Conversation
…cout verbose scripts/volume-bot/ lives only in the local tree (.git/info/exclude), so the osv-scanner step's stat of its package-lock.json fails in every CI checkout — broke the first weekly cron (2026-08-24, exit 127) and would fail every PR run. Scout's quiet mode pipes the detector build's stderr to /dev/null; --verbose keeps the real error in the log next time the build breaks.
…rm-cache runs cargo-scout-audit performs its whole environment setup (nightly-2025-08-07, rust-src/llvm-tools/rustc-dev, dylint-link) in its build.rs, which only runs when the crate is compiled. With rust-cache restoring the binary, cargo install is a no-op, ~/.rustup starts empty, and rustup's bare auto-install provides a nightly without rustc_private crates — every warm-cache run died with E0463 for all rustc_* crates (root cause of the 2026-08-24 cron failure; run #1 passed only because its cache was cold). Install the toolchain and components explicitly so the job no longer depends on scout's build script having executed.
…hape fix
Traders hit the vault's capacity gates blind (#82 OpenInterestCapExceeded,
#89 SkewCapExceeded) after clicking Open — 2026-08-24 one tester's $148.6k of
one-sided XLM shorts exhausted the 15%-of-AUM net-skew budget on prod and
every further XLM short failed with no signal in the UI.
- packages/shared/capacity.ts: vaultAccepts (gate-by-gate transliteration of
vault reserve_for_position) + computeHeadroom per side with the binding
gate; 3,000-case parity test asserts size <= headroom <=> vault accepts,
incl. the cap-already-breached reducing-side bound (|net| + max(cap, |net|)).
- api: ContractReader.readAssetExposure (one batched ledger read of the 14
AssetExposure keys), CapacityService (5s hot / 300s params cache,
stale-while-error 30s, omitted on failure — never zeroed), folded into
GET /v1/markets/stats as per-row `capacity` + top-level `pool`. No new
route. withTimeout hoisted to services/timeout.ts.
- web: OrderPanel clamps market orders past the headroom with a
gate-specific banner + "Use max"; "Pool capacity" row in the order summary;
Long/Short split in MarketStatsBar; trust gate (gatewayServesThisMarket +
<60s data). Fixes the trade page reading `stats?.assets` while the gateway
has always sent `{stats, solvency}` — the OI / 24h-volume tiles rendered
"—" on every environment since 2026-07-04.
- sdk-ts / sdk-py: AssetCapacity / PoolCapacity types mirrored + tests.
- packages/shared gains vitest wiring (test script, config, devDep).
…rod +$2M, staging +$620k)
…params, custody guardrail
… the vault, never from custody The market paid funding receivers out of its own USDC pool while funding payers paid the vault, so every funding receipt drained other traders' collateral. With funding_clamp_bps=100 and weeks of one-sided skew this emptied the prod market (custody 27k vs 241k tracked; 1.1M accrued). Settlement now nets price PnL and funding per closed portion: net>0 is paid by the vault through settle_pnl (shortfall booked, ADL flagged), net<0 leaves the position's own collateral for the vault. Applies to isolated, partial and cross closes; liquidation paths were already conserved. Adds admin reseed_funding(ids) (full-freeze only) to void pending funding accrued under the bug before unfreezing, scripts/funding_params.sh to lower funding_clamp_bps/max_funding_velocity_bps on all pairs, and receiver-side conservation tests (isolated, partial, cross, reseed).
…ot-due saveKeeperState ran every 5s discovery cycle on the Azure Files mount (~5M billed SMB ops/month). Writes are now skipped when byte-identical and rate-limited to one per 60s unless forced (shutdown, funding applied). apply_funding under an L0-15 full-freeze (#90) is treated like not-due instead of a failure streak, so a planned freeze does not page.
Every market test snapshot embeds the contract WASM hash + code; 31f3b4c changed the market (funding receivers paid by the vault) without regenerating them. Output of the test run on the same commit — no test logic changed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What ships
a73e8bd):GET /v1/markets/statsgains per-assetcapacity+ vault-widepool(chain-read, omitted on failure); OrderPanel clamps market orders past the headroom with a gate-specific banner; Long/Short stat; fixes the trade-page OI / 24h-volume tiles that rendered "—" since 07-04 (stats?.assetsvs{stats}); sdk-ts/sdk-py parity; shared math with a 3,000-case parity test against the vault predicate.31f3b4c,2cfa0fa,53103c1): funding receivers are paid by the vault, never from custody; keeper skips redundant state writes and treats #90 freeze as not-due; spec +scripts/funding_params.sh.Already live
noether-api:v14(2026-08-26), keepersnoether-keeper-t3:v10, prod + staging market upgrade (snapshots inaudit/config-snapshots/).scripts/deploy_web_azure.sh prod).Verification
Root typecheck clean; shared 14/14, api 157/157, sdk-ts 63/63, sdk-py 42/42, web tsc + lint clean; CI green on
stagingandtestnet.