feat: document deployment plan and harden ci

.github/workflows/ci.yml

@@ -2,19 +2,55 @@ name: CI
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
-    branches: [ main ]
+    branches: [main]
 
 jobs:
-  build:
+  quality:
     runs-on: ubuntu-latest
+    env:
+      CI: true
     steps:
-      - uses: actions/checkout@v4
-      - name: Set up Node
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v3
+        with:
+          version: 10.18.3
+
+      - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
-      - name: CI placeholder
-        run: |
-          echo "CI scaffolded — implement env-sync, lint and tests."
+          node-version: '22'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install Foundry
+        uses: foundry-rs/foundry-toolchain@v1
+        with:
+          version: v1.4.3
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Build frontend
+        run: pnpm --filter frontend build
+
+      - name: Build indexer
+        run: pnpm --filter indexer build
+
+      - name: Build contracts
+        run: pnpm --filter contracts build
+
+      - name: Test frontend
+        run: pnpm --filter frontend test
+
+      - name: Test indexer
+        run: pnpm --filter indexer test
+
+      - name: Test contracts
+        run: pnpm --filter contracts test

.gitignore

@@ -1,6 +1,5 @@
 # Node / pnpm
 node_modules/
-pnpm-lock.yaml
 .pnpm-store/
 
 # Env files
@@ -9,6 +8,8 @@ pnpm-lock.yaml
 .env.development.local
 .env.production.local
 .env.test.local
+!.env.example
+!**/.env.example
 
 # Logs
 logs/

README.md

@@ -78,7 +78,7 @@ No secrets should be committed—copy the relevant `.env.example` into `.env` lo
 
 ## Development Notes
 
-- **Tooling**: Node v22.21.0, pnpm 10.18.3, Foundry 1.4.4 (see `tool-versions.md`).
+- **Tooling**: Node v22.21.0, pnpm 10.18.3, Foundry v1.4.3 (see `tool-versions.md`).
 - **Linting**: `pnpm lint` (TS + Solidity) and `pnpm format`.
 - **Testing**: Workspace scripts (`vitest` today, forge tests added from Session 2 onward).
 - **Git hooks**: Husky + lint-staged ensure staged files pass lint/format before commit.

agent-context/deployment.md

@@ -0,0 +1,157 @@
+# Deployment & Operations Playbook
+
+This playbook captures the end-to-end steps for publishing the peer-mapper stack once contracts, indexer, and frontend are ready. Session 09 focuses on making deployment repeatable rather than broadcasting from the container.
+
+## 1. Pre-flight Checklist
+
+1. Ensure `pnpm-lock.yaml` is committed (generated via `pnpm install`).
+2. Export the required secrets into your shell (never commit real values):
+   - `MOONBEAM_RPC`, `PRIVATE_KEY_DEPLOYER`, `PRIVATE_KEY_RELAYER`
+   - `SUPABASE_*` keys from the production project
+   - `VERCEL_TOKEN`, `VERCEL_ORG_ID`, `VERCEL_PROJECT_ID`
+   - `FLY_API_TOKEN` (or Render token if using Render)
+3. Confirm Supabase has the production tables (`public.users`) and RLS policies applied.
+4. Update `addresses.json` with the last-known deployment artefacts after each broadcast.
+5. Run the full quality gate locally:
+   ```bash
+   pnpm lint
+   pnpm --filter frontend build
+   pnpm --filter indexer build
+   pnpm --filter frontend test
+   pnpm --filter indexer test
+   pnpm test
+   ```
+
+## 2. Contract Deployment (Moonbeam)
+
+> Uses Foundry scripts under `contracts/script/`.
+
+1. Configure the deployer key:
+   ```bash
+   export MOONBEAM_RPC=https://rpc.api.moonbeam.network
+   export PRIVATE_KEY_DEPLOYER=0x...
+   export PRIVATE_KEY_RELAYER=0x...
+   ```
+2. Deploy SchemaRegistry + EAS:
+   ```bash
+   cd contracts
+   forge script script/DeployEAS.s.sol \
+     --rpc-url "$MOONBEAM_RPC" \
+     --broadcast \
+     --verify \
+     --etherscan-api-key "$MOONSCAN_API_KEY"
+   ```
+3. Register the CubidTrust schema against the deployed registry:
+   ```bash
+   forge script script/RegisterSchema.s.sol \
+     --rpc-url "$MOONBEAM_RPC" \
+     --broadcast
+   ```
+4. Deploy FeeGate with the resulting addresses and schema UID. Example:
+   ```bash
+   forge script script/DeployFeeGate.s.sol \
+     --rpc-url "$MOONBEAM_RPC" \
+     --broadcast \
+     --verify \
+     --etherscan-api-key "$MOONSCAN_API_KEY"
+   ```
+5. Capture the contract addresses, schema UID, and transaction hashes into `addresses.json` and `agent-context/eas-addresses.md`.
+
+### 2.1 Moonscan Verification Links
+
+Moonscan verification happens automatically when `--verify` + `--etherscan-api-key` are provided. Record the permalink to each contract:
+
+- SchemaRegistry: `https://moonscan.io/address/<address>#code`
+- EAS: `https://moonscan.io/address/<address>#code`
+- FeeGate: `https://moonscan.io/address/<address>#code`
+
+## 3. Indexer Deployment (Fly.io example)
+
+1. Build the production image (Dockerfile already present under `indexer/`):
+   ```bash
+   pnpm --filter indexer build
+   docker build -f indexer/Dockerfile -t peer-mapper-indexer:latest .
+   ```
+2. Authenticate with Fly:
+   ```bash
+   fly auth token
+   export FLY_API_TOKEN=...
+   ```
+3. Create the app:
+   ```bash
+   fly apps create peer-mapper-indexer
+   ```
+4. Provision a persistent volume or external Postgres (SQLite is default). For Postgres:
+   ```bash
+   fly postgres create --name peer-mapper-db --initial-cluster-size 1
+   ```
+   Set `DATABASE_URL` to the connection string.
+5. Deploy:
+   ```bash
+   fly deploy --dockerfile indexer/Dockerfile --build-arg PNPM_VERSION=10.18.3
+   ```
+6. Configure secrets (one per environment variable):
+   ```bash
+   fly secrets set \
+     DATABASE_URL=postgres://... \
+     MOONBEAM_RPC=... \
+     PRIVATE_KEY_RELAYER=... \
+     REGISTRY_ADDR=0x... \
+     EAS_ADDR=0x... \
+     SCHEMA_UID=0x... \
+     FEEGATE_ADDR=0x... \
+     SUPABASE_URL=https://... \
+     SUPABASE_SERVICE_ROLE_KEY=... \
+     SUPABASE_JWT_SECRET=...
+   ```
+7. Validate health by curling `/healthz` (Express route exported in `src/api.ts`). Record the public URL in the session log.
+
+_Alternative:_ Render can follow the same Dockerfile. Configure environment variables in the Render dashboard and enable auto-deploy from `main`.
+
+## 4. Frontend Deployment (Vercel)
+
+1. Create a new Vercel project pointing to `frontend/`.
+2. Configure build & dev commands:
+   - **Build Command:** `pnpm --filter frontend build`
+   - **Install Command:** `pnpm install`
+   - **Output Directory:** `.next`
+3. Add environment variables for both Production and Preview:
+   - `NEXT_PUBLIC_INDEXER_URL=https://peer-mapper-indexer.fly.dev`
+   - `NEXT_PUBLIC_EAS_ADDR=0x...`
+   - `NEXT_PUBLIC_FEEGATE_ADDR=0x...`
+   - `NEXT_PUBLIC_SCHEMA_UID=0x...`
+   - `NEXT_PUBLIC_CHAIN_ID=1284`
+   - `NEXT_PUBLIC_SUPABASE_URL=https://...`
+   - `NEXT_PUBLIC_SUPABASE_ANON_KEY=...`
+4. Configure the Supabase redirect URL to include the Vercel domain.
+5. Promote the initial deployment to production once smoke-tested.
+
+## 5. Release Management
+
+- Tag contract deployments (`git tag contracts-v1`) when addresses change. Update `addresses.json` history.
+- For coordinated releases, create a GitHub release noting:
+  - Contract versions + Moonscan links
+  - Indexer deployment URL and build timestamp
+  - Frontend Vercel deployment ID
+- Each production release should attach the output of `pnpm test`, `pnpm lint`, and `pnpm --filter frontend build`.
+
+## 6. Observability & Rollback
+
+- **Indexer:** enable Fly logs (`fly logs -a peer-mapper-indexer`). Add uptime checks (e.g., Better Stack) hitting `/healthz` every minute.
+- **Frontend:** rely on Vercel analytics for build health. Configure a preview protection password if needed.
+- **Contracts:** monitor Moonscan events or integrate Tenderly simulation for FeeGate.
+- Rollback steps:
+  - Frontend: promote a previous Vercel deployment.
+  - Indexer: `fly deploy --image <previous image>`.
+  - Contracts: redeploy new FeeGate version and update addresses (irreversible, so guard carefully).
+
+## 7. Artefact Recording
+
+After each deploy, update:
+
+- `agent-context/eas-addresses.md`
+- `addresses.json`
+- `agent-context/session-log.md`
+- `agent-context/session-logs/session-XX.md`
+
+Include URLs, block numbers, and verification links to preserve provenance.

agent-context/eas-addresses.md

@@ -4,12 +4,26 @@
 
 - SchemaRegistry: `TODO`
 - EAS: `TODO`
+- FeeGate: `TODO`
 - CubidTrust Schema UID: `TODO`
+- Moonscan Verification:
+  - SchemaRegistry: `https://moonscan.io/address/TODO#code`
+  - EAS: `https://moonscan.io/address/TODO#code`
+  - FeeGate: `https://moonscan.io/address/TODO#code`
+- Deployment Tx Hashes:
+  - DeployEAS: `0xTODO`
+  - RegisterSchema: `0xTODO`
+  - DeployFeeGate: `0xTODO`
 
 ## Local Anvil (Testing)
 
 - SchemaRegistry: `0x0000000000000000000000000000000000000000`
 - EAS: `0x0000000000000000000000000000000000000000`
 - CubidTrust Schema UID: `0x0000000000000000000000000000000000000000000000000000000000000000`
+- FeeGate: `0x0000000000000000000000000000000000000000`
 
-> Update these placeholders after running the Foundry scripts in `contracts/script/`.
+## Notes
+
+- Update these placeholders after running the Foundry scripts in `contracts/script/`.
+- Mirror the same data into `addresses.json` so tooling stays in sync.
+- Keep production and testnet entries current; add historical deployments to the `history` arrays in `addresses.json`.

agent-context/functional-spec.md

@@ -198,4 +198,15 @@ The MVP focuses on human-to-human verification and displaying mutual trusted con
 
 ---
 
+## 11. Deployment & Operations (Session 09)
+
+- **Release checklist:** Run the full quality gate (`pnpm lint`, builds, tests across workspaces) before promoting any commit.
+- **Contracts:** Broadcast via Foundry scripts with `--verify` and capture addresses + Moonscan links in `agent-context/eas-addresses.md`.
+- **Indexer:** Deploy the Docker image on Fly.io (or Render) and configure secrets for RPC endpoints, Supabase credentials, and contract IDs. `/healthz` is the primary readiness probe.
+- **Frontend:** Ship to Vercel with environment variables mirroring the production indexer + contract addresses. Preview deployments should use the same Supabase anon key to exercise auth.
+- **Documentation:** `agent-context/deployment.md` now records the full procedure and must be updated with URLs, transaction hashes, and release tags after each rollout.
+- **Incident response:** In case of failure, roll back via Vercel deployment promotion or `fly deploy --image <previous>` while keeping contract data immutable. Record remedial steps in the session log.
+
+---
+
 This **Functional Specification** expresses _what the system does_ from the user’s perspective — clean, behavioral, and outcome-driven — and should be kept fully consistent with your _Technical Specification_ that defines _how_ it’s done.

agent-context/session-log.md

@@ -1,5 +1,9 @@
 # session-log.md
 
+session: v12
+
+- 2025-11-09 — Session 09 (deployment & CI/CD readiness): Generated the workspace lockfile, replaced the placeholder CI with a full lint/build/test pipeline (Node 22 + pnpm + Foundry), authored a deployment playbook, enriched the technical and functional specs with release guidance, extended the EAS addresses ledger for Moonscan links, and logged the session artefacts.
+
 session: v11
 
 - 2025-11-08 — Session 08 (security & determinism polish): Enforced delegated deadline expiry in FeeGate, exposed the on-chain `getLastUID` anchor, taught the indexer listener to honour the anchor with exponential backoff on RPC fetches and basic Cubid length guards, expanded Vitest coverage for canonical anchors/DoS checks, and refreshed the specs + log.

agent-context/session-logs/session-09.md

@@ -0,0 +1,46 @@
+# Session 09 — Deployment & CI/CD Readiness
+
+**Date:** 2025-11-09 \
+**Status:** ✅ COMPLETE
+
+## Goals
+
+- Establish repeatable deployment guidance for contracts, indexer, and frontend.
+- Replace the placeholder CI workflow with a real lint/build/test gate.
+- Record artefacts (addresses, logs, docs) for future operators.
+
+## Actions Performed
+
+- Generated and committed `pnpm-lock.yaml` to stabilise installs across CI and Docker.
+- Authored `agent-context/deployment.md` describing contract broadcasts, Moonscan verification, Fly.io indexer rollout, and Vercel frontend setup.
+- Expanded `agent-context/technical-spec.md` and `functional-spec.md` with deployment/operations posture.
+- Enriched `agent-context/eas-addresses.md` to track FeeGate address, Moonscan URLs, and tx hashes.
+- Upgraded `.github/workflows/ci.yml` to install pnpm + Foundry, then run lint, builds, and tests across all workspaces.
+- Logged the session summary in `agent-context/session-log.md`.
+
+## Commands & Outputs (highlights)
+
+- `pnpm install` — produced the initial `pnpm-lock.yaml` and verified dependency graph.
+
+## Artifacts
+
+- `pnpm-lock.yaml`
+- `.github/workflows/ci.yml`
+- `agent-context/deployment.md`
+- `agent-context/technical-spec.md`
+- `agent-context/functional-spec.md`
+- `agent-context/eas-addresses.md`
+- `agent-context/session-log.md`
+
+## Tests
+
+- Pending — run via CI on pull request (`pnpm lint`, builds, tests across workspaces).
+
+## Issues/Risks
+
+- Actual Moonbeam deployment requires `MOONSCAN_API_KEY` and funded keys; ensure secrets management before live broadcast.
+- Fly.io build expects matching pnpm version (set via build arg) — keep `deployment.md` instructions in sync if pnpm updates.
+
+## Next Session Entry Criteria
+
+- Proceed to Session 10 once contracts are deployed, URLs captured, and smoke tests succeed in production environments.

agent-context/technical-spec.md

@@ -279,26 +279,15 @@ All payments handled in **FeeGate** (treasury = contract balance). Treasury with
 
 ---
 
-## 8) Deployment Plan (1–2 days)
-
-1. **Contracts**
-   - Deploy `SchemaRegistry` and `EAS` (Moonbeam).
-   - Deploy `FeeGate` with pointers to `EAS` + `schemaUID`.
-   - Register `CubidTrust` schema in `SchemaRegistry` with `resolver = FeeGate`.
-   - Verify contracts on Moonscan.
-
-2. **Indexer**
-   - Configure to listen for `EAS.Attested`/`Revoked` for `schemaUID`.
-   - Build `attestations_latest` table; expose REST.
-
-3. **Frontend**
-   - Wire Cubid SDK, Nova/EVM connect.
-   - Implement Vouch (prepare → sign → relay), QR (challenge), Results.
-
-4. **Dry-run**
-   - Seed 2–3 demo issuers, vouch for 3–4 `cubidId`s.
-   - Validate 3rd-attestation fee path.
-   - Live demo: QR scan + overlap render.
+## 8) Deployment & CI/CD Posture
+
+- **Contracts:** Foundry scripts (`DeployEAS.s.sol`, `RegisterSchema.s.sol`, `DeployFeeGate.s.sol`) broadcast to Moonbeam mainnet using `PRIVATE_KEY_DEPLOYER`. Use `--verify` with `MOONSCAN_API_KEY` so source is published automatically. Record the resulting SchemaRegistry, EAS, FeeGate, and schema UID in `addresses.json` and `agent-context/eas-addresses.md` after every deploy.
+- **Moonscan verification:** Store the verification permalinks (e.g., `https://moonscan.io/address/<addr>#code`) alongside the addresses and reference them in `agent-context/deployment.md`.
+- **Indexer:** Dockerised via `indexer/Dockerfile` (Node 22 + pnpm). Deploy on Fly.io (`fly deploy --dockerfile indexer/Dockerfile`) with secrets for RPC, Supabase, and contract identifiers. `/healthz` exposes readiness for uptime checks. Alternative hosts (Render) follow the same container image.
+- **Frontend:** Hosted on Vercel. Build command `pnpm --filter frontend build`, install `pnpm install`, output `.next`. Runtime env vars include `NEXT_PUBLIC_INDEXER_URL`, `NEXT_PUBLIC_EAS_ADDR`, `NEXT_PUBLIC_FEEGATE_ADDR`, `NEXT_PUBLIC_SCHEMA_UID`, `NEXT_PUBLIC_SUPABASE_URL`, `NEXT_PUBLIC_SUPABASE_ANON_KEY`, `NEXT_PUBLIC_CHAIN_ID=1284`.
+- **Quality gate:** Before promoting changes run `pnpm lint`, `pnpm --filter frontend build`, `pnpm --filter indexer build`, `pnpm --filter frontend test`, `pnpm --filter indexer test`, and `pnpm test`. CI enforces the same sequence.
+- **CI:** `.github/workflows/ci.yml` sets up Node 22, pnpm, and Foundry, installs dependencies, then runs the lint/build/test matrix across contracts, indexer, and frontend.
+- **Release log:** Update `agent-context/deployment.md`, session logs, and `addresses.json` with URLs, block numbers, and hashes per release.
 
 ---
 

frontend/.env.example

@@ -0,0 +1,7 @@
+NEXT_PUBLIC_INDEXER_URL=http://localhost:4000
+NEXT_PUBLIC_EAS_ADDR=0x0000000000000000000000000000000000000000
+NEXT_PUBLIC_FEEGATE_ADDR=0x0000000000000000000000000000000000000000
+NEXT_PUBLIC_SCHEMA_UID=0x0000000000000000000000000000000000000000000000000000000000000000
+NEXT_PUBLIC_CHAIN_ID=1284
+NEXT_PUBLIC_SUPABASE_URL=http://localhost:54321
+NEXT_PUBLIC_SUPABASE_ANON_KEY=dev-anon-key