Task: Configure and smoke Buy TCOIN sandbox on Preview

[KazanderDad]

Parent Goal: #79
Depends on: #74
Blocks: Production live Buy TCOIN gate

Objective

Configure and smoke Buy TCOIN sandbox on the Preview/dev path.

Expected Surfaces

• Vercel TCOIN Preview deployment
• Buy TCOIN checkout configuration
• Onramp sandbox/provider configuration
• NEXT_PUBLIC_ENABLE_BUY_TCOIN_CHECKOUT

Scope

• Verify sandbox env vars and provider mode.
• Run sandbox checkout smoke if configured.
• Record transaction/checkout evidence or exact blocker on Goal Goal: Prove Preview sandbox smoke and Buy TCOIN sandbox #79.

Non-Goals

• Do not enable live Buy TCOIN.
• Do not run mainnet settlement.

Guardrails

• Sandbox first; live remains gated behind explicit main approval.
• Keep checkout disabled if sandbox is not fully configured.

Acceptance Criteria

• Buy TCOIN sandbox smoke passes or a precise external/provider blocker is recorded.
• Goal Goal: Prove Preview sandbox smoke and Buy TCOIN sandbox #79 contains the evidence.

Validation Plan

• Hosted Preview browser smoke against Buy TCOIN entrypoint.
• Provider sandbox logs/receipt or documented blocker.

Stop Condition

Stop after sandbox evidence is captured or the missing provider/env dependency is explicit.

[KazanderDad]

Vetting Note

This issue is part of Sprint #78 and is vetted for the shared implementation branch/worktree below.

Implementation Worktree

• Repo: GreenPill-TO/Genero
• Base branch: origin/dev
• Worktree path: /Users/botmaster/src/greenpill-TO/Genero
• Worktree branch: codex/tcoin-production-launch-readiness
• Use this same worktree for related Sprint Sprint: TCOIN production launch readiness #78 issues: Goal: Align hosted release environments and remote Supabase readiness #74, Goal: Prove Preview sandbox smoke and Buy TCOIN sandbox #79, Goal: Prove Supabase-side worker scheduling #80, Goal: Prove Production smoke and live Buy TCOIN gate #81, and Tasks Task: Configure GitHub Environment secrets and vars for TCOIN release alignment #82-Task: Enforce live Buy TCOIN approval gate and disabled fallback #93.
• Worktree owner: Sprint Sprint: TCOIN production launch readiness #78 / sprint-orchestrator.
• Retain until: Sprint PR is merged and approved-cleanup completes.
• Cleanup owner: sprint-orchestrator via approved-cleanup.
• Do not implement the parent Sprint issue directly; implement unblocked Ready Task issues first, then validate their parent Goal.

Implementation Expectations

• Update code, docs, tests, and agent-context/session-log/ as relevant to the issue.
• Capture evidence directly on the relevant Goal issue, not in a separate evidence packet.
• Never print or persist secret values.
• Do not run linked Supabase writes without explicit just-in-time human approval.
• For UI/browser smoke, provide route/result notes and screenshots or comparable visual evidence when practical.

Issue Validator

After implementation, local validation, session-log update, and commit, the orchestrator must run issue-validator before moving high-risk Tasks or Goals to In Review.

Validator input should include: issue URL, parent issue URL, commit hash, worktree path, changed files summary, validation commands/results, smoke evidence, visual evidence where relevant, non-goals/guardrails, skipped checks, and residual risks.

Expected validator output: pass, pass-with-notes, or fail, with concise evidence and required fixes. The validator reports back to the orchestrator; the orchestrator moves Project status only after validation passes.

[KazanderDad]

Implementation evidence for #85

Commit: da5fb27

Result: pass-with-notes. Buy TCOIN sandbox smoke did not pass, but the task stop condition is satisfied because the blocker is precise and externally actionable.

Evidence:

• gh variable list --env "Preview – tcoin" shows NEXT_PUBLIC_ENABLE_BUY_TCOIN_CHECKOUT=false, so the Preview Buy TCOIN entrypoint is intentionally disabled.
• gh secret list --env "Preview – tcoin" shows only Twilio secrets in GitHub Environment metadata; no onramp sandbox secret metadata is present there.
• SMOKE_BASE_URL=https://tcoin-git-dev-cubid-team.vercel.app SMOKE_SKIP_BUILD=1 pnpm smoke:e2e failed because all stable routes redirected to Vercel /login instead of staying on the requested route.
• curl -sS -D - -o /tmp/tcoin-preview-wallet.html -L https://tcoin-git-dev-cubid-team.vercel.app/tcoin/wallet confirmed a 302 to https://vercel.com/sso-api?..., consistent with Vercel Deployment Protection.

Docs/session log:

• Added Preview Buy TCOIN sandbox prerequisites to docs/engineering/wallet-release-runbook.md.
• Added a session-log entry in agent-context/session-log/dev.md.

Required external actions before #85 can be fully green:

• Make the Preview smoke URL reachable without Vercel SSO, or provide an approved automation-bypass token to the smoke runner.
• Configure Vercel Preview with NEXT_PUBLIC_ENABLE_BUY_TCOIN_CHECKOUT=true only after sandbox onramp config is complete.
• Configure the matching Preview Supabase Edge Function/runtime sandbox ONRAMP_* provider and deposit-wallet settings.
• Redeploy Preview and rerun the Buy TCOIN sandbox browser/provider smoke.

Boundary check: live/Production Buy TCOIN remains gated; no linked Supabase writes were run.