Bitcorn — status

Security / authorization — 19 items

• Unauthenticated open-channel routes + guardrail bypass, behind a public endpoint
• /api/swaps/loop-out — an authorization gap, not an unguarded route
• /api/admin/swaps/loop-out — a design question, not only an authorization gap
• /api/pay — unauthenticated arbitrary-invoice payment, no UI caller
• /api/member/open-channel — post-v1.18.6 authorization delta
• POST/DELETE /api/autobuy/credentials — node-role check only, exempt from confirmation
• POST /api/treasury/capital-policy — node-role only, exempt from confirmation, and it configures the guardrail layer
• Ungated capital-moving routes outside any /api/admin/ + /api/treasury/ naming rule
• Loop-* family has no capital guardrail
• Surface (H): 0.0.0.0:3101 reachable on LAN and the tailnet
• The WAF rule is an unversioned operational dependency
• LIT_PASSWORD is a known-value credential guarding a live admin listener ‡
• Secrets scan of the now-known-public repo — proposed, not run
• Node credential scoping
• Credential scoping — PARKED, not dropped
• API mounts the whole LND data dir when it needs two files
• sync.ts vs index.ts case-sensitivity divergence — split-brain role classification
• sync.ts:48 vacuous-comparison shape, latent
• config/env.ts:13 defaults lndGrpcHost to the DNS name proven to fail

CI & release tooling — 14 items

• docker-publish.yml and the version-bump check disagree about what counts as a release
• Worker npm run deploy has no pre-deploy gate
• CI grep gate for direct Worker fetches
• Worker-side browser-origin detector
• Bare $GITHUB_RUN_ID in heredocs under set -euo pipefail
• Node-20-deprecated action majors, force-run on newer Node
• Skipped-satisfies-required, unexercised on this repo
• pr-checks.yml version-bump job is blind to bump-shaped commits
• pr-checks gate detection gap — did-not-fire indistinguishable from pending *
• docs/release-history.md is behind (seven releases at last read, and the stored query cannot see the gap) *
• docs/RELEASE.md hardcodes "four paths entries" at two sites
• docs/RELEASE.md is stale at six sites plus two satellite files
• RELEASE.md's rollback is not expressible as an image-tag sed for a backend-changing release
• origin/release/v1.18.9 survived its merge — the second release-branch residue

LND reliability & sync loop — 13 items

• index.ts:248 sync-loop log discards ln-service error discriminants
• defaultLndProbeDeps() throws under the test runner
• Seventh fault kind — separating wedged-but-connected from refused
• Query-string dispatch: exact-equality routes 404 on any query
• Two sync-tick steps fetch the same LND data twice
• withProbeTimeout leaks its timer on a synchronous throw
• Per-tick budget for the 15s sync loop — deferred
• LND_GOSSIP_CALL_TIMEOUT_MS = 10s is argued, not derived
• LND_SYNC_TIMING_LEVEL is undocumented
• Stale cross-file citations in lndHealth.ts and lndProbeRoute.ts
• loopAvailability.ts bare catches would swallow a fired Loop deadline
• LND fault harness lives outside version control
• LND self-open semantics for POST /api/member/open-channel — needs regtest

Banners & member-facing copy — 11 items

• Member-facing "contact your operator" copy violates the no-operator convention
• SubscriptionPanel.tsx:754 "Contact operator" wired to a dead placeholder mailto
• Two remediation banners contradict on the same member dashboard
• Member advisor tells a farmer "Loop is not installed" when loopd is broken
• certExpiryMessage's nowMs parameter is dead
• A third one-step remediation variant — lndFaultAlerts.ts's cert escalation
• certExpiryNotice.test.ts hardcodes both API strings as fixtures — a mirror that rots silently
• never_synced + expired cert renders reassuring-and-wrong copy
• channelStaleness.test.ts operator-ban loop has no anti-vacuity probe
• Pin dispositions for the banner reconciliation
• Farmer-facing Loop-unavailability is invisible or hostile in three ways

loopd / Loop compose swap — 11 items

• Compose-swap risk posture: three upstream lightninglabs/loop facts
• env.ts:69 "broken ARM builds" comment goes stale at the swap ‡
• Loop release-manifest signature verification is deferred
• The version triplet becomes an ungated quadruplet at the compose swap
• org.opencontainers.image.version reads latest on the published loopd image
• docs/LOOP_SETUP.md is stale at :46, :99, :148 ‡
• docs/LOOP_SETUP.md predates the litd sidecar in places
• The loopd swap mutates litd's directory even with no schema migration
• docker-compose.yml is absent from docker-publish's paths: filter
• getSwapClient() caches against litd's own self-signed cert with no gate
• quoted_fee_sat may include the prepay hold in the guardrail fee math — unverified, money-path *

Cleanup / hygiene / smaller — 9 items

• Delete stale app/api/dist/rebalance/
• .agents/, .codex/, AGENTS.md untracked — worktree removal needs --force
• Two stale claims in the port-3101 containment record
• Unattached remote branches survived the sweep (four at last read) *
• Duplicated CJS entrypoint guard comment in index.ts
• worktree.symlinkDirectories for worktree disk cost
• cloudflared:latest floats
• Stage 5b (admin subscriptions view) + Stage 6 (Tier 3 live promotion)
• types/ln-service.d.ts fabrication audit

Capital guardrails — 8 items

• Stale-state fail-open in the capital guardrails
• The sync loop auto-fails expansion executions stuck >1h
• The freshness primitive already exists, used for display only
• openTreasuryChannel is HELD-unbounded — two unguarded funding paths can hang with no audit row
• assertCanExpand is silent on a pass
• recommended-peers returns a confident wrong answer at 200
• swapPolicy.ts permit/refuse reads of lnd_channels with no age predicate
• Guardrails USDC fee-revenue carve-out

Tests — 8 items

• The web include pattern excludes .test.tsx
• Disk-vs-collected cross-check
• All three CI collection floors are stored counts of growing suites
• The JSX seam is unpinned for all three member-dashboard notice surfaces
• app/web reported 30 npm vulnerabilities — untriaged
• app/api tsconfig never typechecks test files; web does
• SqliteError: no such table stderr noise in action-confirmation.route.test.ts
• Rerun the v1.18.6 verification under a genuinely pinned runtime

Frontend / display — 6 items

• Browser-ahead clock-skew gap
• RefillChannel.tsx seconds-vs-ms heuristic
• Untraced clock provenance in three countdown surfaces
• Six raw /api/channels fetches with no r.ok check
• SwapOperations latent defect on main
• Orphaned client method /api/member-liquidity/clusters — 404s

Stablecoin rail & economics — 6 items

• Rail verification tier-up
• The economics rollup
• Block timestamps on /base/events
• Per-member fee attribution
• The FeeRecipientUpdated done-when is inverted
• Constructor seed-vs-ceiling validation

Infrastructure & process — 5 items

• Monday status artifact — implementation in flight (Claude Code, bitcorn-status) *
• Top the deployer wallet
• Workflow-tooling remainder
• Vault-conventions remainder
• Fifteen broken done-when queries — proven replacements landed, reconcile re-run pending *

Awaiting Ethan's judgment — decisions parked (§1) — 13 items

• Counsel review
• Standalone Lightning Terminal: uninstall or keep
• The PRIVATE_KEY migration
• Per-node base_sync_cursor reset disposition
• Whether the fee recipient moves off the admin Safe
• The Jan-2 cap-raise expectation
• The BitCorn_OS copy of BITCORN_CONTEXT.md
• The announcement
• Wallet-registration keep-vs-re-register
• Hosted wallet registration on the treasury HTTPS origin
• Disposition of the three undocumented workerFetch bypasses
• The Cowork project instructions hold conventions as values
• Ruleset 20756755 provenance unconfirmed as deliberate

Awaiting Ethan's judgment — infrastructure & ventures — 5 items

• The insurance venture (own vault/repo) — packet intake paused on Cael
• Cloudflare domain on Ethan's personal account/card — needs Kevin
• NoMachine on the Dell tower
• Lightning MCP — blocked on the Lightning Terminal decision
• Read first production subscription numbers

Awaiting Ethan's judgment — deferred decisions from arcs — 4 items

• The lockfile / reproducible-CI decision
• The 3109 reservation's fate
• Fresh-grace guidance artifact's durable home
• A verification whose wrong PASS condition produces a false STOP — named as a class, or declined

Awaiting Ethan's judgment — guardrail dispositions — 3 items

• The coverage derivation's unnamed fourth blind spot
• Stored peer_cooldown_minutes = 0 skips the cooldown check entirely
• Two on-node verifications of the shipped guardrail work are deferred

Awaiting Ethan's judgment — arc premises, not yet opened — 2 items

• Fleet cert-expiry reporting (member→treasury)
• BACKLOG §2 split (file bloat)

Awaiting Ethan's judgment — owed to people — 2 items

• Rock Sheet M1–M4
• Hank's L10 to-dos