{ "steps": [ { "key": "contract_project", "skill": "build-contract-project", "dependsOn": [], "objective": "Build the complete standalone VolatilityGuard Lab Foundry project from the empty source, including initial setup, pinned/vendored ordinary-file dependencies (no submodules), VolatilityGuardHook, VolatilityGuardToken, tests, ABI JSON, documentation and actual validation evidence. This complete-project writer owns project setup and contract deliverables; subsequent writers wait. Set bytecode_hash=none; preserve any protected existing configuration/dependencies if encountered. Implement arbitrary-currency Uniswap v4 hook behavior and the exact VGL/native-ETH launch specification. Verify canonical Sepolia PoolManager 0xe03a1074c86cfedd5c142c4f04f1a1536e203543 and compatible existing verified periphery; no new deployed helper, discretionary admin powers or total-MEV-protection claims. Supply integration inputs for control-plane policy-v2 factory launch without broadcasting. Address blocking review findings within this assignment's source ownership and resubmit for independent review before deployment.", "references": [ "uniswap-v4-hooks", "uniswap-v4-security", "defi-native", "public-rpcs" ], "acceptanceCriteria": [ "VolatilityGuardToken is Volatility Guard Lab (VGL), 18 decimals, no constructor args; fixed 10^27 units minted to deployer, no mint backdoor. Exact pool uses native ETH zero address, VGL, fee 3000, tickSpacing 60 and initial sqrtPriceX96 792281625142643375935439503360000 (0.00000001 ETH/VGL).", "Hook isolates every PoolId; bounded observation ring/TWAP and EWMA volatility drive adaptive price-deviation limits and rolling volume budgets resistant to split swaps. NORMAL/WARMUP/GUARDED/RECOVERY, stale and low-liquidity handling and deterministic recovery are specified and tested.", "Authenticate canonical PoolManager callbacks and accounting without trusting sender/hookData identity. Define both swap directions, exact-input/output, currency units, conservative rounding, bounded execution and caps. Initialization/warmup cannot brick the pool; LP exits remain possible; reverted swaps cannot be relied on to persist breaker transitions.", "Offline build, test and fmt checks pass with all dependencies pinned/vendored. Fuzz/invariant/stress tests exercise accounting, pool isolation, manipulation and split volume, unauthorized callbacks, reentrancy, stale history, edge values, recovery and LP exits; report actual test counts, gas, contract sizes, failures and limitations.", "docs/abi/VolatilityGuardHook.json and docs/abi/VolatilityGuardToken.json match source. Architecture/threat-model/integration docs specify exact pool key, hooks/address requirements, supported periphery, real quote/swap/liquidity and supported-position exit recipes, decoded errors and all dashboard read/event units.", "Launch inputs preserve policy v2, specified owners, 80/10/10 allocations, contributor lock/cap, token-only seed/range/rounding, canonical PoolManager and existing gas budget. Explain ETH-first bootstrap and that reverse swaps require accrued ETH liquidity; no extra authority, helpers, keys or broadcasts.", "Evidence and ABI/integration artifacts are sufficient for generated manifest and independent review. Blocking findings are repaired and re-reviewed before control-plane deployment; no fabricated receipts, results or claims." ] }, { "key": "contract_review", "skill": "adversarial-review", "dependsOn": [ "contract_project" ], "objective": "Independently inspect the complete contract source, tests, evidence, ABI/integration docs AND the control-plane-generated launch manifest, read-only. Attack the guard's accounting, economic assumptions, lifecycle and deployment compatibility. Return actionable blocking findings to contract_project for repair and repeat independent review on the repaired source/manifest before authorizing progression. The control plane generates the manifest before this review and performs verified deployment only after all blockers are resolved.", "references": [ "uniswap-v4-hooks", "uniswap-v4-security" ], "acceptanceCriteria": [ "Review covers arbitrary currencies, both directions and exact-input/output, rounding/caps, callback authentication, reentrancy, per-pool isolation, TWAP/EWMA manipulation, split-volume resistance, stale/low-liquidity states, deterministic recovery, revert rollback, warmup and LP exits; examine adversarial test coverage and reported limitations.", "Inspect source and generated manifest together for chain 11155111, canonical PoolManager, ABI/bytecode identity, hook permission/address compatibility, exact pool parameters, fixed supply, ownership/allocation/lock/cap, zero-ETH seed range and liquidity rounding, verified existing periphery and 0.3 ETH gas ceiling.", "Verify offline checks/evidence, no privileged mint or discretionary admin behavior, no extra helper deployment or spending authorization, and usable integration recipes. Explicitly resolve every blocking finding after producer repair; deployment cannot proceed on unresolved blockers." ] }, { "key": "frontend", "paths": [ "web/**", "dist/**", "docs/**", "package.json", "pnpm-lock.yaml", "package-lock.json", "yarn.lock" ], "skill": "frontend-for-contract", "dependsOn": [ "contract_review" ], "objective": "After independent contract review AND actual verified control-plane deployment handoff at .imd/reads/deployment.json, build the complete React/Vite/TypeScript dapp with RainbowKit/wagmi/viem in web/, committed relative-base export in dist/, tests and evidence. This final writer integrates and checks all accepted contract outputs with the frontend against the approved request. Use pinned source, deployed addresses and matching docs/abi/.json hashes; preserve ABIs and integration facts within the explicit frontend scope. Use injected wallets without extra credentials and only existing verified periphery. Finish with source/export/tests and final integration evidence; control-plane services handle publication, naming and reachability validation. Repair frontend defects in this scope. A discovered contract blocker stops frontend acceptance and returns to the pre-deployment contract repair/review gate; resume only with a renewed verified handoff. Do not perform contract review as a post-frontend worker assignment.", "acceptanceCriteria": [ "Public ETH/VGL swap flow supports amounts, direction, balances/max, real quotes, slippage/minimum received, required approvals and wallet-signed swaps; show transaction progress, decoded errors and explorer links. No fabricated production quotes, addresses or receipts; no private keys or worker broadcasts.", "Live dashboard displays tick/TWAP, volatility, deviation, rolling volume, guard state and events from verified deployed contracts. Explain hook behavior, risks and limitations without total-MEV-protection claims; simulation demos are clearly labeled and separate from real transactions.", "Explain token-sided bootstrap: buy with ETH first and gate reverse trades on actual accrued ETH liquidity. Provide supported-position exits through verified periphery with no new helper deployments or unrequested admin features.", "Meaningful tests cover both directions, bootstrap/reverse-liquidity constraints, wallet and wrong-chain states, rejected signing, guard reverts, funds/RPC errors and responsive UI. Report actual results and limitations; production chain is Sepolia only.", "Deliver complete source and tested relative-base dist/ export usable on IPFS, reproducible dependency declarations/lockfile and available offline dependencies needed by verification. Verify ABI hashes against deployment handoff and document integration/test evidence; no service receipts or hosted URL are required to submit worker artifacts.", "Final integration checks join contract source, generated launch manifest, deployment handoff, ABI hashes, frontend and static export: pool parameters, dashboard units/events, quotes, approvals, signed swaps, decoded guard errors and supported exits agree. Record actual test evidence and resolve frontend blockers; contract blockers return to the pre-deployment gate.", "Preserve all specified owners, allocations, Sepolia-only chain, gas ceiling and configured GitHub/Pinata destinations. Overall launch completes only when control-plane services confirm verified live contracts and seeded pool, published real source/receipts/test evidence, and a reachable functional IPFS dapp; later service results are not worker submission prerequisites." ] } ], "version": 1, "questions": [], "sharedInterfaces": "Sequential handoff: contract_project supplies pinned Foundry source/tests, docs/abi/.json and architecture, threat-model and integration docs with exact pool key, units, rounding, decoded errors and quote/swap/liquidity recipes. The control plane inserts its generated launch manifest before contract_review, then handles verified factory deployment and publication; no worker receives keys, broadcasts, commissions factories/policies or deploys helpers. Frontend additionally waits for actual .imd/reads/deployment.json with verified addresses and ABI hashes, never mocks for production. Sepolia only (11155111), univ4_hook policy v2. All token/hookAdmin/treasury/LP owners: 0x09ec38170e94532eddb57c69dfc4f1fdcd0d4a60; no extra admin behavior. Supply: 80% LP, 10% treasury, 10% contributors, 1h contributor lock and 30% per-wallet cap. Factory seeds up to 8e26 VGL, ZERO ETH; deployer derives widest aligned token-only range from opening price/spacing and rounds liquidity down. Existing configured deployer gas ceiling: 0.3 Sepolia ETH, no extra spending/funding. Authorized destinations: signed publisher's configured GitHub org and configured Pinata/IPFS, automatic repository/site naming; no caller repo/CID required. Services publish real source, receipts, evidence and reachable functional site after submissions; these are service completion gates, not worker prerequisites. Sequential writers; frontend performs final integration. No separate research." }