v1.0.0 — Mainnet Launch

[corvid-agent]

<!-- blocked-by: #310 -->

v1.0.0 — Mainnet Launch

Priority: CRITICAL — The destination.

Prerequisites

• v1.0.0-rc ALL gating criteria met
• Owner sign-off received

Launch Checklist

Configuration

• Set ALGORAND_NETWORK=mainnet in production .env
• Set mainnet USDC ASA ID: 31566704
• Set conservative spending limits: 2 ALGO/day initially
• Verify all API keys are production keys (not testnet)
• Verify wallet encryption is using production passphrase

Wallet

• Fund mainnet wallet with initial ALGO for transactions
• Verify wallet can opt-in to USDC ASA (31566704)
• Test a small ALGO transaction on mainnet
• Verify spending cap enforcement on mainnet

Monitoring

• Monitoring active for all critical paths
• Alerting configured for:
  • Spending limit approach (80% threshold)
  • Failed transactions
  • Injection detection CRITICAL events
  • Bridge disconnections
  • Error rate spikes
• Log retention configured (30 days minimum)
• Backup schedule active (daily database backups)

Security Final Check

• All security tests still passing on mainnet config
• Injection detection active on all channels
• Rate limiting active and persistent
• RBAC enforced
• No testnet-only bypasses left in code

Go Live

• Deploy v1.0.0 to production
• Verify health check endpoint returns green
• Send first mainnet AlgoChat message
• Verify USDC deposit detection on mainnet
• Monitor first 24 hours closely

Post-Launch

• Monitor spending patterns and adjust caps as needed
• Collect user feedback from mainnet users
• Track agent reputation scores on mainnet
• Gradual cap increases as confidence builds
• Weekly security log review for first month

All Human-Required Actions

This issue is entirely human-driven:

• Network configuration changes
• Wallet funding
• Monitoring setup
• Final deployment

Dependencies

• v1.0.0-rc (Release Candidate) — all gating criteria met

[corvid-agent]

Dependencies

• Blocked by: v1.0.0-rc — Release Candidate #310 (Release Candidate) — ALL gating criteria must be met

Entirely Human-Driven

This issue requires manual configuration changes, wallet funding, and deployment.

[corvid-agent]

Acknowledged. This is the mainnet launch checklist — entirely human-driven as noted.

Current status: Blocked by #310 (v1.0.0-rc). The RC gating criteria and owner sign-off are prerequisites before any launch steps begin.

What I can help with when the time comes:

• Verifying security tests pass against mainnet config
• Confirming no testnet-only bypasses remain in code (ALGORAND_NETWORK guards, hardcoded testnet ASA IDs, etc.)
• Running a final spec compliance check
• Validating health check endpoint post-deploy

What requires human action:

• All configuration changes (env vars, spending limits, API keys)
• Wallet funding and initial mainnet transactions
• Monitoring/alerting setup and log retention
• Final deployment and 24-hour monitoring
• Owner sign-off

Standing by until #310 is resolved and you're ready to proceed with launch prep.

[corvid-agent]

Security Final Check — Code Audit Results (2026-04-04)

Audited the "No testnet-only bypasses left in code" checklist item. All findings are clean.

Testnet/Localnet Conditional Patterns Reviewed

Location	Pattern	Assessment
server/algochat/init.ts:135-139	Mainnet: throws fatal; testnet: warns and continues	✅ Safe — mainnet is always fatal
server/algochat/agent-wallet.ts:80-113	Legacy fallback throws on non-localnet	✅ Safe — mainnet/testnet require KeyProvider
server/algochat/service.ts:226-241	No mnemonic + not localnet/testnet → returns null	✅ Safe — mainnet refuses to init without mnemonic
server/lib/key-provider.ts:136	assertProductionReady no-op on localnet	✅ Safe — localnet skip is intentional, mainnet enforced
server/lib/key-provider.ts:190	detectPlaintextKeyConfig no-op on localnet	✅ Safe — mainnet makes this fatal
server/algochat/message-router.ts:337,576	Agent wallet features gated to localnet only	✅ Safe — feature gate, not security bypass

Security Test Results

• 9717 tests pass, 0 fail — including all injection, key rotation, cross-tenant, spending cap, and RBAC suites

Spec Validation

• 210 specs checked: 210 passed, 0 warnings — 100% file and LOC coverage

Dependency Audit

• 1 moderate vulnerability in @anthropic-ai/sdk (GHSA-5474-4w2j-mq4c) — already addressed by PR security(deps): update @anthropic-ai/claude-agent-sdk to 0.2.92 #1819 (green, ready to merge)

Conclusion

✅ No testnet-only security bypasses found in production code paths. All network-conditional logic is properly gated: mainnet always enforces strict security; testnet/localnet relaxations are intentional development affordances that cannot be triggered on mainnet.

This checklist item can be marked done once PR #1819 is merged to resolve the transitive SDK vulnerability.

— Jackdaw

[corvid-agent]

v1.0.0 Master Plan — Updated 2026-04-13

The RC gate is green (9,244 tests, 195 specs, all security checks pass). Now we need to go from "technically ready" to "perfect launch with great onboarding." Here's the full plan organized by phase.

---

Phase 1: Foundation (Launch Blockers)

These MUST be done before 1.0.0 ships.

Issue	Title	Owner	Status
#1487	One-command deployment (curl | bash or docker compose up)	Jackdaw	Open
#1490	Self-service configuration (UI/CLI, no code editing)	Jackdaw	Open
#1987	NEW Getting Started guide & README rewrite	Magpie	Open
#1988	NEW E2E test suite full green run	Jackdaw	Open
#1991	NEW Backup, restore & disaster recovery docs	Rook	Open
#538	Demo video (2-minute walkthrough)	Leif (human)	Open
#430	2FA enforcement at org level	Leif (human)	Open
#465	GitHub secret scanning enabled	Leif (human)	Open

Manual RC checks still pending (from #310):

• 3+ external testnet users running stable instances
• Zero critical issues reported by testnet users
• Self-hosting docs validated by external users
• Owner security posture review complete
• Owner sign-off on mainnet readiness

---

Phase 2: Polish (Should ship with 1.0.0)

Strong differentiators that make the launch impressive.

Issue	Title	Owner	Status
#1611	Design token consistency audit (UI polish)	Merlin	Open
#1549	Secure remote access beyond localhost	Rook → Jackdaw	Open
#1489	Plugin/integration system documentation	Jackdaw	Open
#1989	NEW Performance benchmarks (API p95, resource usage)	Condor	Open
#1990	NEW Release notes & changelog compilation	CorvidAgent	Open

---

Phase 3: Strategic (1.0.x or 1.1.0)

Important long-term goals, but don't block the initial launch.

Issue	Title	Owner	Status
#1458	Full on-chain transparency	Team	Open
#1459	Grow the flock — multi-agent coordination	Team	Open
#1460	Frictionless adoption (umbrella)	Team	Open
#1623	Three.js dual-mode views	Starling	Open
#1500	Ollama/Cursor quality regression cadence	Condor	Open

---

Team Assignments Summary

Agent	Phase 1	Phase 2
CorvidAgent	Coordination, plan tracking, PR audit	Release notes (#1990)
Jackdaw	#1487 (deploy), #1490 (config), #1988 (E2E)	#1549 (remote access impl), #1489 (plugins)
Rook	#1991 (backup/DR docs), security review	#1549 (security design)
Magpie	#1987 (README/getting started)	#1611 triage
Merlin	—	#1611 (design tokens)
Condor	—	#1989 (benchmarks)
Starling	—	— (Phase 3: #1623)
Leif	#538 (demo), #430 (2FA), #465 (scanning), sign-off	Final review

---

What "Perfect" Looks Like

1. Install in 1 command — curl ... | bash or docker compose up → working instance
2. First agent session in 5 minutes — guided setup, no .env editing
3. Understand value in 2 minutes — demo video, clear README
4. Confidence in production — E2E green, benchmarks documented, backup/restore proven
5. Security posture — 2FA, secret scanning, remote access design documented
6. Professional launch — release notes, changelog, GitHub Release

Suggested Priority Order

1. One-command deployment or hosted option #1487 (one-command deploy) + v1.0.0: Getting Started guide & README rewrite for new users #1987 (getting started guide) — the front door
2. Self-service configuration (no code touching) #1490 (self-service config) — remove friction after install
3. v1.0.0: E2E test suite full green run #1988 (E2E green) + v1.0.0: Backup, restore & disaster recovery documentation #1991 (backup docs) — confidence
4. UI: Design token consistency audit across all feature pages #1611 (UI polish) + v1.0.0: Performance benchmarks — API p95 latency & resource usage #1989 (benchmarks) — professionalism
5. v1.0.0: Release notes & changelog compilation #1990 (release notes) + docs: record a 2-minute demo video #538 (demo) — the launch itself
6. Human items: 2FA, secret scanning, testnet users, sign-off

[corvid-agent]

Status Update — 2026-04-20

All agent-actionable Phase 1 and Phase 2 sub-issues are now closed:

Issue	Title	Status
#1487	One-command deployment	✅ Closed
#1490	Self-service configuration	✅ Closed
#1987	Getting Started guide & README rewrite	✅ Closed
#1988	E2E test suite full green run	✅ Closed
#1991	Backup, restore & disaster recovery docs	✅ Closed
#1989	Performance benchmarks	✅ Closed
#1990	Release notes & changelog	✅ Closed
#1549	Secure remote access	✅ Closed

Open PRs (CI green, MERGEABLE)

• feat(client): design token audit — fix hardcoded colors in dashboard #2112 — Design token audit (Merlin)
• feat(client): dashboard dual-mode view — Basic stats + Three.js 3D agent visualization #2113 — Dashboard dual-mode / Three.js view (Starling)

Remaining for humans (Leif)

• Set ALGORAND_NETWORK=mainnet and production env vars
• Fund mainnet wallet, verify USDC opt-in
• Configure monitoring/alerting and log retention
• Enable 2FA at org level (security: enforce 2FA at org level and complete access audit #430)
• Enable GitHub secret scanning (Security: Enable GitHub secret scanning on CorvidLabs and 0xLeif orgs #465)
• Record 2-minute demo video (docs: record a 2-minute demo video #538)
• 3+ external testnet users running stable instances
• Owner security posture review + sign-off

Agent queue is clear. Standing by for human sign-off to proceed with launch.

— Jackdaw