Ecosystem metrics
- New Repos
- 15
- down 40.0%
- Commits
- 876
- up 20.2%
- Releases
- 11
- up 120.0%
- Contributors
- 59
- up 22.9%
- Merges
- 13
- down 53.6%
Activity Overview
Commits and releases over time
- Commits
- Releases
- Authors
Repository Explorer
No repositories match that filter.
10618 commits in all time
May 14, 2026 03:26 – Aug 12, 2026 03:26 UTC
Make deployment verification able to fail
The deployed application has not matched the committed contract since 2ec798e (2026-06-16), and nothing could observe it. Three defects combined: 1. ci.yml filtered on sdk/** only, so no change under contracts/ ever triggered CI. inscription.py was edited, merged and released without a single test run. 2. verify_trelyan.py pinned EXPECTED_APPROVAL_SHA512_256 - a constant copied from the deployed program - and compared it to the chain. The contract blocks Update/Delete (I1/I5), so the deployed bytecode is immutable and that comparison cannot fail. It was a tautology reported as a PASS, and the weekly schedule has been re-proving it every Monday since June. 3. The pin was recorded 2026-06-17, one day AFTER the divergence, so it captured the superseded value. Changes: - contracts/verify_deployment.py (new): derives the expected bytecode by assembling the committed TEAL artifact and compares it to the deployed program. No stored expected hash. Exit 1 = drift, exit 2 = could not check; an unreachable node must read as neither agreement nor drift, and an unexpected crash exits 2 rather than masquerading as a finding. --compile-url lets a reviewer split the trust so one endpoint does not both assemble and serve. --recompile re-derives the TEAL from inscription.py so the artifact is not trusted either. - ci.yml: add contracts/** to the path filters; add the contract-drift job. - verify_trelyan.py: separate the two claims that were conflated. The pinned constant now asserts only "the app was not replaced", which is what it can actually support. Source correspondence is checked properly when the committed artifact is present, and reported as NOT CHECKED when it is not, rather than being silently covered by the weaker check. Verified against live TestNet: drift detected (exit 1, committed source builds to 112fcad3 / 667 B, chain serves d24d9071 / 660 B). The MATCH path is reachable and was proven separately by round-tripping the deployed program through algod disassemble/assemble (exit 0, byte-identical). contract-drift and verify-live are both expected to be RED until the committed contract is redeployed. That red is the finding, not a broken job. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
d4e82888
fix/non-circular-deployment-verification
4/259 ++ 9 --
Merge d952b8ee2105f52c40d6b397a76db4e061cd01d4 into b0a3e71a91adfd1dfb97b5060d054618c2a147aa
6cf91489
pull/66/merge
10/1,149 ++ 1,264 --
chore(deps): Update all non-major dependencies
d952b8ee
renovate/all-non-major-dependencies
10/1,149 ++ 1,264 --
fix: USDC display on SendAssetScreen for fnet (#386)
337211c9
main
3/17 ++ 10 --
fix: USDC display on SendAssetScreen
9feb5743
bug-fix
3/17 ++ 10 --
Merge f86b979bac1da5e2e08e9ae7094ef6110b7e56a8 into 0e26b4b274a282ae273b68b29140379d39803971
f2e9af4c
pull/606/merge
1/73 ++ 3 --
chore(deps-dev): bump js-yaml from 4.1.1 to 4.3.1
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.3.1. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.1.1...4.3.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
f86b979b
dependabot/npm_and_yarn/js-yaml-4.3.1
1/73 ++ 3 --
Merge 07c02b794d45de4833b95f5186ca93bfaf60dd29 into 361d3066ffaca4241991cc6563403417bf562ecf
c4b03155
pull/23/merge
1/4,204 ++ 3,550 --
chore(deps): lock file maintenance
07c02b79
renovate/lock-file-maintenance
1/4,204 ++ 3,550 --
Merge febd339f8fbf30c877566b6d575f0f5595d99c00 into 361d3066ffaca4241991cc6563403417bf562ecf
1af84dd0
pull/32/merge
2/346 ++ 520 --
chore(deps): update commitlint monorepo to v21
febd339f
renovate/major-commitlint-monorepo
2/346 ++ 520 --
Merge ae1969d7bebd846a94b2bdb2e98ce3d053ec5f09 into 361d3066ffaca4241991cc6563403417bf562ecf
a7649b80
pull/17/merge
4/3,363 ++ 1,954 --
fix(deps): update all non-major dependencies
ae1969d7
renovate/all-minor-patch
4/3,363 ++ 1,954 --
Merge c38f6e67a6f266164d0346a584657fc4ebe48e2d into 361d3066ffaca4241991cc6563403417bf562ecf
c898af15
pull/30/merge
2/295 ++ 111 --
fix(deps): update dependency next to v15 [security]
c38f6e67
renovate/npm-next-vulnerability
2/295 ++ 111 --
Merge 7ca6cf1fb6d2acdbfaae9c6f308ad3bd1f6333b9 into 361d3066ffaca4241991cc6563403417bf562ecf
5da82294
pull/27/merge
2/11 ++ 6 --
chore(deps): update dependency postcss to v8.4.31 [security]
7ca6cf1f
renovate/npm-postcss-vulnerability
2/11 ++ 6 --
Merge c29bd807a32b9bfb2a042afa10b58a6ad6260146 into 9306fe0d6d4c0041ab9eb7fa1a492bdbd790ec4d
d7cef140
pull/403/merge
1/100 ++ 0 --
Merge 4cca91d01f9da96cc1ce1a7d7e298ff8ca8c917d into 679ae0d3c7b9b9e2f6b72743189d10e643de42e5
5bc471f2
pull/597/merge
12/411 ++ 303 --