Drips Stellar Wave Readiness Ledger

This ledger coordinates the remediation work identified by the October 7, 2026 Drips Stellar Wave readiness audit. It records evidence without treating plans, local tests, deployments, or organizer decisions as interchangeable.

The authoritative local source documents are DRIPS_STELLAR_WAVE_READINESS_AUDIT.md and DRIPS_STELLAR_WAVE_AUDIT_IMPLEMENTATION.md. The tracking issues below own the public execution record.

Evidence States

State	Meaning	Does not prove
local	A named command passed in a maintainer checkout at a recorded commit.	CI, deployment, or public reproducibility.
ci	A public CI run passed for the exact commit and required checks.	That an artifact was deployed or works on testnet.
deployed	A pinned artifact is reachable in a named environment.	Correct payment behavior, finality, or persistence.
testnet-proven	Public testnet transactions and state changes prove the claimed behavior.	Mainnet readiness or independent review.
reviewed	A focused pull request passed its completion check and was reviewed.	Drips acceptance.
wave-approved	The organizer approved the repository or issue for a named Wave.	Product security beyond the submitted evidence.

Evidence states are cumulative only when each lower state is independently recorded. A health response, mock, fixture, or deployment manifest cannot be promoted to testnet-proven without lifecycle evidence.

October 7, 2026 Baseline

Repository	Baseline commit	Public CI	Local validation	Dependency audit	Public capability
lumenbazaar-contracts	fe15b32	CI passed	70 tests, formatting, clippy, locked WASM build, binding and evidence checks passed.	No known vulnerability; one informational unmaintained paste warning.	Testnet upload, deployment, initialization, interface, and WASM hash are public. A payment lifecycle is not proven.
lumenbazaar-backend	f2fa194	CI passed	163 tests plus OpenAPI, formatting, lint, typecheck, and Prisma checks passed.	13 high and 1 critical production finding reported.	/health is reachable, but /version reports local, /v1/supported is empty, discovery is empty, and /mcp returns 404.
lumenbazaar-frontend	4648d3b	CI passed	104 unit tests, production build, and 6 desktop/mobile Playwright checks passed.	15 high and 1 critical production finding reported.	The public site is reachable, but payment uses a v1-style preview or wallet draft and operational data can use fixtures.
lumenbazaar-docs	1639638	CI passed	Markdown, links, generated-reference, content, consistency, and production build checks passed.	20 high and 18 critical affected production packages reported.	The public site is reachable, but deployment statements and generated references are not release-synchronized.

The dependency counts are package-manager results, not exploitability findings. They remain open gates until each path is upgraded or covered by a reviewed, time-bounded exception.

Deployment Baseline

The public probes below were repeated on October 7, 2026.

Target	URL or identifier	Observed state
Frontend	Public frontend	HTTP 200.
Docs	Public docs	HTTP 200.
Backend API	Public backend	Health HTTP 200; version 0.1.0; environment local.
Backend exact capability	/v1/supported	No payment schemes advertised.
Backend discovery	/v1/discovery/search	No resources indexed.
Backend MCP	/mcp	HTTP 404.
upto-session contract	CCO7IMY4LYPWNKXEQ44LKTRMPZBQC7UM7JV3MOGGMB5GC4246I7Y2RB6	Testnet deployment exists; live funding and settlement are not proven.
Contract WASM	23ee0112e5748a1450669d82063e72c32cecfea52b0a07d3edd54d727ab45eaf	Published hash matches the audited build and live contract.

Compatibility Matrix

Matrix entry	Frontend	Backend	Contracts	Docs	Highest common evidence	Status
baseline-2026-10-07	4648d3b	f2fa194	fe15b32	1639638	ci	Incompatible as a complete payment product: exact is disabled, upto authorization is unproven, and public docs are stale.
remediation-candidate-2026-10-07	dc41e2c	4637959	10460b5	d48d595 plus current docs phases	Contract: testnet-proven; other repositories: local	Contract escrow lifecycle is public. Backend and frontend exact flow is locally validated but not deployed, so Gates B-D remain open.

Add a new immutable row for every release candidate. Never overwrite a prior row to make a newer combination appear historically compatible.

The current component-by-component truth and the replacement testnet contract ID are maintained in the deployment and capability matrix. The deployment baseline above is retained as a dated historical observation and must not be used as current configuration.

Blocking Findings And Ownership

Finding	Required outcome	Owning phases
P0-1: capped-session authorization is unproven	Select, implement, test, deploy, and publish a real funding and recovery model.	2-11
P0-2: official exact x402 is not implemented	Complete official v2 transport, signing, verification, settlement, persistence, and buyer flow.	14-20, 24, 26-29
P0-3: no reproducible reviewer path	Publish a real paid resource, MCP service, wallet flow, receipt, explorer evidence, and five-minute guide.	21-24, 27-31, 35
P1-1: payment state is ephemeral	Make attempts, settlement, receipts, replay controls, jobs, and recovery durable.	18-20
P1-2: deployment is development-like	Enforce real environment configuration, readiness, observability, and capability reporting.	13, 23-24
P1-3: documentation is inconsistent	Synchronize generated artifacts and deployment, security, license, and capability claims.	33-35
P1-4: maintainer execution is unproven	Demonstrate protected, reviewed, released, triaged, and responsive repository operation.	36-40
P1-5: dependency security gate fails	Remove or explicitly review critical and high production findings in each affected repository.	9, 12, 25, 32

Phase Tracking

All entries start open. A tracking issue closes only after its completion check, repository gate, evidence record, review, and commit are complete.

Phase	Owner	Tracking issue	Initial state
1	Docs coordination	docs #21	In progress
2	Contracts	contracts #21	Open
3	Contracts	contracts #22	Open
4	Contracts	contracts #23	Open
5	Contracts	contracts #24	Open
6	Contracts	contracts #25	Open
7	Contracts	contracts #26	Open
8	Contracts	contracts #27	Open
9	Contracts	contracts #28	Open
10	Contracts	contracts #29	Open
11	Contracts	contracts #30	Open
12	Backend	backend #21	Open
13	Backend	backend #22	Open
14	Backend	backend #23	Open
15	Backend	backend #24	Open
16	Backend	backend #25	Open
17	Backend	backend #26	Open
18	Backend	backend #27	Open
19	Backend	backend #28	Open
20	Backend	backend #29	Open
21	Backend	backend #30	Open
22	Backend	backend #31	Open
23	Backend	backend #32	Open
24	Backend	backend #33	Open
25	Frontend	frontend #21	Open
26	Frontend	frontend #22	Open
27	Frontend	frontend #23	Open
28	Frontend	frontend #24	Open
29	Frontend	frontend #25	Open
30	Frontend	frontend #26	Open
31	Frontend	frontend #27	Open
32	Docs	docs #22	Open
33	Docs	docs #23	Open
34	Docs	docs #24	Open
35	Docs	docs #25	Open
36	Cross-repository governance	docs #26	Open
37	Cross-repository issue curation	docs #27	Contracts backlog prepared; independent estimate and dashboard points pending
38	Application preparation	docs #28	Evidence pack prepared; Gate E remains open
39	Contracts	contracts #31	Not submitted: exact blockers recorded
40	Wave operations	docs #29	Inactive operations ledger prepared; blocked on organizer approval
41	Backend	backend #34	Candidate set prepared; application blocked on Gate B
42	Frontend	frontend #28	Candidate set prepared; application blocked on Gates B and C
43	Docs	docs #30	Retained as non-applied supporting infrastructure

Existing Wave Candidates

Issues 1-8 in each repository retain their existing wave-ready label for history and now also carry readiness-provisional. Phase 37 must remove that provisional label only after confirming the issue is still meaningful, bounded to one contributor and one Wave, objectively testable, unassigned, and free of hidden application prerequisites.

Update Rules

• Record the starting commit before each phase.
• Link focused checks, the full repository gate, dependency audit, and public evidence in the owning tracking issue.
• Keep exact x402 and experimental upto evidence separate.
• Append compatibility rows; do not rewrite old rows.
• Do not promote mocked, fixture-backed, in-memory, placeholder, or planned behavior to deployed or testnet-proven evidence.
• Keep phases open when a stop condition applies, and record the exact blocker.
• Recheck Drips dates, limits, budgets, KYC, and program rules immediately before any application action.