Ayinkx01 · Oct 28, 2026 · Oct 28, 2026
@@ -72,10 +72,10 @@ No releases yet. No tagged release, binaries, or crates.io publication.
 
 ## Issue backlog
 
-- **Total open issues:** 112
-- **Trivial:** 7
+- **Total open issues:** 110
+- **Trivial:** 6
 - **Medium:** 78
-- **High:** 27
+- **High:** 26
 
 Issue complexity is assigned from the scope of each individual issue rather than
 an aggregate reward target. Complexity was not inflated. Most of the backlog is

@@ -69,10 +69,10 @@ reason and confirm dates in the Drips dashboard.
 
 ## Contributor opportunities
 
-The backlog contains 112 open issues: 82 Drips-ready, 24 blocked by dependencies,
-3 needing revision, and 3 deferred. Five of the 82 are implemented or partially
-implemented on `main` and are excluded from the board pending closure or re-scope
-(#1, #7, #20, #25, #33). [WAVE_BOARD.md](WAVE_BOARD.md) curates 20 independent,
+The backlog contains 110 open issues: 77 Drips-ready, 24 blocked by dependencies,
+6 needing revision, and 3 deferred. #20 and #33 were closed as completed after the
+merge; #1, #7, and #25 are partially implemented and marked
+`status/needs-revision`. [WAVE_BOARD.md](WAVE_BOARD.md) curates 20 independent,
 Wave-sized issues (3 trivial, 13 medium, 4 high; 3,050 points).
 Backlog issues are proposed work, not completed functionality. Check current
 issue states and assignment requirements before describing specific issues as

@@ -3,10 +3,10 @@
 Generated from `tools/backlog/issues_*.json`. The GitHub issue numbers are
 assigned on creation; titles are the stable identifier.
 
-- **Total issues:** 112
-- **Trivial:** 7
+- **Total issues:** 110
+- **Trivial:** 6
 - **Medium:** 78
-- **High:** 27
+- **High:** 26
 
 Complexity is assigned from the scope of each individual issue, not from an
 aggregate reward target. Drips determines applicable points and budgets
@@ -19,7 +19,6 @@ through its own system.
 | #98 | feat(cli): add verbosity control | cli | trivial | Structured logging issue. | yes | yes | yes |
 | #76 | feat(ledger): add ledger sequence and close-time helpers | rpc | trivial | None. | yes | yes | yes |
 | #6 | feat(rpc): add a typed model for getFeeStats | rpc | trivial | None. | yes | yes | yes |
-| #33 | test(cli): assert the exit-code contract | cli | trivial | None. | yes | yes | yes |
 | #40 | test(core): add deterministic snapshot tests for core types | core | trivial | Error taxonomy issue. | yes | yes | yes |
 | #105 | chore(ci): add triage automation for issues and pull requests | github | medium | None. | yes | yes | yes |
 | #34 | ci(msrv): pin and test a minimum supported Rust version | release | medium | None. | yes | yes | yes |
@@ -125,7 +124,6 @@ through its own system.
 | #12 | feat(xdr): define a versioned JSON schema for decoded values | xdr | high | None. | yes | yes | yes |
 | #93 | test(contracts): add fixture WASM contracts | contract-inspection | high | WASM spec extraction issue. | yes | yes | yes |
 | #47 | test(rpc): add a local integration test server | rpc | high | Live transport issue. | yes | yes | yes |
-| #20 | test(security): add a fuzz target for XDR and SCVal decoding | security | high | None. | yes | yes | yes |
 
 ## Notes
 

@@ -1,8 +1,8 @@
 # Drips Issue Quality Audit
 
 - **Audit date:** 2026-10-28
-- **Repository commit audited:** aec759c
-- **Issues classified:** 112 open issues.
+- **Repository commit audited:** 1f91cbf
+- **Issues classified:** 110 open issues.
 
 Standard applied: Drips *Creating Meaningful Issues* and the Wave maintainer
 documentation. Classification is evidence-based; weak issues are flagged, not
@@ -12,17 +12,17 @@ hidden. Nothing here claims Drips approval.
 
 | Classification | Count |
 |---|---:|
-| Drips-ready | 82 |
-| Needs revision | 3 |
+| Drips-ready | 77 |
+| Needs revision | 6 |
 | Must split | 0 |
 | Must merge | 0 |
 | Remove | 0 |
 | Defer | 3 |
 | Blocked | 24 |
 
-> **Post-merge note (2026-10-28):** #1, #7, #20, #25,
-> and #33 have merged or partial implementation on `main` and are excluded
-> from `docs/WAVE_BOARD.md` pending maintainer closure or re-scope.
+> **Post-merge note (2026-10-28):** #20 and #33 were
+> implemented in the merged work and closed. #1, #7, and #25 are partially
+> implemented and marked `status/needs-revision`. See `docs/WAVE_BOARD.md`.
 
 No issue required splitting: the largest issues are already scoped to a single
 capability, and the previously broad areas had already been decomposed.
@@ -35,10 +35,10 @@ through its own system.
 
 | Complexity | Count |
 |---|---:|
-| High | 27 |
+| High | 26 |
 | Medium | 78 |
-| Trivial | 7 |
-| **Total** | **112** |
+| Trivial | 6 |
+| **Total** | **110** |
 
 No complexity label was changed during this audit: no issue was found to be
 clearly underpriced or overpriced. Complexity was not inflated.
@@ -47,7 +47,7 @@ clearly underpriced or overpriced. Complexity was not inflated.
 
 ### #1 — feat(rpc): implement a live HTTP transport over the official client
 
-- Classification: **Drips-ready**
+- Classification: **Needs revision**
 - Complexity: high
 - Area: rpc
 - Impact: PASS — maps to a real capability of the toolkit.
@@ -58,7 +58,7 @@ clearly underpriced or overpriced. Complexity was not inflated.
 - Security: N/A or addressed where relevant.
 - Dependencies: None.
 - Duplication: PASS.
-- Final recommendation: Drips-ready.
+- Final recommendation: Needs revision.
 
 ### #2 — feat(rpc): add timeouts and cancellation to RPC calls
 
@@ -137,7 +137,7 @@ clearly underpriced or overpriced. Complexity was not inflated.
 
 ### #7 — feat(core): add a configuration system with file and environment support
 
-- Classification: **Drips-ready**
+- Classification: **Needs revision**
 - Complexity: medium
 - Area: core
 - Impact: PASS — maps to a real capability of the toolkit.
@@ -148,7 +148,7 @@ clearly underpriced or overpriced. Complexity was not inflated.
 - Security: N/A or addressed where relevant.
 - Dependencies: None.
 - Duplication: PASS.
-- Final recommendation: Drips-ready.
+- Final recommendation: Needs revision.
 
 ### #8 — feat(config): resolve network profiles and custom endpoints
 
@@ -330,21 +330,6 @@ clearly underpriced or overpriced. Complexity was not inflated.
 - Duplication: PASS.
 - Final recommendation: Drips-ready.
 
-### #20 — test(security): add a fuzz target for XDR and SCVal decoding
-
-- Classification: **Drips-ready**
-- Complexity: high
-- Area: security
-- Impact: PASS — maps to a real capability of the toolkit.
-- Context: PASS — problem, why, current state, and scope sections present.
-- Scope: PASS — a single capability, Wave-sized.
-- Acceptance criteria: PASS — testable criteria present.
-- Testing: PASS — tests requested.
-- Security: N/A or addressed where relevant.
-- Dependencies: None.
-- Duplication: PASS.
-- Final recommendation: Drips-ready.
-
 ### #21 — feat(security): harden the HTTP transport against SSRF and unsafe redirects
 
 - Classification: **Blocked by dependency**
@@ -407,7 +392,7 @@ clearly underpriced or overpriced. Complexity was not inflated.
 
 ### #25 — feat(contracts): inspect WASM contract specs via soroban-spec
 
-- Classification: **Drips-ready**
+- Classification: **Needs revision**
 - Complexity: high
 - Area: contract-inspection
 - Impact: PASS — maps to a real capability of the toolkit.
@@ -418,7 +403,7 @@ clearly underpriced or overpriced. Complexity was not inflated.
 - Security: N/A or addressed where relevant.
 - Dependencies: None.
 - Duplication: PASS.
-- Final recommendation: Drips-ready.
+- Final recommendation: Needs revision.
 
 ### #26 — feat(transactions): add an envelope summary command
 
@@ -525,21 +510,6 @@ clearly underpriced or overpriced. Complexity was not inflated.
 - Duplication: PASS.
 - Final recommendation: Blocked by dependency.
 
-### #33 — test(cli): assert the exit-code contract
-
-- Classification: **Drips-ready**
-- Complexity: trivial
-- Area: cli
-- Impact: PASS — maps to a real capability of the toolkit.
-- Context: PASS — problem, why, current state, and scope sections present.
-- Scope: PASS — a single capability, Wave-sized.
-- Acceptance criteria: PASS — testable criteria present.
-- Testing: PASS — tests requested.
-- Security: N/A or addressed where relevant.
-- Dependencies: None.
-- Duplication: PASS.
-- Final recommendation: Drips-ready.
-
 ### #34 — ci(msrv): pin and test a minimum supported Rust version
 
 - Classification: **Drips-ready**
@@ -1729,13 +1699,11 @@ clearly underpriced or overpriced. Complexity was not inflated.
 
 | Issue | Title | Complexity | Area | Why it is Wave-ready |
 |---|---|---:|---|---|
-| #1 | feat(rpc): implement a live HTTP transport over the official client | high | rpc | Depends only on implemented or independent work; testable. |
 | #2 | feat(rpc): add timeouts and cancellation to RPC calls | medium | rpc | Depends only on implemented or independent work; testable. |
 | #3 | feat(rpc): add exponential backoff with jitter to retries | medium | rpc | Depends only on implemented or independent work; testable. |
 | #4 | feat(rpc): add a typed model for getLedgerEntries | medium | rpc | Depends only on implemented or independent work; testable. |
 | #5 | feat(rpc): add typed models for getTransaction and getTransactions | medium | rpc | Depends only on implemented or independent work; testable. |
 | #6 | feat(rpc): add a typed model for getFeeStats | trivial | rpc | Depends only on implemented or independent work; testable. |
-| #7 | feat(core): add a configuration system with file and environment support | medium | core | Depends only on implemented or independent work; testable. |
 | #8 | feat(config): resolve network profiles and custom endpoints | medium | rpc | Depends only on implemented or independent work; testable. |
 | #10 | feat(core): add structured logging with levels | medium | core | Depends only on implemented or independent work; testable. |
 | #11 | feat(scval): add curated human-readable rendering for common SCVal types | high | xdr | Depends only on implemented or independent work; testable. |
@@ -1747,17 +1715,14 @@ clearly underpriced or overpriced. Complexity was not inflated.
 | #17 | feat(testing): add a fixture loader and schema | high | testing | Depends only on implemented or independent work; testable. |
 | #18 | feat(testing): add mock RPC network scenarios | medium | rpc | Depends only on implemented or independent work; testable. |
 | #19 | test(xdr): add property-based round-trip tests | medium | xdr | Depends only on implemented or independent work; testable. |
-| #20 | test(security): add a fuzz target for XDR and SCVal decoding | high | security | Depends only on implemented or independent work; testable. |
 | #22 | feat(security): redact secrets in logs and output | medium | security | Depends only on implemented or independent work; testable. |
 | #24 | feat(github): add a composite Action to run DevKit checks | high | github | Depends only on implemented or independent work; testable. |
-| #25 | feat(contracts): inspect WASM contract specs via soroban-spec | high | contract-inspection | Depends only on implemented or independent work; testable. |
 | #26 | feat(transactions): add an envelope summary command | medium | transactions | Depends only on implemented or independent work; testable. |
 | #27 | feat(events): add a typed getEvents model with pagination | high | rpc | Depends only on implemented or independent work; testable. |
 | #28 | perf(observability): benchmark decode throughput | medium | observability | Depends only on implemented or independent work; testable. |
 | #29 | ci(release): build and attach cross-platform release binaries | high | release | Depends only on implemented or independent work; testable. |
 | #30 | feat(cli): add shell completion generation | trivial | cli | Depends only on implemented or independent work; testable. |
 | #31 | ci(deps): configure automated dependency updates | trivial | release | Depends only on implemented or independent work; testable. |
-| #33 | test(cli): assert the exit-code contract | trivial | cli | Depends only on implemented or independent work; testable. |
 | #34 | ci(msrv): pin and test a minimum supported Rust version | medium | release | Depends only on implemented or independent work; testable. |
 | #36 | feat(core): define a categorized error taxonomy | medium | core | Depends only on implemented or independent work; testable. |
 | #37 | feat(core): add shared Severity and Confidence models | medium | core | Depends only on implemented or independent work; testable. |
@@ -1816,9 +1781,12 @@ clearly underpriced or overpriced. Complexity was not inflated.
 
 | Issue | Problem | Required Action |
 |---|---|---|
+| #1 | Needs revision | Revise the issue body before it can be Wave-ready. |
+| #7 | Needs revision | Revise the issue body before it can be Wave-ready. |
 | #9 | Blocked by dependency | Label status/blocked; add to a Wave only after the dependency lands. |
 | #21 | Blocked by dependency | Label status/blocked; add to a Wave only after the dependency lands. |
 | #23 | Blocked by dependency | Label status/blocked; add to a Wave only after the dependency lands. |
+| #25 | Needs revision | Revise the issue body before it can be Wave-ready. |
 | #32 | Blocked by dependency | Label status/blocked; add to a Wave only after the dependency lands. |
 | #35 | Defer / future work | Label status/deferred; revisit when the subsystem is planned. |
 | #42 | Defer / future work | Label status/deferred; revisit when the subsystem is planned. |

@@ -94,10 +94,10 @@ exact scope.
 
 ## Issue quality and backlog
 
-There are 112 open issues: 82 Drips-ready, 24 blocked, 3 needing revision, and 3
-deferred. Five of the 82 are implemented or partially implemented on `main` and
-are excluded from the Wave board pending closure or re-scope (#1, #7, #20, #25,
-#33). The audit and manifest are regenerated from live GitHub issue numbers:
+There are 110 open issues: 77 Drips-ready, 24 blocked, 6 needing revision, and 3
+deferred. #20 and #33 were closed as completed after the merge; #1, #7, and #25
+are partially implemented and marked `status/needs-revision`. The audit and
+manifest are regenerated from live GitHub issue numbers:
 
 - [DRIPS_ISSUE_QUALITY_AUDIT.md](DRIPS_ISSUE_QUALITY_AUDIT.md)
 - [DRIPS_ISSUE_AUDIT.md](DRIPS_ISSUE_AUDIT.md)

@@ -17,8 +17,8 @@ Audit date: 2026-10-28. Commit: `aec759c`.
 | No secrets in repo | Verified | No secrets; `.gitignore` excludes keys/env |
 | No placeholder/fake implementations | Verified | CLI exposes only commands that do real work |
 | Documentation for public features | Verified | README plus the `docs/` set |
-| Issue backlog present | Verified | 112 open issues |
-| Issue complexity honest | Verified | 7 trivial / 78 medium / 27 high |
+| Issue backlog present | Verified | 110 open issues |
+| Issue complexity honest | Verified | 6 trivial / 78 medium / 26 high |
 | Live RPC transport | Verified | `devkit_rpc::HttpTransport`; `rpc-health`; CI tests |
 | Contract inspection | Verified | `inspect-wasm`; `devkit-contract` tests |
 | Security analysis + SARIF | Verified (structural) | `devkit-analysis`; `analyze-wasm --format sarif` |

@@ -3,9 +3,9 @@
 Generated from `tools/backlog/issues_*.json`. Closed and superseded
 definitions are excluded.
 
-**Total open issues:** 112
+**Total open issues:** 110
 
-Complexity: 7 trivial, 78 medium, 27 high.
+Complexity: 6 trivial, 78 medium, 26 high.
 
 ## phase/01-foundation
 
@@ -106,7 +106,6 @@ Complexity: 7 trivial, 78 medium, 27 high.
 
 | # | Title | Area | Complexity | Dependencies |
 | - | ----- | ---- | ---------- | ------------ |
-| #20 | test(security): add a fuzz target for XDR and SCVal decoding | security | high | None. |
 | #21 | feat(security): harden the HTTP transport against SSRF and unsafe redirects | rpc | high | Live transport issue. |
 | #22 | feat(security): redact secrets in logs and output | security | medium | None. |
 | #78 | feat(security): design and implement the rule engine architecture | security | high | Severity/Confidence models. |
@@ -127,7 +126,6 @@ Complexity: 7 trivial, 78 medium, 27 high.
 | #10 | feat(core): add structured logging with levels | core | medium | None. |
 | #30 | feat(cli): add shell completion generation | cli | trivial | None. |
 | #32 | feat(cli): add config init, show, and validate subcommands | cli | medium | Configuration system issue. |
-| #33 | test(cli): assert the exit-code contract | cli | trivial | None. |
 | #96 | feat(cli): unify global flags across commands | cli | medium | None. |
 | #97 | feat(cli): improve error presentation with suggestions | cli | medium | Secret redaction issue. |
 | #98 | feat(cli): add verbosity control | cli | trivial | Structured logging issue. |
@@ -189,9 +187,9 @@ Complexity: 7 trivial, 78 medium, 27 high.
 | phase/04-analysis | 15 |
 | phase/05-contracts | 10 |
 | phase/06-testing | 7 |
-| phase/07-security | 12 |
-| phase/08-cli | 8 |
+| phase/07-security | 11 |
+| phase/08-cli | 7 |
 | phase/09-github | 10 |
 | phase/10-observability | 5 |
 | phase/12-release | 7 |
-| **Total** | **112** |
+| **Total** | **110** |
@@ -79,11 +79,10 @@ workflow and checklist exist, but publishing remains outstanding work.
 
 ## Contributor backlog
 
-There are 112 open issues: 82 Drips-ready, 24 blocked by dependencies, 3 needing
-revision, and 3 deferred. Five of the 82 are implemented or partially
-implemented on `main` and are excluded from the Wave board pending closure or
-re-scope (#1, #7, #20, #25, #33). The backlog is a roadmap, not a list of
-completed features. Audit counts, labels, and issue descriptions must not be presented as
+There are 110 open issues: 77 Drips-ready, 24 blocked by dependencies, 6 needing
+revision, and 3 deferred. #20 and #33 were closed as completed after the merge;
+#1, #7, and #25 are partially implemented and marked `status/needs-revision`.
+The backlog is a roadmap, not a list of completed features. Audit counts, labels, and issue descriptions must not be presented as
 proof that the corresponding work is implemented.
 
 See [ISSUE_BACKLOG.md](ISSUE_BACKLOG.md),

@@ -31,7 +31,7 @@ This roadmap distinguishes **Completed** (works today), **In progress**, and
 
 ## Planned (issue-backed phases)
 
-There are 112 open issues. The counts below come from the current labels.
+There are 110 open issues. The counts below come from the current labels.
 
 | Phase | Focus | Issues |
 | ----- | ----- | ------ |
@@ -41,8 +41,8 @@ There are 112 open issues. The counts below come from the current labels.
 | 04 Analysis | Envelope/operation/fee/signature/memo/bounds/footprint/result analysis, events, ledger helpers | 15 |
 | 05 Contracts | Contract IDs, storage, events-to-spec, environment, CLI | 10 |
 | 06 Testing | Fixture loader, snapshots, cross-platform, corpus runner, WASM fixtures | 7 |
-| 07 Security | Rule engine, findings, suppression, corpus, FP/FN tests, metadata/WASM/RPC hardening, SARIF catalog | 12 |
-| 08 CLI / config | Configuration, profiles, global flags, error UX, verbosity, JSON errors, stdin | 8 |
+| 07 Security | Rule engine, findings, suppression, corpus, FP/FN tests, metadata/WASM/RPC hardening, SARIF catalog | 11 |
+| 08 CLI / config | Configuration, profiles, global flags, error UX, verbosity, JSON errors, stdin | 7 |
 | 09 GitHub / CI | Action, reusable workflow, SARIF upload, baseline, triage, auditing | 10 |
 | 10 Performance / observability | RPC and decode benchmarks, cache, regression tests, logging | 5 |
 | 12 Release | Versioning policy, crates.io readiness, SBOM, compatibility matrix | 7 |