Bitcorn — status

Security / authorization — 22 items

• Unauthenticated open-channel routes + guardrail bypass, behind a public endpoint
• /api/swaps/loop-out — an authorization gap, not an unguarded route
• /api/admin/swaps/loop-out — a design question, not only an authorization gap
• /api/swaps/loop-in — the live mirror of the inert Loop Out role-field skip
• /api/pay — unauthenticated arbitrary-invoice payment, no UI caller
• /api/member/open-channel — post-v1.18.6 authorization delta
• POST/DELETE /api/autobuy/credentials — node-role check only, exempt from confirmation
• POST /api/treasury/capital-policy — node-role only, exempt from confirmation, and it configures the guardrail layer
• POST /api/subscription/token — the replay window in the proof-of-possession check
• Two state-mutating GETs — /api/node/address and /api/coinbase/onramp-url each mint a fresh on-chain address
• Ungated capital-moving routes outside any /api/admin/ + /api/treasury/ naming rule
• Loop-* family has no capital guardrail
• Surface (H): 0.0.0.0:3101 reachable on LAN and the tailnet
• The WAF rule is an unversioned operational dependency
• LIT_PASSWORD is a known-value credential guarding a live admin listener ‡
• Secrets scan of the now-known-public repo — proposed, not run
• Node credential scoping
• Credential scoping — PARKED, not dropped
• API mounts the whole LND data dir when it needs two files
• sync.ts vs index.ts case-sensitivity divergence — split-brain role classification
• sync.ts:48 vacuous-comparison shape, latent
• config/env.ts:13 defaults lndGrpcHost to the DNS name proven to fail

CI & release tooling — 18 items

• docker-publish.yml and the version-bump check disagree about what counts as a release
• docker-publish.yml claims its paths: filter was tested programmatically — the named job contains no such step *
• docker-publish.yml's duplicate-tag assert stores cardinalities in its own failure text
• Worker npm run deploy has no pre-deploy gate
• CI grep gate for direct Worker fetches
• Worker-side browser-origin detector
• Bare $GITHUB_RUN_ID in heredocs under set -euo pipefail
• Node-20-deprecated action majors, force-run on newer Node
• Skipped-satisfies-required, unexercised on this repo
• Which side's workflow file executes on a pull_request event — unverified
• pr-checks.yml version-bump job is blind to bump-shaped commits
• pr-checks gate detection gap — did-not-fire indistinguishable from pending *
• docs/release-history.md is behind (seven releases at last read; shape now decided as generated) *
• docs/RELEASE.md hardcodes "four paths entries" at two sites
• docs/RELEASE.md is stale at six sites plus two satellite files
• RELEASE.md's rollback is not expressible as an image-tag sed for a backend-changing release
• origin/release/v1.18.9 survived its merge — the second release-branch residue
• bitcorn-status pins no Node version at all — the status page builds on whatever the runner image ships

LND reliability & sync loop — 13 items

• index.ts:248 sync-loop log discards ln-service error discriminants
• defaultLndProbeDeps() throws under the test runner
• Seventh fault kind — separating wedged-but-connected from refused
• Query-string dispatch: exact-equality routes 404 on any query
• Two sync-tick steps fetch the same LND data twice
• withProbeTimeout leaks its timer on a synchronous throw
• Per-tick budget for the 15s sync loop — deferred
• LND_GOSSIP_CALL_TIMEOUT_MS = 10s is argued, not derived
• LND_SYNC_TIMING_LEVEL is undocumented
• Stale cross-file citations in lndHealth.ts and lndProbeRoute.ts
• loopAvailability.ts bare catches would swallow a fired Loop deadline
• LND fault harness lives outside version control
• LND self-open semantics for POST /api/member/open-channel — needs regtest

Cleanup / hygiene / smaller — 12 items

• Delete stale app/api/dist/rebalance/
• .agents/, .codex/, AGENTS.md untracked — worktree removal needs --force
• Two stale claims in the port-3101 containment record
• Three stale remote branches survived the ~190-branch sweep
• The ~190-branch sweep was remote-only — the local checkout still carries the graveyard
• Duplicated CJS entrypoint guard comment in index.ts
• worktree.symlinkDirectories for worktree disk cost
• cloudflared:latest floats
• Stage 5b (admin subscriptions view) + Stage 6 (Tier 3 live promotion)
• types/ln-service.d.ts fabrication audit
• The web actionConfirmation.ts carries a false parenthetical about three uncalled routes
• The runtime ABI-check promotion named by learnings.md, deliberately not built there

loopd / Loop compose swap — 11 items

• Compose-swap risk posture: three upstream lightninglabs/loop facts
• env.ts:69 "broken ARM builds" comment goes stale at the swap ‡
• Loop release-manifest signature verification is deferred
• The version triplet becomes an ungated quadruplet at the compose swap
• org.opencontainers.image.version reads latest on the published loopd image
• docs/LOOP_SETUP.md is stale at :46, :99, :148 ‡
• docs/LOOP_SETUP.md predates the litd sidecar in places
• The loopd swap mutates litd's directory even with no schema migration — now occurred on the live fleet *
• docker-compose.yml is absent from docker-publish's paths: filter
• getSwapClient() caches against litd's own self-signed cert with no gate
• quoted_fee_sat may include the prepay hold in the guardrail fee math — unverified, money-path *

Banners & member-facing copy — 11 items

• Member-facing "contact your operator" copy violates the no-operator convention
• SubscriptionPanel.tsx:754 "Contact operator" wired to a dead placeholder mailto
• Two remediation banners contradict on the same member dashboard
• certExpiryMessage's nowMs parameter is dead
• A third one-step remediation variant — lndFaultAlerts.ts's cert escalation
• certExpiryNotice.test.ts hardcodes both API strings as fixtures — a mirror that rots silently
• never_synced + expired cert renders reassuring-and-wrong copy
• channelStaleness.test.ts operator-ban loop has no anti-vacuity probe
• Pin dispositions for the banner reconciliation
• Farmer-facing Loop-unavailability is invisible or hostile in three ways
• Member node unreachable-to-treasury plus "VALUATION UNAVAILABLE" — Phase 1 recon reported, awaiting Ethan's confirmation; in that state a member cannot pay by any route the product offers *

Infrastructure & process — 10 items

• Fifteen broken done-when queries — proven replacements landed, reconcile re-run pending *
• SOURCE_REPOS_READ_TOKEN expires 2026-11-29 and fails silently when it lapses
• status/agenda.md's footer position is load-bearing and unenforced
• The status-page agenda regeneration is an instruction — nothing fires it and nothing detects that it has not run
• Top the deployer wallet
• Workflow-tooling remainder
• App-repo CLAUDE.md documents a rate-limit default 200× smaller than the code's
• Loop classification covers one of eight rpcCall entry points
• channelClassifier.ts declares three config fields, defaults them, and never reads them
• BACKLOG.md structure program — all moves done (34 entries archived, pass headers to passes/, cross-arc constraints to CROSS_ARC_CONSTRAINTS.md); 3b's implementation in bitcorn-status and a closing report outstanding *

Capital guardrails — 9 items

• Stale-state fail-open in the capital guardrails
• The sync loop auto-fails expansion executions stuck >1h
• The freshness primitive already exists, used for display only
• openTreasuryChannel is HELD-unbounded — two unguarded funding paths can hang with no audit row
• assertCanExpand is silent on a pass
• recommended-peers returns a confident wrong answer at 200
• swapPolicy.ts permit/refuse reads of lnd_channels with no age predicate
• Execute-time fee ceilings can authorise costs far above what the quote showed
• Guardrails USDC fee-revenue carve-out

Tests — 8 items

• The web include pattern excludes .test.tsx
• Disk-vs-collected cross-check
• All three CI collection floors are stored counts of growing suites
• The JSX seam is unpinned for all three member-dashboard notice surfaces
• app/web reported 30 npm vulnerabilities — untriaged
• app/api tsconfig never typechecks test files; web does
• SqliteError: no such table stderr noise in action-confirmation.route.test.ts
• Rerun the v1.18.6 verification under a genuinely pinned runtime

Frontend / display — 7 items

• Browser-ahead clock-skew gap
• RefillChannel.tsx seconds-vs-ms heuristic
• Untraced clock provenance in three countdown surfaces
• Six raw /api/channels fetches with no r.ok check
• SwapOperations latent defect on main
• Orphaned client method /api/member-liquidity/clusters — 404s
• Orphaned client method applyDynamicFees — the route has no UI caller

Stablecoin rail & economics — 6 items

• Rail verification tier-up
• The economics rollup
• Block timestamps on /base/events
• Per-member fee attribution
• The FeeRecipientUpdated done-when is inverted
• Constructor seed-vs-ceiling validation

Awaiting Ethan's judgment — decisions parked (§1) — 13 items

• Counsel review
• Standalone Lightning Terminal: uninstall or keep
• The PRIVATE_KEY migration
• Per-node base_sync_cursor reset disposition
• Whether the fee recipient moves off the admin Safe
• The Jan-2 cap-raise expectation
• The BitCorn_OS copy of BITCORN_CONTEXT.md
• The announcement
• Wallet-registration keep-vs-re-register
• Hosted wallet registration on the treasury HTTPS origin
• Disposition of the three undocumented workerFetch bypasses
• Ruleset 20756755 provenance unconfirmed as deliberate
• Concurrent-vault-write design, after the inbox rejection

Awaiting Ethan's judgment — infrastructure & ventures — 5 items

• The insurance venture (own vault/repo) — packet intake paused on Cael
• Cloudflare domain on Ethan's personal account/card — needs Kevin
• NoMachine on the Dell tower
• Lightning MCP — blocked on the Lightning Terminal decision
• Read first production subscription numbers

Awaiting Ethan's judgment — deferred decisions from arcs — 4 items

• The lockfile / reproducible-CI decision
• The 3109 reservation's fate
• Fresh-grace guidance artifact's durable home
• A verification whose wrong PASS condition produces a false STOP — named as a class, or declined

Awaiting Ethan's judgment — arc premises, not yet opened — 2 items

• Fleet cert-expiry reporting (member→treasury)
• Change 2 — loop-out error surfacing, the /cashout successor premise *

Awaiting Ethan's judgment — guardrail dispositions — 2 items

• Stored peer_cooldown_minutes = 0 skips the cooldown check entirely
• Two on-node verifications of the shipped guardrail work are deferred

Awaiting Ethan's judgment — owed to people — 2 items

• Rock Sheet M1–M4
• Hank's L10 to-dos