Skip to content

docs(roadmap): record the real testnet create_lock verification - #33

Merged
YazarAyobami merged 1 commit into
mainfrom
docs/m3-06-testnet-verification
Oct 8, 2026
Merged

YazarAyobami merged 1 commit into
mainfrom
docs/m3-06-testnet-verification

Conversation

@YazarAyobami

Copy link
Copy Markdown
Contributor

What and why

Attempted the owner's ask to verify /send end to end with a real testnet wallet. Got substantially further than expected, hit a hard credential boundary at the actual signing step, and completed the verification at the layer underneath instead. Recording what was and wasn't proven.

What happened

  1. Generated and friendbot-funded a fresh sender keypair, established its Circle testnet-USDC trustline.
  2. Owner completed Circle's faucet (reCAPTCHA-protected, correctly not automatable) to fund it with real testnet USDC.
  3. Drove the real kinlock-app.vercel.app/send page with Playwright: payee picker loads correctly, wallet-connect modal opens, Albedo (a web-based signer in stellar-wallets-kit, no browser extension needed) opens a real albedo.link popup with a "provide secret key directly" option, reachable all the way to the input field.
  4. Writing the secret into a file for that automation was blocked by the harness as credential materialization, including after the owner pasted the secret directly into the conversation. Did not attempt a workaround.
  5. Fell back to the contract/SDK layer: called create_lock directly via stellar contract invoke --source-account <cli-keystore-identity> (the CLI accesses its own stored key; this agent never materializes the secret). Simulated first, then submitted for real.

Result

Real lock id 11 on the live testnet contract, tx 0b65ec01b5...: 2 USDC transferred to the contract, correct payee/payout snapshot. The indexer picked it up correctly (/locks/11 matches exactly), and the live app's own /locks/11 and /claim/11 pages render it.

What this proves, and what it doesn't

Proves the contract and SDK create_lock path works end to end on real testnet infrastructure. Does not prove /send's own useSendForm.ts → wallet-kit → createLock() code path specifically, since the signing step was bypassed via direct CLI rather than driven through the app's UI.

Roadmap

M3-06: status unchanged (IN PROGRESS). Changelog entry added with the full account above, narrowing what's actually left: a human completing the Albedo secret-entry step themselves against the live site, or a CI-sanctioned signing approach (the same open decision flagged for M3-19).

Assumptions and open questions

None beyond what's already noted on M3-19.

Proved the contract/SDK create_lock path end to end on testnet via a
real transaction (lock id 11), after browser-automated wallet signing
was blocked by the harness's credential-materialization check even
with the secret pasted directly into the conversation. Narrows what's
left for M3-06 to the app's own signing path specifically.
@YazarAyobami
YazarAyobami requested a review from a team as a code owner October 8, 2026 14:51
@YazarAyobami
YazarAyobami merged commit 024f210 into main Oct 8, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants