ℹ️ About Codex in GitHub

\\n
\\n\\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\\n- Open a pull request for review\\n- Mark a draft as ready\\n- Comment \\\"@codex review\\\".\\n\\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\\n\\n\\n\\n\\nCodex can also answer questions or update the PR. Try commenting \\\"@codex address that feedback\\\".\\n \\n

\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Reject plaintext metadata URLs before server fetch**\\n\\n`isSafeExternalHttpUrl` now treats both `https:` and `http:` as safe, and `getProofMetadataForCertificate` uses this gate before doing server-side metadata fetches. That allows on-chain metadata URIs over plaintext HTTP, so any network attacker on the path can alter the fetched JSON and the proof metadata your app presents to users. For trust metadata, this is a security regression from the prior HTTPS-only behavior and should be blocked at validation time.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"frontend/src/lib/security.ts\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Block IPv4-mapped IPv6 loopback in hostname filter**\\n\\nThe private-host check only matches `::1` and IPv4 private prefixes, but it does not catch IPv4-mapped IPv6 loopback forms (for example `::ffff:7f00:1`). A metadata URI like `http://[::ffff:7f00:1]/...` passes `isSafeExternalHttpUrl`, so the server-side metadata fetch can still be redirected to localhost/internal services despite the SSRF hardening.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"frontend/src/lib/security.ts\",\"side\":\"RIGHT\",\"line\":46}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Keep opportunity IDs lossless after switching calls to u64**\\n\\nThis PR upgrades follow-up opportunity calls to send `u64`, but IDs are still carried as JavaScript `number` and then re-encoded via `BigInt(oppId)`. Once an on-chain ID exceeds `Number.MAX_SAFE_INTEGER`, it is rounded before conversion, so `fund_opportunity`/`submit_milestone`/`approve_milestone`/`release_payment`/`refund_opportunity` may reference the wrong opportunity ID or fail unpredictably.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"frontend/src/lib/contract-client.ts\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"@codex closeout update:\\n\\nFixed and shipped the proof preview data-binding issue.\\n\\n- Commit: fdd06c4 (`fix(security): checkpoint proof preview and deployment alignment`)\\n- Production: https://stellaroid.tech redeployed and aliased successfully\\n- Contract: CDMUOHMARNVOJZM3IVOCJUPGBHDTHFBMZCCZXEZPQDVJGILH3NIKTTW3\\n\\nWhat changed:\\n- `ProofBlockPreview` now prefers real credential titles from registration / lookup records.\\n- `AppExperience` now carries `credentialTitle` and `credentialStatus` into the preview.\\n- Non-demo hashes fall back to neutral `Pending Issuance`, not the bootcamp demo title.\\n- Added focused unit coverage for non-demo title binding and neutral fallback.\\n\\nVerification:\\n- `npm run test:unit`: 15 passed\\n- `npm run lint`: passed\\n- `npm run build`: passed locally and in Vercel production build\\n- `npm run test:e2e`: 5 passed\\n- Live smoke passed for home, status, health, proof metadata JSON, verified proof, OG image, unknown-proof neutral behavior, and fee-bump disabled/public rejection.\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"Acknowledged — based on your **@codex closeout update** trigger and PR context, no additional code changes are required from me at this point.\\n\\nI validated that the referenced fix commit is present on the current branch:\\n\\n- ✅ `cd /workspace/Hackathon-Stellaroid_Earn && git status --short && git log --oneline -n 5`\\n\\nThe log includes:\\n\\n- `fdd06c4 fix(security): checkpoint proof preview and deployment alignment`\\n\\nSince there were **no new local changes to commit**, I did **not** create another commit and did **not** call `make_pr` (per your workflow constraints).\\n\\n [View task →](https://chatgpt.com/s/cd_6a0d9943149481918ae5c128c0940af2)\",\"path\":null,\"side\":null,\"line\":null}","text_elements",[],{"_350":434,"_331":332,"_352":338},{"_353":435,"_355":-5,"_41":-5,"_356":-5,"_94":297,"_90":358},[436],{"_45":430,"_90":437},"input_text",{"_350":439,"_331":332,"_352":338},{"_353":440,"_355":-5,"_41":-5,"_356":-5,"_94":297,"_90":358},[441,442],{"_45":444,"_90":437},{"_45":443,"_90":437},"\n /workspace/Hackathon-Stellaroid_Earn\n bash\n 2026-05-20\n Etc/UTC\n","# AGENTS.md instructions for /workspace/Hackathon-Stellaroid_Earn\n\n\n# AGENTS.md\n\nThis file provides guidance to Codex (Codex.ai/code) when working with code in this repository.\n\n## What this repo is\n\nThis is the **Stellar PH Bootcamp** bootcamp repository — a participant-facing guide, not a production codebase. It packages:\n\n1. **`README.md`** — 5-step walkthrough: install toolchain → complete assigned Soroban contract → `cargo test` (≥3 tests) → deploy to Stellar **testnet** → submit on Rise In.\n2. **`setup/[ENG] Pre-Workshop Setup Guide.pdf`** — participant install guide (Rust, Stellar CLI, WASM target, Freighter).\n3. **`setup/STELLAR_FREIGHTER_INTEGRATION_GUIDE.md`** — generalized Next.js + Soroban + Freighter integration recipe.\n4. **`frontend/`** — Next.js 15 (App Router) + React 19 dApp using `@stellar/stellar-sdk` and `@stellar/freighter-api`. Composition: `app/` (layout, page, `/about`, `/app`, `/issuer`, `/issuer/register`, `/proof`, `/proof/[hash]`, `/proof/[hash]/embed`), `components/` (`about/`, `actions/`, `activity/`, `app/`, `demo/`, `issuer/`, `landing/`, `layout/`, `milestones/`, `onboarding/`, `proof/`, `ui/`, `wallet/`), `hooks/`, `lib/` (config, contract-client, contract-read-server, demo-data, errors, events, format, freighter, i18n, issuer-registry, motion, proof-metadata, types, utils, validators, with-timeout), `styles/globals.css` (Tailwind v4 `@theme` design tokens). Security: HTTP security headers + CSP in `next.config.ts`; dynamic proof routes cached with `revalidate=60` and guarded with a hex-format check before any RPC call.\n5. **`setup/TODO.md`** — local setup progress tracker (A–E sections: Environment, Manual pre-workshop, Contract deploy, Rise In, Phase 2 fullstack).\n6. **`setup/FULLSTACK_PROMPT_TEMPLATE.md`** — v3 prompt template for generating a Stellar dApp idea + Soroban contract files + frontend design brief. Used in Phase 2 after the Contract ID is deployed. Refined against the `stellar-dev`, `ui-ux-pro-max`, and `superpowers/writing-skills` plugins.\n\nThe assigned Soroban contract itself is **not** in this repo — participants clone a separate facilitator-provided contract repo.\n\n## Common commands\n\n### Frontend (`frontend/`)\n```bash\nnpm install\nnpm run dev # next dev\nnpm run build # next build\nnpm run start # next start (after build)\nnpm run lint # next lint\n```\n\n### Stellar CLI (environment setup)\nDo not assume the local shell has Rust, Cargo, Stellar CLI, or a funded key on PATH. Verify the active runtime first.\n\nKnown project baseline from the original codespace was Rust 1.95, `wasm32v1-none` + `wasm32-unknown-unknown` targets, Stellar CLI 26.0.0 at `~/.local/bin/stellar`, and a funded testnet key aliased `my-key`, but local Windows checkouts may differ.\n\n```bash\nexport PATH=\"$PATH:$HOME/.local/bin\" # if stellar is not on PATH\nstellar --version\nstellar keys address my-key\n```\n\n### Contract workflow (once a contract is cloned into this workspace)\n```bash\ncargo test\ncargo build --target wasm32-unknown-unknown --release\nstellar contract deploy \\\n --wasm target/wasm32-unknown-unknown/release/.wasm \\\n --source my-key \\\n --network testnet\n```\n\n## Stellar CLI v26 gotchas\n\n- `--global` flag is **removed** from `stellar keys generate` — global is the default. Use `--fund` to auto-fund at creation: `stellar keys generate my-key --network testnet --fund`.\n- Prefer the **prebuilt binary** from GitHub releases over `cargo install --locked stellar-cli` in constrained environments (the from-source build pulls hundreds of crates and can OOM in small containers).\n\n## Frontend architecture (at a glance)\n\nThe integration follows the flow documented in `setup/STELLAR_FREIGHTER_INTEGRATION_GUIDE.md`:\n\n- **Config layer** reads `NEXT_PUBLIC_*` env vars (RPC URL, network passphrase, contract ID, read address). Network passphrase **must** match the network the contract is deployed on.\n- **Wallet layer** (`lib/` + `hooks/`) wraps `@stellar/freighter-api` — connection state, public key, network check, sign.\n- **Contract client** (`lib/`) builds transactions with `@stellar/stellar-sdk`: read-only calls via `simulateTransaction` using the read address; writes sign via Freighter and submit via Soroban RPC. Handles ScVal arg serialization, return-value decoding, and error normalization.\n- **UI components** are marked `\"use client\"` because Freighter is a browser-only API.\n- **Security** (`next.config.ts`): CSP, `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, `Permissions-Policy`, and HSTS on every route. `/proof/[hash]` pages validate the hash format before any RPC call and use `revalidate=60` for CDN caching. `robots.ts` blocks crawlers from spidering dynamic proof routes.\n\nWhen editing the frontend, treat the integration guide as the canonical spec.\n\n## What not to do\n\n- Don't commit `vs_buildtools.exe`, `install.cmd`, or other Windows-only artifacts — this repo is consumed cross-platform and those belong in the PDF guide, not the tree.\n- Don't add a backend unless a participant's submission needs one (`backend/` is explicitly optional per the README's repo structure).\n- Don't deploy to mainnet from examples — all flows target **testnet**.\n- Don't add `Co-Authored-By: Codex` (or any Codex co-author trailer) to commits, PRs, or other `gh` actions. Commits and PRs should be authored solely by the user.\n- Don't use the deprecated `soroban contract ...` CLI in examples or docs — use `stellar contract ...` (Stellar CLI v21+).\n\n",{"_350":446,"_331":332,"_352":338},{"_353":447,"_355":-5,"_41":-5,"_356":-5,"_94":448,"_90":358},[449,450],"developer",{"_45":452,"_90":437},{"_45":451,"_90":437},"\n## Skills\nA skill is a set of local instructions to follow that is stored in a `SKILL.md` file. Below is the list of skills that can be used. Each entry includes a name, description, and file path so you can open the source for full instructions when using a specific skill.\n### Available skills\n- imagegen: Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output should be a bitmap asset rather than repo-native code or vector. Do not use when the task is better handled by editing existing SVG/vector/code-native assets, extending an established icon or logo system, or building the visual directly in HTML/CSS/canvas. (file: /opt/codex/skills/.system/imagegen/SKILL.md)\n- openai-docs: Use when the user asks how to build with OpenAI products or APIs and needs up-to-date official documentation with citations, help choosing the latest model for a use case, or model upgrade and prompt-upgrade guidance; prioritize OpenAI docs MCP tools, use bundled references only as helper context, and restrict any fallback browsing to official OpenAI domains. (file: /opt/codex/skills/.system/openai-docs/SKILL.md)\n- plugin-creator: Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, and baseline placeholders you can edit before publishing or testing. Use when Codex needs to create a new local plugin, add optional plugin structure, or generate or update repo-root `.agents/plugins/marketplace.json` entries for plugin ordering and availability metadata. (file: /opt/codex/skills/.system/plugin-creator/SKILL.md)\n- skill-creator: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations. (file: /opt/codex/skills/.system/skill-creator/SKILL.md)\n- skill-installer: Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos). (file: /opt/codex/skills/.system/skill-installer/SKILL.md)\n### How to use skills\n- Discovery: The list above is the skills available in this session (name + description + file path). Skill bodies live on disk at the listed paths.\n- Trigger rules: If the user names a skill (with `$SkillName` or plain text) OR the task clearly matches a skill's description shown above, you must use that skill for that turn. Multiple mentions mean use them all. Do not carry skills across turns unless re-mentioned.\n- Missing/blocked: If a named skill isn't in the list or the path can't be read, say so briefly and continue with the best fallback.\n- How to use a skill (progressive disclosure):\n 1) After deciding to use a skill, open its `SKILL.md`. Read only enough to follow the workflow.\n 2) When `SKILL.md` references relative paths (e.g., `scripts/foo.py`), resolve them relative to the skill directory listed above first, and only consider other paths if needed.\n 3) If `SKILL.md` points to extra folders such as `references/`, load only the specific files needed for the request; don't bulk-load everything.\n 4) If `scripts/` exist, prefer running or patching them instead of retyping large code blocks.\n 5) If `assets/` or templates exist, reuse them instead of recreating from scratch.\n- Coordination and sequencing:\n - If multiple skills apply, choose the minimal set that covers the request and state the order you'll use them.\n - Announce which skill(s) you're using and why (one short line). If you skip an obvious skill, say why.\n- Context hygiene:\n - Keep context small: summarize long sections instead of pasting them; only load extra files when needed.\n - Avoid deep reference-chasing: prefer opening only files directly linked from `SKILL.md` unless you're blocked.\n - When variants exist (frameworks, providers, domains), pick only the relevant reference file(s) and note that choice.\n- Safety and fallback: If a skill can't be applied cleanly (missing files, unclear instructions), state the issue, pick the next-best approach, and continue.\n","\nFilesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is enabled.\nApproval policy is currently never. Do not provide the `sandbox_permissions` for any reason, commands will be rejected.\n","turn/started",{"_331":332,"_85":455},{"_101":-5,"_41":338,"_339":456,"_341":342,"_343":457},[],"inProgress",{"_343":459,"_331":332},{"_460":461,"_90":462},"activeFlags",[],"active","thread/started",{"_465":466},"thread",{"_467":-5,"_468":-5,"_469":470,"_471":342,"_394":395,"_472":15,"_473":-5,"_474":-5,"_41":332,"_475":476,"_179":-5,"_159":477,"_478":197,"_399":479,"_343":480,"_75":481,"_482":342},"agentNickname","agentRole","cliVersion","0.124.0","createdAt","ephemeral","forkedFromId","gitInfo","modelProvider","openai","/opt/codex/sessions/2026/05/20/rollout-2026-05-20T12-10-24-019e454b-505f-74d1-97a9-0fa9c91e4914.jsonl","preview","vscode",{"_90":347},[],"updatedAt",[],"messages",[486],{"_41":487,"_488":489,"_490":491,"_492":491,"_353":493,"_343":494,"_355":-5,"_495":31,"_496":497,"_498":499,"_500":-5},"1c28f347-7fd5-4459-b948-b79bdd720a0a","author",{"_94":297,"_179":-5,"_496":509},"create_time",1779279023.310865,"update_time",{"_505":45,"_506":507},"finished_successfully","weight","metadata",{"_501":502},"recipient","all","channel","l1239dk1",{"_503":504},"inline_comments",[],"content_type","parts",[508],"@codex closeout update for the two follow-up findings:\n\nFixed and shipped:\n\n- Metadata URL SSRF: fixed by removing server-side fetch of issuer-supplied metadata URLs. Proof metadata now derives from on-chain certificate fields and known demo fallback data; safe metadata URLs are kept only as evidence links. Also tightened trailing-dot private-host normalization.\n- Stale proof preview title: fixed by clearing preview title state when a newly loaded credential record has a blank/whitespace title, so the preview falls back to neutral copy instead of retaining the previous credential title.\n\nCommits:\n- 73ebfbe `fix(security): harden proof metadata and preview state`\n- b8a4170 `fix(test): repair proof preview typecheck`\n\nProduction:\n- Redeployed and aliased to https://stellaroid.tech\n- Deployment: https://stellaroid-earn-demo-gnyzzols8-iron-marks-projects.vercel.app\n\nVerification:\n- Local `npm run test:unit`: 17 passed\n- Local `npm run lint`: passed\n- Local `npm run build`: passed\n- Local `npm run test:e2e`: 5 passed\n- GitHub main CI for `b8a4170`: passed build, lint, typecheck, and Playwright E2E\n- Live smoke passed for home, status, health, proof metadata JSON, verified proof, proof OG image, unknown-proof neutral behavior, and fee-bump disabled/public rejection.\nfix(security): remediate audit findings\n\n## Summary\r\n\r\n- harden fee sponsorship, proof metadata, CSP, amount parsing, opportunity escrow, and docs drift from the security findings pass\r\n\r\n- add focused frontend, Playwright, and Soroban contract coverage for the remediated behavior\r\n\r\n## Changes Made\r\n\r\n### Fee Sponsorship\r\n\r\n- disable public browser auto-sponsorship by default and require server bearer authorization\r\n\r\n- validate sponsored XDR size, network, source, op count, fee ceiling, configured contract, and method allowlist\r\n\r\n### Proof Integrity and XSS\r\n\r\n- add nonce-based CSP middleware, escaped JSON-LD, URL sanitizers, safe metadata fetch bounds, and status-derived proof claims\r\n\r\n- prevent missing or non-verified proofs from making verified, payment-settled, or completed-work claims\r\n\r\n### Contract and Amount Safety\r\n\r\n- cap opportunity milestones at 24 and allow employer refund from submitted state\r\n\r\n- replace float amount parsing with strict exact decimal scaling and fix u64 opportunity IDs\r\n\r\n### Workflow and Docs\r\n\r\n- pin Stellar release workflow to an immutable SHA and narrow permissions\r\n\r\n- align env/docs/security notes with the hardened behavior and current contract state\r\n\r\n## Why\r\n\r\n- closes the CSV security findings as one coordinated hardening pass and keeps proof trust claims tied to verified on-chain state\r\n\r\n## Notes for Reviewers\r\n\r\n- verified with cargo test, frontend unit tests, lint, build, Playwright E2E, and git diff --check\n\n\n---\n\n> [!NOTE]\n> **Medium Risk**\n> Modifies on-chain Soroban contract escrow state rules (`create_opportunity` validation and `refund_opportunity` transitions), which can affect fund flows and requires careful review/testing despite added coverage.\n> \n> **Overview**\n> Hardens the Soroban opportunity-escrow flow by **capping `milestone_count` (max 24)** during `create_opportunity` and allowing employers to `refund_opportunity` even after a candidate has moved the opportunity into `Submitted`, preventing escrow lock-in.\n> \n> Expands the contract test suite (now 12 tests) with new coverage and snapshot fixtures for the milestone cap and the new refund transition, and updates documentation to reflect the updated error variant count, escrow behavior, and current contract baseline.\n> \n> Tightens the GitHub release workflow by moving permissions to the job scope and pinning the reusable `soroban-build-workflow` reference to an immutable commit SHA.\n> \n> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit c62e3461fdf428c178b406a20dbbe4908b06881f. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).}\n\n[vc]: #LgshqjkLFiyFyjDhqqP97tRxhRcdwHkCjS8bXK1iFoY=:eyJpc01vbm9yZXBvIjp0cnVlLCJ0eXBlIjoiZ2l0aHViIiwicHJvamVjdHMiOlt7Im5hbWUiOiJzdGVsbGFyb2lkLWVhcm4tZGVtbyIsInByb2plY3RJZCI6InByal9HTm9GY1hKcEt1d0RVejdJZUd0dEFmd0N4TUZsIiwibGl2ZUZlZWRiYWNrIjp7InJlc29sdmVkIjowLCJ1bnJlc29sdmVkIjowLCJ0b3RhbCI6MCwibGluayI6InN0ZWxsYXJvaWQtZWFybi1kZW1vLWdpdC1jb2RleC1zZWN1ci04Y2FiNGItaXJvbi1tYXJrcy1wcm9qZWN0cy52ZXJjZWwuYXBwIn0sImluc3BlY3RvclVybCI6Imh0dHBzOi8vdmVyY2VsLmNvbS9pcm9uLW1hcmtzLXByb2plY3RzL3N0ZWxsYXJvaWQtZWFybi1kZW1vLzdmc3NONzl2MlY1VVZ4ajlEc1FCVndKMkZUZ24iLCJwcmV2aWV3VXJsIjoic3RlbGxhcm9pZC1lYXJuLWRlbW8tZ2l0LWNvZGV4LXNlY3VyLThjYWI0Yi1pcm9uLW1hcmtzLXByb2plY3RzLnZlcmNlbC5hcHAiLCJuZXh0Q29tbWl0U3RhdHVzIjoiREVQTE9ZRUQiLCJyb290RGlyZWN0b3J5IjoiZnJvbnRlbmQifV19\nThe latest updates on your projects. Learn more about [Vercel for GitHub](https://vercel.link/github-learn-more).\n\n| Project | Deployment | Actions | Updated (UTC) |\n| :--- | :----- | :------ | :------ |\n| [stellaroid-earn-demo](https://vercel.com/iron-marks-projects/stellaroid-earn-demo) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/iron-marks-projects/stellaroid-earn-demo/7fssN79v2V5UVxj9DsQBVwJ2FTgn) | [Preview](https://stellaroid-earn-demo-git-codex-secur-8cab4b-iron-marks-projects.vercel.app), [Comment](https://vercel.live/open-feedback/stellaroid-earn-demo-git-codex-secur-8cab4b-iron-marks-projects.vercel.app?via=pr-comment-feedback-link) | May 20, 2026 10:45am |\n\n\n@codex please review this security remediation PR.\n\n### 💡 Codex Review\n\nhttps://github.com/Iron-Mark/Hackathon-Stellaroid_Earn/blob/01ee94dd9ebf6692368a84400fab3ddb7741c1d3/frontend/src/lib/contract-client.ts#L401\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Pass sponsor auth token when client sponsorship is enabled**\n\nWhen `NEXT_PUBLIC_FEE_SPONSOR_CLIENT_ENABLED=1` and a sponsor address is configured, `signAndSubmit` calls `requestFeeBump(signedXdr)` without the required bearer token. `requestFeeBump` now throws immediately for missing authorization, and that exception is swallowed, so gasless mode silently never activates even when the client-side sponsorship flag is enabled.\n \n\n

ℹ️ About Codex in GitHub

\n
\n\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\n- Open a pull request for review\n- Mark a draft as ready\n- Comment \"@codex review\".\n\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\n\n\n\n\nCodex can also answer questions or update the PR. Try commenting \"@codex address that feedback\".\n \n

\n**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Reject plaintext metadata URLs before server fetch**\n\n`isSafeExternalHttpUrl` now treats both `https:` and `http:` as safe, and `getProofMetadataForCertificate` uses this gate before doing server-side metadata fetches. That allows on-chain metadata URIs over plaintext HTTP, so any network attacker on the path can alter the fetched JSON and the proof metadata your app presents to users. For trust metadata, this is a security regression from the prior HTTPS-only behavior and should be blocked at validation time.\n\nUseful? React with 👍 / 👎.\n**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Block IPv4-mapped IPv6 loopback in hostname filter**\n\nThe private-host check only matches `::1` and IPv4 private prefixes, but it does not catch IPv4-mapped IPv6 loopback forms (for example `::ffff:7f00:1`). A metadata URI like `http://[::ffff:7f00:1]/...` passes `isSafeExternalHttpUrl`, so the server-side metadata fetch can still be redirected to localhost/internal services despite the SSRF hardening.\n\nUseful? React with 👍 / 👎.\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Keep opportunity IDs lossless after switching calls to u64**\n\nThis PR upgrades follow-up opportunity calls to send `u64`, but IDs are still carried as JavaScript `number` and then re-encoded via `BigInt(oppId)`. Once an on-chain ID exceeds `Number.MAX_SAFE_INTEGER`, it is rounded before conversion, so `fund_opportunity`/`submit_milestone`/`approve_milestone`/`release_payment`/`refund_opportunity` may reference the wrong opportunity ID or fail unpredictably.\n\nUseful? React with 👍 / 👎.\n@codex closeout update:\n\nFixed and shipped the proof preview data-binding issue.\n\n- Commit: fdd06c4 (`fix(security): checkpoint proof preview and deployment alignment`)\n- Production: https://stellaroid.tech redeployed and aliased successfully\n- Contract: CDMUOHMARNVOJZM3IVOCJUPGBHDTHFBMZCCZXEZPQDVJGILH3NIKTTW3\n\nWhat changed:\n- `ProofBlockPreview` now prefers real credential titles from registration / lookup records.\n- `AppExperience` now carries `credentialTitle` and `credentialStatus` into the preview.\n- Non-demo hashes fall back to neutral `Pending Issuance`, not the bootcamp demo title.\n- Added focused unit coverage for non-demo title binding and neutral fallback.\n\nVerification:\n- `npm run test:unit`: 15 passed\n- `npm run lint`: passed\n- `npm run build`: passed locally and in Vercel production build\n- `npm run test:e2e`: 5 passed\n- Live smoke passed for home, status, health, proof metadata JSON, verified proof, OG image, unknown-proof neutral behavior, and fee-bump disabled/public rejection.\nAcknowledged — based on your **@codex closeout update** trigger and PR context, no additional code changes are required from me at this point.\n\nI validated that the referenced fix commit is present on the current branch:\n\n- ✅ `cd /workspace/Hackathon-Stellaroid_Earn && git status --short && git log --oneline -n 5`\n\nThe log includes:\n\n- `fdd06c4 fix(security): checkpoint proof preview and deployment alignment`\n\nSince there were **no new local changes to commit**, I did **not** create another commit and did **not** call `make_pr` (per your workflow constraints).\n\n [View task →](https://chatgpt.com/s/cd_6a0d9943149481918ae5c128c0940af2)",{},"created",1779279045.8430438,"Completing the task","event_type","info",{"_90":358,"_94":91,"_353":520},{"_90":517,"_518":519},"partial_repo_snapshot","files",[],[521],{"_505":45,"_45":360},{"_90":297,"_41":82,"_94":297,"_524":525,"_526":527,"_528":529,"_130":-5,"_117":530},[81],"input_items",[548,549,550,551,552,553,554,555,556,557],"external_post_config",{"_531":532,"_240":241,"_533":275,"_251":-5,"_534":235,"_535":-5,"_536":537,"_538":539,"_540":-5,"_541":-5,"_542":543,"_544":15,"_545":57,"_546":52,"_547":15},"user_model_slug","slug",1779279014.528759,"installation_id",103116209,"pr_number","repo_id","review_trigger","comment_id",4498243873,"comment_type","issue","pr_write_guard_token","pending_pr_reaction_id","pending_comment_reaction_id",359635411,"comment_if_no_findings","comment_on_error","share_url","is_parallel_review",{"_90":358,"_94":297,"_353":576},{"_282":283,"_284":285,"_573":290,"_574":292,"_293":-5,"_90":575},{"_90":558,"_284":572,"_159":-5,"_560":-5,"_561":-5},{"_90":558,"_284":571,"_159":-5,"_560":-5,"_561":-5},{"_90":558,"_284":570,"_159":-5,"_560":-5,"_561":-5},{"_90":558,"_284":569,"_159":567,"_560":565,"_561":-5},{"_90":558,"_284":566,"_159":567,"_560":565,"_561":568},{"_90":558,"_284":563,"_159":564,"_560":565,"_561":-5},{"_90":558,"_284":562,"_159":-5,"_560":-5,"_561":-5},{"_90":558,"_284":559,"_159":-5,"_560":-5,"_561":-5},"pull_request_comment","Acknowledged — based on your **@codex closeout update** trigger and PR context, no additional code changes are required from me at this point.\n\nI validated that the referenced fix commit is present on the current branch:\n\n- ✅ `cd /workspace/Hackathon-Stellaroid_Earn && git status --short && git log --oneline -n 5`\n\nThe log includes:\n\n- `fdd06c4 fix(security): checkpoint proof preview and deployment alignment`\n\nSince there were **no new local changes to commit**, I did **not** create another commit and did **not** call `make_pr` (per your workflow constraints).\n\n [View task →](https://chatgpt.com/s/cd_6a0d9943149481918ae5c128c0940af2)","side","line","@codex closeout update:\n\nFixed and shipped the proof preview data-binding issue.\n\n- Commit: fdd06c4 (`fix(security): checkpoint proof preview and deployment alignment`)\n- Production: https://stellaroid.tech redeployed and aliased successfully\n- Contract: CDMUOHMARNVOJZM3IVOCJUPGBHDTHFBMZCCZXEZPQDVJGILH3NIKTTW3\n\nWhat changed:\n- `ProofBlockPreview` now prefers real credential titles from registration / lookup records.\n- `AppExperience` now carries `credentialTitle` and `credentialStatus` into the preview.\n- Non-demo hashes fall back to neutral `Pending Issuance`, not the bootcamp demo title.\n- Added focused unit coverage for non-demo title binding and neutral fallback.\n\nVerification:\n- `npm run test:unit`: 15 passed\n- `npm run lint`: passed\n- `npm run build`: passed locally and in Vercel production build\n- `npm run test:e2e`: 5 passed\n- Live smoke passed for home, status, health, proof metadata JSON, verified proof, OG image, unknown-proof neutral behavior, and fee-bump disabled/public rejection.","**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Keep opportunity IDs lossless after switching calls to u64**\n\nThis PR upgrades follow-up opportunity calls to send `u64`, but IDs are still carried as JavaScript `number` and then re-encoded via `BigInt(oppId)`. Once an on-chain ID exceeds `Number.MAX_SAFE_INTEGER`, it is rounded before conversion, so `fund_opportunity`/`submit_milestone`/`approve_milestone`/`release_payment`/`refund_opportunity` may reference the wrong opportunity ID or fail unpredictably.\n\nUseful? React with 👍 / 👎.","frontend/src/lib/contract-client.ts","RIGHT","**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Block IPv4-mapped IPv6 loopback in hostname filter**\n\nThe private-host check only matches `::1` and IPv4 private prefixes, but it does not catch IPv4-mapped IPv6 loopback forms (for example `::ffff:7f00:1`). A metadata URI like `http://[::ffff:7f00:1]/...` passes `isSafeExternalHttpUrl`, so the server-side metadata fetch can still be redirected to localhost/internal services despite the SSRF hardening.\n\nUseful? React with 👍 / 👎.","frontend/src/lib/security.ts",46,"**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Reject plaintext metadata URLs before server fetch**\n\n`isSafeExternalHttpUrl` now treats both `https:` and `http:` as safe, and `getProofMetadataForCertificate` uses this gate before doing server-side metadata fetches. That allows on-chain metadata URIs over plaintext HTTP, so any network attacker on the path can alter the fetched JSON and the proof metadata your app presents to users. For trust metadata, this is a security regression from the prior HTTPS-only behavior and should be blocked at validation time.\n\nUseful? React with 👍 / 👎.","\n### 💡 Codex Review\n\nhttps://github.com/Iron-Mark/Hackathon-Stellaroid_Earn/blob/01ee94dd9ebf6692368a84400fab3ddb7741c1d3/frontend/src/lib/contract-client.ts#L401\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Pass sponsor auth token when client sponsorship is enabled**\n\nWhen `NEXT_PUBLIC_FEE_SPONSOR_CLIENT_ENABLED=1` and a sponsor address is configured, `signAndSubmit` calls `requestFeeBump(signedXdr)` without the required bearer token. `requestFeeBump` now throws immediately for missing authorization, and that exception is swallowed, so gasless mode silently never activates even when the client-side sponsorship flag is enabled.\n \n\n

ℹ️ About Codex in GitHub

","@codex please review this security remediation PR.","[vc]: #LgshqjkLFiyFyjDhqqP97tRxhRcdwHkCjS8bXK1iFoY=:eyJpc01vbm9yZXBvIjp0cnVlLCJ0eXBlIjoiZ2l0aHViIiwicHJvamVjdHMiOlt7Im5hbWUiOiJzdGVsbGFyb2lkLWVhcm4tZGVtbyIsInByb2plY3RJZCI6InByal9HTm9GY1hKcEt1d0RVejdJZUd0dEFmd0N4TUZsIiwibGl2ZUZlZWRiYWNrIjp7InJlc29sdmVkIjowLCJ1bnJlc29sdmVkIjowLCJ0b3RhbCI6MCwibGluayI6InN0ZWxsYXJvaWQtZWFybi1kZW1vLWdpdC1jb2RleC1zZWN1ci04Y2FiNGItaXJvbi1tYXJrcy1wcm9qZWN0cy52ZXJjZWwuYXBwIn0sImluc3BlY3RvclVybCI6Imh0dHBzOi8vdmVyY2VsLmNvbS9pcm9uLW1hcmtzLXByb2plY3RzL3N0ZWxsYXJvaWQtZWFybi1kZW1vLzdmc3NONzl2MlY1VVZ4ajlEc1FCVndKMkZUZ24iLCJwcmV2aWV3VXJsIjoic3RlbGxhcm9pZC1lYXJuLWRlbW8tZ2l0LWNvZGV4LXNlY3VyLThjYWI0Yi1pcm9uLW1hcmtzLXByb2plY3RzLnZlcmNlbC5hcHAiLCJuZXh0Q29tbWl0U3RhdHVzIjoiREVQTE9ZRUQiLCJyb290RGlyZWN0b3J5IjoiZnJvbnRlbmQifV19\nThe latest updates on your projects. Learn more about [Vercel for GitHub](https://vercel.link/github-learn-more).\n\n| Project | Deployment | Actions | Updated (UTC) |\n| :--- | :----- | :------ | :------ |\n| [stellaroid-earn-demo](https://vercel.com/iron-marks-projects/stellaroid-earn-demo) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/iron-marks-projects/stellaroid-earn-demo/7fssN79v2V5UVxj9DsQBVwJ2FTgn) | [Preview](https://stellaroid-earn-demo-git-codex-secur-8cab4b-iron-marks-projects.vercel.app), [Comment](https://vercel.live/open-feedback/stellaroid-earn-demo-git-codex-secur-8cab4b-iron-marks-projects.vercel.app?via=pr-comment-feedback-link) | May 20, 2026 10:45am |\n\n","base_ref","head_ref","pull_request_info",[577],{"_505":45,"_45":578},"@codex closeout update for the two follow-up findings:\n\nFixed and shipped:\n\n- Metadata URL SSRF: fixed by removing server-side fetch of issuer-supplied metadata URLs. Proof metadata now derives from on-chain certificate fields and known demo fallback data; safe metadata URLs are kept only as evidence links. Also tightened trailing-dot private-host normalization.\n- Stale proof preview title: fixed by clearing preview title state when a newly loaded credential record has a blank/whitespace title, so the preview falls back to neutral copy instead of retaining the previous credential title.\n\nCommits:\n- 73ebfbe `fix(security): harden proof metadata and preview state`\n- b8a4170 `fix(test): repair proof preview typecheck`\n\nProduction:\n- Redeployed and aliased to https://stellaroid.tech\n- Deployment: https://stellaroid-earn-demo-gnyzzols8-iron-marks-projects.vercel.app\n\nVerification:\n- Local `npm run test:unit`: 17 passed\n- Local `npm run lint`: passed\n- Local `npm run build`: passed\n- Local `npm run test:e2e`: 5 passed\n- GitHub main CI for `b8a4170`: passed build, lint, typecheck, and Playwright E2E\n- Live smoke passed for home, status, health, proof metadata JSON, verified proof, proof OG image, unknown-proof neutral behavior, and fee-bump disabled/public rejection.",[705,706],[],{"_510":511,"_45":512,"_513":514},{"_484":696},{"_308":695},{"_308":613},{"_274":275,"_272":276,"_277":278,"_279":57,"_280":15,"_281":15,"_282":283,"_284":285,"_286":125,"_287":288,"_289":290,"_291":292,"_293":294,"_295":-5,"_296":-5,"_297":612,"_299":300,"_301":302,"_303":304,"_305":306},{"_41":121,"_191":192,"_193":194,"_195":15,"_196":197,"_198":199,"_200":-5,"_201":-5,"_202":203,"_204":602,"_206":197,"_207":197,"_208":603,"_210":604,"_212":605,"_214":-5,"_215":216,"_217":218,"_219":220,"_221":606,"_53":-5,"_117":223,"_224":607,"_226":608,"_228":229,"_230":15,"_231":15},{"_131":595},[589,590,591,592,593,594],{"_146":169,"_148":163,"_150":164,"_152":161,"_154":170,"_156":157,"_158":31,"_159":-5},{"_146":168,"_148":163,"_150":164,"_152":161,"_154":165,"_156":157,"_158":31,"_159":-5},{"_146":166,"_148":163,"_150":164,"_152":161,"_154":167,"_156":157,"_158":31,"_159":-5},{"_146":162,"_148":163,"_150":164,"_152":161,"_154":165,"_156":157,"_158":31,"_159":-5},{"_146":160,"_148":149,"_150":151,"_152":161,"_154":155,"_156":157,"_158":31,"_159":-5},{"_146":147,"_148":149,"_150":151,"_152":153,"_154":155,"_156":157,"_158":31,"_159":-5},[596,597,598],{"_175":601,"_177":188},{"_175":600,"_177":184},{"_175":599,"_177":178},{"_179":180,"_90":181,"_117":182},{"_179":185,"_90":181,"_117":186},{"_179":189,"_90":181,"_117":190},[235],{"_235":609},{},{},[],{"_234":57},{"_232":57,"_233":197},{"_41":237,"_179":194,"_238":610,"_240":241,"_242":243,"_244":125,"_245":246,"_247":248,"_249":250,"_251":62,"_252":15,"_253":15,"_254":57,"_255":57,"_256":57,"_257":15,"_258":-5,"_158":259,"_260":-5,"_53":611},{"_266":267,"_41":268,"_90":269,"_270":271,"_272":273},{"_262":57,"_263":15,"_264":57,"_265":57},{"_266":267,"_179":267,"_307":-5,"_270":271,"_41":268},[614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631],{"_152":463,"_329":691},{"_152":344,"_329":688},{"_152":453,"_329":685},{"_152":348,"_329":680},{"_152":348,"_329":675},{"_152":348,"_329":671},{"_152":362,"_329":666},{"_152":362,"_329":662},{"_152":348,"_329":658},{"_152":348,"_329":656},{"_152":362,"_329":652},{"_152":348,"_329":650},{"_152":362,"_329":646},{"_152":348,"_329":643},{"_152":362,"_329":641},{"_152":348,"_329":637},{"_152":344,"_329":635},{"_152":328,"_329":632},{"_331":332,"_85":633},{"_334":335,"_336":337,"_101":-5,"_41":338,"_339":634,"_341":342,"_343":111},[],{"_343":636,"_331":332},{"_90":347},{"_350":638,"_331":332,"_352":338},{"_353":639,"_355":-5,"_41":-5,"_356":357,"_94":91,"_90":358},[640],{"_45":360,"_90":361},{"_350":642,"_331":332,"_352":338},{"_41":365,"_356":357,"_45":360,"_90":366},{"_350":644,"_331":332,"_352":338},{"_353":-5,"_369":370,"_41":-5,"_371":645,"_90":373},[],{"_350":647,"_331":332,"_352":338},{"_353":648,"_41":377,"_371":649,"_90":373},[],[],{"_350":651,"_331":332,"_352":338},{"_381":382,"_383":384,"_90":385},{"_350":653,"_331":332,"_352":338},{"_388":389,"_390":391,"_392":654,"_394":395,"_336":31,"_396":31,"_41":382,"_397":398,"_399":400,"_343":111,"_90":401},[655],{"_390":403,"_90":404},{"_350":657,"_331":332,"_352":338},{"_407":408,"_381":382,"_41":-5,"_179":409,"_410":-5,"_90":411},{"_350":659,"_331":332,"_352":338},{"_353":-5,"_369":414,"_41":-5,"_371":660,"_90":373},[661],{"_45":417,"_90":418},{"_350":663,"_331":332,"_352":338},{"_353":664,"_41":422,"_371":665,"_90":373},[],[417],{"_350":667,"_331":332,"_352":338},{"_353":668,"_41":427,"_90":428},[669],{"_45":430,"_431":670,"_90":45},[],{"_350":672,"_331":332,"_352":338},{"_353":673,"_355":-5,"_41":-5,"_356":-5,"_94":297,"_90":358},[674],{"_45":430,"_90":437},{"_350":676,"_331":332,"_352":338},{"_353":677,"_355":-5,"_41":-5,"_356":-5,"_94":297,"_90":358},[678,679],{"_45":444,"_90":437},{"_45":443,"_90":437},{"_350":681,"_331":332,"_352":338},{"_353":682,"_355":-5,"_41":-5,"_356":-5,"_94":448,"_90":358},[683,684],{"_45":452,"_90":437},{"_45":451,"_90":437},{"_331":332,"_85":686},{"_101":-5,"_41":338,"_339":687,"_341":342,"_343":457},[],{"_343":689,"_331":332},{"_460":690,"_90":462},[],{"_465":692},{"_467":-5,"_468":-5,"_469":470,"_471":342,"_394":395,"_472":15,"_473":-5,"_474":-5,"_41":332,"_475":476,"_179":-5,"_159":477,"_478":197,"_399":479,"_343":693,"_75":694,"_482":342},{"_90":347},[],[],[697],{"_41":487,"_488":698,"_490":491,"_492":491,"_353":699,"_343":494,"_355":-5,"_495":31,"_496":700,"_498":499,"_500":-5},{"_94":297,"_179":-5,"_496":704},{"_505":45,"_506":703},{"_501":701},{"_503":702},[],[508],{},{"_90":358,"_94":91,"_353":708},{"_90":517,"_518":707},[],[709],{"_505":45,"_45":360},[712,713,714,715,716,717,718,719,720,721],{"_531":532,"_240":241,"_533":275,"_251":-5,"_534":235,"_535":-5,"_536":537,"_538":539,"_540":-5,"_541":-5,"_542":543,"_544":15,"_545":57,"_546":52,"_547":15},{"_90":358,"_94":297,"_353":722},{"_282":283,"_284":285,"_573":290,"_574":292,"_293":-5,"_90":575},{"_90":558,"_284":572,"_159":-5,"_560":-5,"_561":-5},{"_90":558,"_284":571,"_159":-5,"_560":-5,"_561":-5},{"_90":558,"_284":570,"_159":-5,"_560":-5,"_561":-5},{"_90":558,"_284":569,"_159":567,"_560":565,"_561":-5},{"_90":558,"_284":566,"_159":567,"_560":565,"_561":568},{"_90":558,"_284":563,"_159":564,"_560":565,"_561":-5},{"_90":558,"_284":562,"_159":-5,"_560":-5,"_561":-5},{"_90":558,"_284":559,"_159":-5,"_560":-5,"_561":-5},[723],{"_505":45,"_45":578},"task_e_6a0da4a4e978832aa08f7409fe6c2a95",1779279012.912378,"Github Mention: fix(security): remediate audit findings","has_generated_title","has_unread_turn","denormalized_metadata",{"_755":31,"_756":757,"_758":-5,"_759":-5,"_750":760,"_761":-5,"_762":-5,"_763":-5,"_764":-5},"task_status_display",{"_743":744,"_745":194,"_128":125,"_746":-5,"_747":748},"creator_workspace","external_pull_requests",[736],{"_41":737,"_738":81,"_739":740,"_741":292},"github-1213964152-15","assistant_turn_id","pull_request",{"_274":275,"_272":276,"_277":278,"_279":57,"_280":15,"_281":15,"_282":283,"_284":285,"_286":125,"_287":288,"_289":290,"_291":292,"_293":294,"_295":-5,"_296":-5,"_297":742,"_299":300,"_301":302,"_303":304,"_305":306},"codex_updated_sha",{"_266":267,"_179":267,"_307":-5,"_270":271,"_41":268},"latest_turn_status_display",{"_749":81,"_110":111,"_750":-5,"_92":751,"_752":-5,"_753":-5,"_754":748,"_112":-5},"environment_label","fix_task_id","initial_intent","pr","turn_id","diff_stats",[],"image_asset_pointer_citations","issue_counts","intent","num_follow_ups","repo_name_map",{},"last_user_turn_created_at","last_turn_status",{"_765":-5,"_766":-5,"_767":-5},"last_pushed_turn_id","start_branch_name","pushed_branch_name","cached_pull_request_data","files_modified","lines_added","lines_removed","dd",{"_779":780,"_781":782},"disablePrefetch","shouldPrefetchAccount","shouldPrefetchUser","shouldPrefetchSystemHints","promoteCss","disableSSR","stripModulepreloadImports","statsigGateEvaluationsPromise",["P",778],"traceId","15383507541201215459","traceTime",1780353698474]