Ecosystem metrics

New Repos
11
down 56.0%
Commits
876
up 20.2%
Releases
11
up 120.0%
Contributors
59
up 25.5%
Merges
13
down 51.9%

Repository Explorer

10614 commits in all time May 14, 2026 12:25 – Aug 12, 2026 12:25 UTC
meetthosar devportal
Merge 1d0195b41a72d3a9e9b90cabd0f2b422f489b8b6 into 3373832646a00d4285576642c42c4776cbf71f24
Git Commit b3ea7b78 Branch pull/639/merge Document 5/186 ++ 14 --
meetthosar devportal
docs: updated Sharing Boxes Between Applications links
Git Commit 1d0195b4 Branch feat/box-family-read-write Document 1/1 ++ 1 --
meetthosar devportal
docs: update box storage links
Git Commit 72db1e47 Branch feat/box-family-read-write Document 1/2 ++ 2 --
meetthosar devportal
docs: clarify family box re-entrancy wording in avm.md
Git Commit 36dd1bd3 Branch feat/box-family-read-write Document 1/12 ++ 8 --
Merge 7d30f921287e64aa52a0e8cceb07eb75ec89d258 into c16958b8238c18f3d0762c3772e296e9b7976a02
Git Commit cec0076e Branch pull/30/merge Document 40/3,200 ++ 98 --
meetthosar devportal
Added high level concept for 'Family box writing' & 'Foreign box reading'
Git Commit 2dfe44d7 Branch feat/box-family-read-write Document 1/31 ++ 21 --
feat(react-native-keystore): track legacy passkey flagging as migration 0001
BREAKING CHANGE: legacy passkey flagging no longer runs automatically on engine
start. It is now revision 0001 of the package's migration manifest and requires
WithMigrations from @algorandfoundation/provider-migrations to be installed on
the provider. Applications that do not add it will never flag legacy passkeys.
Git Commit 7ab0e90f Branch pull/30/head Document 12/247 ++ 47 --
feat(example): wire the migrations engine into the react-native wallet
Git Commit ad0a2f43 Branch pull/30/head Document 7/142 ++ 38 --
feat(react-native-keystore): gate engine hydration behind an optional `before` promise
Git Commit af602290 Branch pull/30/head Document 2/88 ++ 10 --
test(react-native-keystore): pin storage identity between migration context and engine
Code review flagged that the migration-registration test never exercised the
real createReactNativeKeyStore path, so nothing asserted that the migration's
context() returns the very same storage object the engine reads/writes. Adds
a test that constructs the real engine and checks reference identity;
verified it fails when the invariant is broken.
Git Commit c446a22f Branch pull/30/head Document 1/29 ++ 0 --
feat(migrations): scaffold provider-migrations package with types and errors
Git Commit d99a1a2b Branch pull/30/head Document 11/549 ++ 2 --
test(migrations): cover failure isolation, downgrades, hooks and scratch lifetime
Git Commit 9a801205 Branch pull/30/head Document 1/381 ++ 1 --
feat(migrations): add the migration runner with per-revision ledger writes
Git Commit 9c022269 Branch pull/30/head Document 2/415 ++ 4 --
test(migrations): guard catch-only assertions with an explicit rejects check
Git Commit 5c99ecd1 Branch pull/30/head Document 1/5 ++ 0 --
feat(migrations): add run-scoped secure scratch for material in flight
Git Commit 75c5edce Branch pull/30/head Document 2/208 ++ 0 --
Reconstruct M from the artifact hash, not from the record header
Step [5] is the reviewer's "byte-exact reconstruction of the message M a
live inscription must have signed". It read the wrong bytes.

InscriptionRecord is an arc4.Struct, so the ARC4 head packs fixed-size
fields in declaration order:

  version         UInt8                  rec[0:1]
  cell_id         UInt64                 rec[1:9]
  artifact_hash   StaticArray[Byte,32]   rec[9:41]   <- the signed bytes
  inscribed_round UInt64                 rec[41:49]
  inscriber       Address                rec[49:81]
  payload_uri     DynamicBytes           rec[81:83] -> tail

The code used rec[0:32], which is version || cell_id || the first 23 bytes
of the hash. Confirmed against live TestNet cell 763809098: rec[0] == 1 and
rec[1:9] == 763809098, matching the box name exactly, so the layout is not
in doubt. The script displayed

  rec[0:32] = 01000000002d86cd4a5680fc4ddf9d331b585198239ab41bdc768e3192efc477
  rec[9:41] = 5680fc4ddf9d331b585198239ab41bdc768e3192efc477793a9daa1445dd4574

and rebuilt M from the first. No signature has ever covered those bytes.

It went unnoticed because the sole assertion was len(M_live) == 102, and
build_message validates both inputs are 32 bytes and then concatenates
fixed-width fields - so it either raises or returns exactly 102. The check
could not observe a wrong hash. Same shape as the approval-program pin
this branch already replaced: an assertion with no reachable failure.

Replaced with checks that can fail:
  - version == 1
  - the cell_id INSIDE the record equals the cell_id in the box NAME. Two
    independent sources for one claim, and the check that actually pins the
    offsets above. Mutation-tested: reading rec[0:8] instead of rec[1:9]
    yields "record 72057594040911565 vs box 763809098" and fails.
  - M matches the spec layout at every field offset, so a drift in
    build_message surfaces instead of being absorbed.

Note the tempting check is NOT sufficient: comparing M's embedded hash to
art32 would have passed under the old bug too, since both sides shift
together. That is why the layout is pinned by the cross-source comparison.

Also states plainly that M is reconstructed, not verified: the signature is
a call argument the AVM checks, and is not stored on-chain, so no local
signature verification is possible from box state alone.

Live: 17 passed, 1 failed (the failure is the deployment drift). Standalone,
without the committed artifact: 17 passed, 0 failed.

Found by an adversarial claim-vs-enforcement sweep (TCE-02).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Git Commit 24031544 Branch fix/non-circular-deployment-verification Document 1/30 ++ 4 --