{ "schema": "tezos-x-pack/recipes/v14", "generated": "2026-06-03T00:00:00Z", "purpose": "Machine-readable map from a build INTENT to the exact primitives, files, dependencies, env vars, and ordered steps an agent composes to deliver it. The agent CLI (agent/scaffold.mjs) reads this to emit working starters; an agent reasoning by hand reads it to plan. Each recipe is self-contained and cross-references pack files by path.", "conventions": { "layers": { "01-rpc": "submit ops + read head state; failover/caching", "02-wallet-connect": "user-held keys via octez.connect", "03-signing": "proofs, SIWT, verification, backend/HSM signing", "04-indexers": "queryable history/tokens/events via TzKT", "05-batches": "atomic multi-op", "08-smart-contracts": "FA2/FA2.1, registries, origination", "13-adapters": "chain-agnostic interface (Tezos L1 / Etherlink-EVM / extensible)", "12-ai-agentic": "agent-controlled wallets, policy guardrails, agent payments, MCP tools", "17-wallet-account-abstraction": "wallet routing, account abstraction, session keys, backend/KMS wallet modes", "18-digital-identity-compliance": "W3C VC/DID, KYC/KYB reusable credentials, revocation", "26-encrypted-group-chat": "client-side encrypted collaboration with Cloudflare relay", "27-defi-routing-risk": "swap route normalization, slippage, freshness, venue risk policy", "28-mcp-governed-connectors": "MCP tool schemas, tiers, authorization gateway", "29-observability-evidence": "audit events, evidence packs, examiner exports", "30-production-hardening": "release checklist, performance/security gates", "31-signed-publication-wallet-gate": "wallet-gated publication, signed comments, proof anchoring", "32-encrypted-collaboration-infra": "server-blind encrypted rooms and Cloudflare relay", "33-infra-pattern-library": "banking, identity, wallet, DeFi, Cloudflare, and evidence architecture patterns", "34-quality-gates": "release scorecards and validator", "35-sovereign-platform-kernel": "cross-layer control-plane planning kernel", "36-modern-dev-portal": "sleek static developer portal for the package", "37-reference-cards": "implementation reference cards", "38-implementation-blueprints": "product-specific build paths and ship gates", "39-runtime-policy-engine": "local policy enforcement and hash-chained policy receipts", "40-ui-system-kit": "self-contained modern UI system and static sovereign console", "41-release-integrity": "file-level SHA-256 integrity ledger and aggregate release root" }, "hard_rules_ref": "00-START-HERE/AGENT_INSTRUCTIONS.md#5 and 10-reference/SECURITY_BEST_PRACTICES.md", "amount_units": "Taquito Wallet/Contract API `amount` is in tez; raw RPC/op layer is mutez; FA tokens use metadata decimals." }, "recipes": [ { "id": "read-only-dashboard", "title": "Blockchain-enabled website (read-only display)", "use_cases": [ "portfolio page", "token/NFT gallery", "address explorer widget", "public stats" ], "difficulty": "beginner", "needs_keys": false, "layers": [ "04-indexers" ], "primary_files": [ "04-indexers/tzkt-client.js", "06-templates/html-vanilla/index.html" ], "deps": [], "optional_deps": [ "@microsoft/signalr" ], "env": [], "steps": [ "Instantiate TzktClient (no key) for the target network.", "Read account(), tokenBalances(), operations() for display.", "Optionally subscribe via WebSocket for live updates (subscribeOperations).", "Show 'Powered by TzKT API' attribution (free-tier license condition)." ], "pitfalls": [ "Do NOT poll RPC for history/tokens \u2014 use the indexer.", "Handle HTTP 429 (rate limit) with backoff/cache." ], "scaffold": "read-only-dashboard" }, { "id": "dapp-connect-send", "title": "dApp: connect wallet + send/transact (user holds keys)", "use_cases": [ "any user-facing dApp", "tipping", "checkout", "mint button" ], "difficulty": "beginner", "needs_keys": false, "layers": [ "02-wallet-connect", "01-rpc", "04-indexers" ], "primary_files": [ "02-wallet-connect/wallet-singleton.js", "06-templates/react-taquito/useTezos.js", "06-templates/react-taquito/WalletPanel.jsx" ], "deps": [ "@taquito/taquito", "@taquito/beacon-wallet", "@tezos-x/octez.connect-sdk" ], "optional_deps": [], "env": [ "VITE_TZ_RPC_URL?" ], "steps": [ "Create ONE TezosToolkit + ONE BeaconWallet (wallet-singleton pattern).", "requestPermissions() to connect; subscribe to ACTIVE_ACCOUNT_SET.", "Use Tezos.wallet.* for ops; await op.confirmation(1).", "Read balances/history from the indexer, not RPC." ], "pitfalls": [ "Never hold user keys.", "Wallet network must match toolkit RPC network.", "Single wallet instance only." ], "scaffold": "dapp-react" }, { "id": "siwt-auth", "title": "Passwordless login (Sign-In-With-Tezos)", "use_cases": [ "gasless login", "session auth", "wallet-as-identity" ], "difficulty": "intermediate", "needs_keys": false, "layers": [ "03-signing", "02-wallet-connect" ], "primary_files": [ "03-signing/SIWT.md", "06-templates/beacon-react/SignInPanel.jsx", "09-examples/example-identity-siwt.md" ], "deps": [ "@taquito/taquito", "@taquito/beacon-wallet", "@tezos-x/octez.connect-sdk", "@taquito/utils" ], "optional_deps": [], "env": [ "SESSION_SECRET" ], "steps": [ "Server issues nonce-bound, domain-bound, expiring payload (Micheline-packed).", "Client signs via requestSignPayload (SigningType.MICHELINE).", "Server verifies with verifySignature, checks pk->pkh==address, nonce fresh/single-use/unexpired.", "Issue short-TTL signed JWT/session." ], "pitfalls": [ "Always verify server-side.", "Enforce nonce single-use + expiry (replay protection).", "Bind payload to your exact domain." ], "scaffold": "siwt-auth" }, { "id": "token-gating", "title": "Token-gated access (hold token/NFT => access)", "use_cases": [ "gated content", "community access", "premium features", "allowlist" ], "difficulty": "intermediate", "needs_keys": false, "layers": [ "03-signing", "04-indexers" ], "primary_files": [ "14-patterns/token-gating.md", "03-signing/SIWT.md", "04-indexers/tzkt-client.js" ], "deps": [ "@taquito/utils" ], "optional_deps": [], "env": [ "GATE_CONTRACT", "GATE_MIN_BALANCE?" ], "steps": [ "Authenticate the address with SIWT (proves control, no gas).", "Server-side: read token balance for the verified address via TzKT.", "Grant access iff balance/criteria met; never trust client-claimed balance." ], "pitfalls": [ "Check balance at verification time, server-side.", "Beware time-of-check/time-of-use \u2014 re-check on sensitive actions." ], "scaffold": "token-gating" }, { "id": "nft-mint-display", "title": "NFT mint + collection display (FA2)", "use_cases": [ "NFT drop", "membership pass", "ticketing", "collectibles" ], "difficulty": "intermediate", "needs_keys": false, "layers": [ "02-wallet-connect", "05-batches", "08-smart-contracts", "04-indexers" ], "primary_files": [ "14-patterns/nft-mint-display.md", "08-smart-contracts/README.md", "14-patterns/ipfs-metadata.md" ], "deps": [ "@taquito/taquito", "@taquito/beacon-wallet", "@tezos-x/octez.connect-sdk", "@taquito/tzip12", "@taquito/tzip16" ], "optional_deps": [], "env": [ "NFT_CONTRACT", "PINATA_JWT?" ], "steps": [ "Upload media + metadata JSON to IPFS (TZIP-21 shape).", "Mint via FA2 contract call (or batch mint+list).", "Display the collection reading tokens + metadata from TzKT (tzip12)." ], "pitfalls": [ "Pin IPFS content (unpinned CIDs vanish).", "Validate metadata against TZIP-21 before mint.", "Storage burn on mint \u2014 budget tez." ], "scaffold": "nft-mint-display" }, { "id": "defi-swap", "title": "DeFi: atomic approve-then-swap", "use_cases": [ "DEX integration", "token swap UI", "liquidity actions" ], "difficulty": "intermediate", "needs_keys": false, "layers": [ "02-wallet-connect", "05-batches", "08-smart-contracts", "04-indexers" ], "primary_files": [ "09-examples/example-defi-swap.md", "05-batches/batch-builder.js" ], "deps": [ "@taquito/taquito", "@taquito/beacon-wallet", "@tezos-x/octez.connect-sdk" ], "optional_deps": [], "env": [ "FA2_CONTRACT", "DEX_CONTRACT" ], "steps": [ "Read pool reserves from DEX storage for price preview (no key).", "Build atomic batch: update_operators (approve) + swap [+ revoke].", "Pass min_out (slippage); atomicity reverts approval if swap fails." ], "pitfalls": [ "Always set slippage min_out.", "Approve-and-revoke in one batch for hygiene.", "Estimate the whole batch." ], "scaffold": "defi-swap" }, { "id": "backend-automation", "title": "Backend automation (bots, payouts, monitoring)", "use_cases": [ "airdrops", "scheduled payouts", "event-triggered actions", "treasury ops" ], "difficulty": "intermediate", "needs_keys": true, "layers": [ "01-rpc", "03-signing", "05-batches", "04-indexers" ], "primary_files": [ "06-templates/node-backend/backend.js", "05-batches/batch-builder.js", "01-rpc/rpc-failover.js" ], "deps": [ "@taquito/taquito", "@taquito/signer" ], "optional_deps": [ "@taquito/remote-signer", "@microsoft/signalr" ], "env": [ "TZ_SECRET_KEY|REMOTE_SIGNER_URL", "TZ_RPC_URL?", "TZ_NETWORK?" ], "steps": [ "Signer from env/vault (InMemorySigner dev; remote signer/HSM prod).", "Read triggers via indexer (REST or WebSocket).", "Estimate, then write via Tezos.contract.*; batch payouts with chunking.", "Wrap RPC in failover/retry." ], "pitfalls": [ "Keys from env/vault only, never source.", "One batch at a time per key (counter safety).", "Prod = remote signer/HSM, not InMemorySigner." ], "scaffold": "backend-automation" }, { "id": "verifiable-credentials", "title": "Digital identity: verifiable credentials + registry", "use_cases": [ "KYC tiers", "membership proofs", "attestations", "corporate identity" ], "difficulty": "advanced", "needs_keys": true, "layers": [ "03-signing", "08-smart-contracts", "04-indexers" ], "primary_files": [ "09-examples/example-identity-siwt.md", "14-patterns/did-vc.md", "03-signing/README.md" ], "deps": [ "@taquito/taquito", "@taquito/signer", "@taquito/utils" ], "optional_deps": [ "@spruceid/didkit-wasm" ], "env": [ "ISSUER_SK|ISSUER_REMOTE_SIGNER", "REGISTRY_CONTRACT?" ], "steps": [ "Issuer signs a claim (the signature IS the credential).", "Verifier checks issuer signature + expiry offline.", "Optional on-chain registry for issuer allow-list + revocation (read via indexer).", "Keep PII off-chain; only trust/revocation state on-chain." ], "pitfalls": [ "No PII on-chain (permanent + public).", "Use selective disclosure for privacy.", "Issuer key in HSM/remote signer." ], "scaffold": "verifiable-credentials" }, { "id": "tezos-x-cross-interface", "title": "Tezos X: atomic EVM <> Michelson app", "use_cases": [ "pay-in-USDC for tez-priced asset", "EVM liquidity + Tezos-native assets", "cross-runtime composition" ], "difficulty": "advanced", "needs_keys": false, "layers": [ "02-wallet-connect", "13-adapters" ], "primary_files": [ "10-reference/TEZOS_X_DUAL_INTERFACE.md", "06-templates/tezos-x-evm/tezosx-evm.js", "13-adapters/README.md" ], "deps": [ "viem" ], "optional_deps": [ "@taquito/taquito", "@taquito/beacon-wallet", "wagmi" ], "env": [ "TEZOSX_EVM_RPC", "TEZOSX_EVM_CHAIN_ID" ], "steps": [ "EVM side: viem client from live chain params (or Etherlink mainnet 42793).", "Michelson side: the rest of the pack unchanged.", "Compose atomically across interfaces (verify gateway ABI for the running kernel)." ], "pitfalls": [ "Don't hardcode previewnet chain ID (rotates).", "EVM-equivalent != identical (method/gas/hashing differences).", "Never use tx.origin as a guard on a unified ledger." ], "scaffold": "tezos-x-evm" }, { "id": "chain-agnostic-app", "title": "Chain-agnostic app shell (Tezos + EVM via one interface)", "use_cases": [ "multi-chain wallet UX", "portable dApp", "future-proof integration" ], "difficulty": "advanced", "needs_keys": false, "layers": [ "13-adapters", "02-wallet-connect" ], "primary_files": [ "13-adapters/README.md", "13-adapters/chain-adapter.js", "13-adapters/tezos-adapter.js", "13-adapters/evm-adapter.js" ], "deps": [], "optional_deps": [ "@taquito/taquito", "@taquito/beacon-wallet", "@tezos-x/octez.connect-sdk", "viem" ], "env": [], "steps": [ "Program against the ChainAdapter interface (connect/getAddress/getBalance/signMessage/sendValue/readContract).", "Inject the Tezos or EVM adapter at runtime.", "Add new chains by implementing the same interface." ], "pitfalls": [ "Keep chain-specific quirks inside adapters.", "Normalize units at the boundary." ], "scaffold": "chain-agnostic" }, { "id": "ai-agent-wallet", "title": "AI x Blockchain: agent-controlled wallet with guardrails", "use_cases": [ "autonomous payments", "agentic treasury", "AI-executed on-chain actions", "x402 agent payments" ], "difficulty": "advanced", "needs_keys": true, "layers": [ "12-ai-agentic", "03-signing", "05-batches" ], "primary_files": [ "12-ai-agentic/README.md", "12-ai-agentic/agent-wallet.js", "12-ai-agentic/policy-guard.js", "12-ai-agentic/SAFETY.md" ], "deps": [ "@taquito/taquito", "@taquito/signer" ], "optional_deps": [], "env": [ "AGENT_SK|AGENT_REMOTE_SIGNER", "AGENT_POLICY_PATH?" ], "steps": [ "Define a spend policy (per-tx cap, daily cap, allowlist, rate limit, kill switch).", "Route every agent action through PolicyGuard BEFORE signing.", "Use a dedicated low-balance hot key (sweep profits to cold).", "Log every signed action for provenance/audit." ], "pitfalls": [ "NEVER give an agent an unbounded key.", "Policy enforced before signing, not after.", "Separate hot (agent) from cold (treasury) keys.", "Human-approval gate for over-threshold actions." ], "scaffold": "ai-agent-wallet" }, { "id": "wallet-gated-access", "title": "Wallet-gated access (header connect button + allowlist)", "use_cases": [ "members-only area", "allowlisted gated page", "token-holder lounge", "private virtual environment" ], "difficulty": "intermediate", "needs_keys": false, "layers": [ "02-wallet-connect", "03-signing" ], "primary_files": [ "14-patterns/wallet-gating.md", "06-templates/wallet-gate/wallet-gate.js", "06-templates/wallet-gate/wallet-gate.css", "06-templates/wallet-gate/allowlist.json", "06-templates/wallet-gate/index.html", "06-templates/wallet-gate/gated.html", "06-templates/wallet-gate/verify-gate.mjs", "06-templates/wallet-gate/README.md" ], "deps": [ "@taquito/taquito", "@taquito/beacon-wallet", "@tezos-x/octez.connect-sdk" ], "optional_deps": [ "@taquito/utils" ], "env": [ "GATE_DOMAIN?", "GATE_SECRET?" ], "steps": [ "Mount the header connect button (createWalletGate) into your site header.", "List approved tz1/tz2/tz3/tz4 addresses in allowlist.json (validated, malformed skipped).", "On connect, check the address; approved \u2192 enter gated.html, denied \u2192 'wallet not approved' modal.", "Re-check the wallet on the gated page's load.", "For private content, enable Tier-2: sign a challenge, verify server-side against the allowlist, release a short-TTL token (verify-gate.mjs)." ], "pitfalls": [ "A client-side gate hides content, it does NOT protect it \u2014 use Tier-2 (server + signature) for secrets.", "Re-check on the gated page, not just the landing page.", "Verify signatures server-side for Tier-2; the client is never the boundary.", "Validate tz addresses; skip malformed allowlist entries.", "The allowlist is a membership list \u2014 keep it server-side if membership is sensitive." ], "scaffold": "wallet-gate" }, { "id": "wallet-signed-comments", "title": "Wallet-signed comment section (sign to post)", "use_cases": [ "signed guestbook", "attributable comments", "proof-of-authorship reactions", "sybil-resistant feedback" ], "difficulty": "intermediate", "needs_keys": false, "layers": [ "02-wallet-connect", "03-signing", "04-indexers" ], "primary_files": [ "14-patterns/wallet-comments.md", "06-templates/comment-section/index.html", "06-templates/comment-section/CommentSection.jsx", "06-templates/comment-section/verify-server.mjs", "06-templates/comment-section/README.md" ], "deps": [ "@taquito/taquito", "@taquito/beacon-wallet", "@tezos-x/octez.connect-sdk", "@taquito/utils" ], "optional_deps": [], "env": [ "COMMENT_DOMAIN", "NONCE_STORE_URL?" ], "steps": [ "Connect wallet; collect name + comment in a modal.", "Server issues a single-use, domain-bound nonce.", "Client signs a canonical payload (name+comment+address+domain+nonce+issued), Micheline-packed.", "Server verifies signature + pkh(pk)==address + nonce freshness + domain, then persists with a server UTC timestamp.", "Render name, comment, shortened address (\u2192 TzKT), and timestamp WITH time zone; escape HTML." ], "pitfalls": [ "Verify server-side \u2014 the client is never the security boundary.", "Bind name+comment into the signed payload or the text isn't protected.", "Single-use nonce + domain binding (anti-replay).", "Server-authoritative timestamp; never trust the client clock.", "Escape rendered text \u2014 authorship is not content safety." ], "scaffold": "wallet-comments" }, { "id": "bitcoin-on-tezos", "title": "Bitcoin on Tezos (tzBTC / HTLC / Etherlink wrapped BTC)", "use_cases": [ "BTC-pegged token in Tezos DeFi", "trustless BTC<>XTZ swap", "BTC DeFi with EVM tooling", "BTC price exposure without custody" ], "difficulty": "advanced", "needs_keys": false, "layers": [ "15-bitcoin-interop", "16-defi", "04-indexers" ], "primary_files": [ "15-bitcoin-interop/README.md", "15-bitcoin-interop/tzbtc-client.js", "15-bitcoin-interop/atomic-swap-htlc.md", "15-bitcoin-interop/etherlink-btc.js", "15-bitcoin-interop/BITCOIN_ASSETS.md" ], "deps": [ "@taquito/taquito" ], "optional_deps": [ "viem" ], "env": [], "steps": [ "Pick the trust model: custodial wrap (tzBTC), trustless HTLC (Atomex), or Etherlink wrapped BTC.", "tzBTC is an FA1.2 token \u2014 read/transfer with Taquito (no programmatic mint).", "For EVM BTC DeFi, use viem against verified Etherlink token addresses.", "State the trust model honestly in product copy." ], "pitfalls": [ "'Tezos as a Bitcoin L2 over Lightning' does NOT exist \u2014 don't build it.", "tzBTC/wrapped = custodial; uBTC = synthetic; HTLC = trustless. Say which.", "Verify every token address on an explorer before prod (LBTC on Etherlink is unconfirmed).", "tzBTC mint/burn is KYC-gated off-chain, not a dApp call." ], "scaffold": "backend-automation" }, { "id": "defi-aggregator-swap", "title": "DeFi on Tezos (3Route aggregator, Youves, liquidity baking, staking)", "use_cases": [ "best-price token swap", "synthetic assets (uBTC/uUSD)", "XTZ/tzBTC liquidity", "staking/delegation" ], "difficulty": "advanced", "needs_keys": false, "layers": [ "16-defi", "05-batches", "02-wallet-connect", "04-indexers" ], "primary_files": [ "16-defi/README.md", "16-defi/3route-swap.md", "16-defi/synthetics.md", "16-defi/liquidity-baking.md", "16-defi/staking.md" ], "deps": [ "@taquito/taquito", "@taquito/beacon-wallet", "@tezos-x/octez.connect-sdk" ], "optional_deps": [], "env": [], "steps": [ "Quote via the 3Route aggregator API (best route across 400+ pools).", "Compute minOut with explicit slippage; set a deadline.", "Approve + swap in ONE atomic batch (05-batches).", "Confirm and read the resulting balance from the indexer." ], "pitfalls": [ "Always set minOut/slippage \u2014 never 0, never omitted.", "Approve+swap atomic (no dangling allowance).", "Price from live reserves/quotes, never hardcode a rate.", "Pull router/vault addresses from live docs at integration time." ], "scaffold": "defi-swap" }, { "id": "cloudflare-wallet-gate", "title": "Cloudflare Worker: server-enforced multi-curve Tezos wallet gate + private R2 files, AI concierge, gallery & lounge", "when_to_use": "Use when gated files, private diligence rooms, or restricted dashboards must be protected server-side instead of by a client-side allowlist.", "primary_files": [ "06-templates/cloudflare-wallet-gate/README.md", "06-templates/cloudflare-wallet-gate/src/worker.js", "06-templates/cloudflare-wallet-gate/src/tezos.js", "06-templates/cloudflare-wallet-gate/src/capabilities.js", "06-templates/cloudflare-wallet-gate/src/jwt.js", "06-templates/cloudflare-wallet-gate/public/index.html", "06-templates/cloudflare-wallet-gate/wrangler.toml" ], "deps": [ "@stablelib/blake2b", "@stablelib/ed25519", "@noble/curves" ], "optional_deps": [ "wrangler" ], "env": [ "SESSION_SECRET", "ALLOWLIST", "ALLOWED_ORIGIN?", "SESSION_TTL_SECONDS?", "NONCE_TTL_SECONDS?" ], "steps": [ "Create a private R2 bucket for gated files.", "Create a KV namespace for one-time nonces.", "Set SESSION_SECRET and ALLOWLIST as Worker secrets.", "Deploy the Worker and keep protected bytes behind /api/file.", "Extend src/tezos.js if tz2/tz3 signatures are required." ], "scaffold": "cloudflare-worker", "difficulty": "advanced", "needs_keys": true, "use_cases": [ "server-enforced wallet-gated file room", "private diligence materials", "restricted investor portal", "private investor data room (files)", "wallet-gated AI concierge / agent chat", "approved-only photo/media gallery", "VIP lounge (wallet-attributed posts)" ], "layers": [ "19-cloudflare-gate", "03-signing" ], "pitfalls": [ "Client-side allowlists are UX only; protected bytes must stay behind the Worker.", "Current verifier scope is tz1/ed25519; extend verification before relying on tz2/tz3 wallets.", "SESSION_SECRET and ALLOWLIST must be Worker secrets, never committed to source.", "Set ALLOWED_ORIGIN narrowly for cross-origin deployments." ], "flow": [ "octez.connect wallet proof", "Cloudflare Worker", "KV nonce store", "R2 private object delivery" ] }, { "id": "etherlink-smart-wallet-core", "title": "Etherlink smart-wallet and account-abstraction core", "use_cases": [ "tokenized-deposit wallet", "stablecoin wallet", "smart account UX", "session-key workflow" ], "difficulty": "advanced", "needs_keys": false, "layers": [ "17-wallet-account-abstraction", "13-adapters", "06-templates/tezos-x-evm", "29-observability-evidence" ], "primary_files": [ "17-wallet-account-abstraction/README.md", "17-wallet-account-abstraction/wallet-router.js", "17-wallet-account-abstraction/wallet-action-intent.schema.json", "17-wallet-account-abstraction/session-key-policy.schema.json", "06-templates/tezos-x-evm/tezosx-evm.js" ], "deps": [ "viem", "thirdweb" ], "optional_deps": [], "env": [ "ETHERLINK_RPC_URL?", "WALLETCONNECT_PROJECT_ID?" ], "steps": [ "Classify the user or agent wallet action with wallet-action-intent.schema.json.", "Choose Tezos L1 or Etherlink EVM using wallet-router.js and the wallet-mode matrix.", "Run policy preflight and require human approval for high-risk actions.", "Use viem/AA tooling for Etherlink execution; write an evidence event after confirmation." ], "pitfalls": [ "Do not assume Alchemy/Bridge support for Etherlink; verify live support.", "Do not use session keys without target/method/amount/expiry constraints.", "Do not let the model decide money movement authority." ], "scaffold": "etherlink-aa" }, { "id": "reusable-kyc-vc-gate", "title": "Reusable KYC/KYB VC gate", "use_cases": [ "regulated onboarding", "tokenized deposit eligibility", "investor gating", "KYB reuse" ], "difficulty": "advanced", "needs_keys": false, "layers": [ "18-digital-identity-compliance", "03-signing", "04-indexers", "29-observability-evidence" ], "primary_files": [ "18-digital-identity-compliance/README.md", "18-digital-identity-compliance/kyc-vc.schema.json", "18-digital-identity-compliance/presentation-request.schema.json", "18-digital-identity-compliance/vc-verifier-worker.js", "18-digital-identity-compliance/bitstring-revocation-runbook.md" ], "deps": [ "@spruceid/didkit-wasm-node" ], "optional_deps": [], "env": [ "VC_TRUSTED_ISSUERS", "SESSION_SECRET" ], "steps": [ "Issue or accept a W3C VC / SD-JWT VC after regulated onboarding.", "Request only the required claims for the target action.", "Verify issuer, signature, expiration, and status/revocation server-side.", "Convert verified claims into policy allow/deny/step-up and write an evidence event." ], "pitfalls": [ "Never put full KYC/KYB documents on-chain.", "Re-check revocation before consequential actions.", "Do not trust client-provided credential summaries." ], "scaffold": "vc-gate" }, { "id": "encrypted-token-gated-chat", "title": "Encrypted token-gated group chat", "use_cases": [ "DAO room", "investor lounge", "bank operator channel", "agent supervision thread" ], "difficulty": "advanced", "needs_keys": false, "layers": [ "26-encrypted-group-chat", "03-signing", "14-patterns/token-gating", "23-cloudflare-ai-backend" ], "primary_files": [ "26-encrypted-group-chat/README.md", "26-encrypted-group-chat/crypto-envelope.js", "26-encrypted-group-chat/chat-relay-worker.js", "26-encrypted-group-chat/group-message.schema.json", "26-encrypted-group-chat/threat-model.md" ], "deps": [ "wrangler" ], "optional_deps": [], "env": [ "ROOM_RELAY", "SESSION_SECRET", "GATE_CONTRACT?" ], "steps": [ "Authenticate users with SIWT/SIWE/DID and verify membership server-side.", "Exchange/derive room keys client-side and keep plaintext off the server.", "Relay only encrypted envelopes through Durable Objects.", "Rotate room keys when membership changes and log evidence metadata." ], "pitfalls": [ "The reference AES-GCM envelope is not a full MLS implementation.", "Never send decrypted chat to an AI tool by default.", "Metadata remains sensitive even when content is encrypted." ], "scaffold": "encrypted-chat" }, { "id": "defi-risk-routed-swap", "title": "Risk-routed DeFi swap workflow", "use_cases": [ "DEX swap UI", "treasury rebalance", "agent-constrained swap", "approve-act-revoke flow" ], "difficulty": "intermediate", "needs_keys": false, "layers": [ "27-defi-routing-risk", "05-batches", "16-defi", "29-observability-evidence" ], "primary_files": [ "27-defi-routing-risk/README.md", "27-defi-routing-risk/swap-intent.schema.json", "27-defi-routing-risk/quote-normalizer.js", "27-defi-routing-risk/slippage-risk-policy.js", "05-batches/batch-builder.js" ], "deps": [ "@taquito/taquito", "viem" ], "optional_deps": [], "env": [ "DEX_ROUTER_URL?", "FA2_CONTRACT?" ], "steps": [ "Capture a swap intent with actor, chain, assets, amount, and max slippage.", "Fetch and normalize a quote.", "Evaluate slippage, freshness, router allowlist, and agent capability.", "Only then build approve-act-revoke or EVM transaction flow and emit evidence." ], "pitfalls": [ "Do not submit against stale quotes.", "Do not leave unlimited token approvals.", "Require human approval for out-of-policy slippage or unknown routers." ], "scaffold": "defi-risk-swap" }, { "id": "governed-mcp-tool-gateway", "title": "Governed MCP tool gateway for blockchain banking agents", "use_cases": [ "Claude/MCP agent", "bank compliance automation", "wallet tool routing", "evidence-backed tool calls" ], "difficulty": "advanced", "needs_keys": true, "layers": [ "28-mcp-governed-connectors", "21-agent-authority", "29-observability-evidence", "23-cloudflare-ai-backend" ], "primary_files": [ "28-mcp-governed-connectors/README.md", "28-mcp-governed-connectors/mcp-server-manifest.json", "28-mcp-governed-connectors/tool-gateway.js", "28-mcp-governed-connectors/MCP_SECURITY_RUNBOOK.md", "29-observability-evidence/evidence-pack-builder.js" ], "deps": [ "@modelcontextprotocol/sdk" ], "optional_deps": [], "env": [ "MCP_AUTH_ISSUER", "SESSION_SECRET", "POLICY_ENGINE_URL?" ], "steps": [ "Define tools by tier and strict JSON schema.", "Authenticate every private tool call.", "Require approval or capability for T3/T4 tools.", "Execute through the tool gateway and record an audit/evidence event." ], "pitfalls": [ "Do not expose write tools directly to the model.", "Do not pass credentials in prompts or tool arguments.", "Deny unknown tools by default." ], "scaffold": "governed-mcp" }, { "id": "evidence-pack-export", "title": "Evidence-pack export for auditors/examiners", "use_cases": [ "audit export", "examiner packet", "compliance review", "agent action trace" ], "difficulty": "intermediate", "needs_keys": false, "layers": [ "29-observability-evidence", "30-production-hardening" ], "primary_files": [ "29-observability-evidence/README.md", "29-observability-evidence/evidence-pack-builder.js", "29-observability-evidence/evidence-event.schema.json", "29-observability-evidence/evidence-pack.schema.json", "30-production-hardening/RELEASE_CHECKLIST.md" ], "deps": [], "optional_deps": [], "env": [], "steps": [ "Collect events for a defined scope and time range.", "Redact sensitive content and include hashes/refs instead of raw secrets.", "Build a deterministic evidence pack and verify integrity hash.", "Export to the target repository or examiner package." ], "pitfalls": [ "Do not export raw private keys, seed phrases, or full KYC files.", "Hash sensitive artifacts and store access-controlled references." ], "scaffold": "evidence-export" }, { "id": "sovereign-platform-console", "title": "Full-stack sovereign platform console", "use_cases": [ "blockchain banking dev portal", "architectural control plane", "agentic product map" ], "difficulty": "advanced", "needs_keys": false, "layers": [ "35-sovereign-platform-kernel", "36-modern-dev-portal", "37-reference-cards" ], "primary_files": [ "35-sovereign-platform-kernel/platform-kernel.js", "35-sovereign-platform-kernel/stack-registry.json", "36-modern-dev-portal/index.html", "37-reference-cards/README.md" ], "deps": [], "optional_deps": [], "env": [], "steps": [ "Select goals: blockchain, wallet, defi, identity, banking, cloudflare, agents, chat, publication.", "Run the platform kernel to produce stack, controls, evidence, and review gates.", "Use the modern dev portal as the human-facing map for developers and stakeholders.", "Hand off the chosen recipe to the package scaffold engine." ], "pitfalls": [ "Do not turn the platform map into runtime authorization; use the policy/gate modules for execution.", "Keep vendor claims separated from control-plane facts." ], "scaffold": "sovereign-platform-console" }, { "id": "signed-publication-wallet-gate", "title": "Signed publication wallet gate with provenance anchoring", "use_cases": [ "multisignature essay site", "wallet-signed comments", "publication provenance" ], "difficulty": "intermediate", "needs_keys": false, "layers": [ "24-multisignature-publication", "31-signed-publication-wallet-gate", "29-observability-evidence" ], "primary_files": [ "31-signed-publication-wallet-gate/README.md", "31-signed-publication-wallet-gate/cloudflare/worker.js", "31-signed-publication-wallet-gate/tools/anchor.mjs" ], "deps": [], "optional_deps": [ "wrangler" ], "env": [ "PUBLICATION_SECRET", "COMMENTS_DB" ], "steps": [ "Deploy the Cloudflare worker and D1 schema.", "Gate comments or protected publication artifacts by wallet proof.", "Emit a publication proof hash for every meaningful release.", "Store comments and proofs without exposing signer secrets." ], "pitfalls": [ "Do not accept unsigned comments as provenance.", "Do not put allowlists or secrets in static assets." ], "scaffold": "signed-publication-wallet-gate" }, { "id": "server-blind-encrypted-room", "title": "Server-blind encrypted group room", "use_cases": [ "token-gated team room", "investor data room chat", "wallet/DID-gated encrypted collaboration" ], "difficulty": "advanced", "needs_keys": false, "layers": [ "26-encrypted-group-chat", "32-encrypted-collaboration-infra", "19-cloudflare-gate" ], "primary_files": [ "32-encrypted-collaboration-infra/README.md", "32-encrypted-collaboration-infra/client/secure-room.js", "32-encrypted-collaboration-infra/cloudflare/relay-worker.js" ], "deps": [], "optional_deps": [ "wrangler" ], "env": [ "ROOM_POLICY_SECRET", "R2_BUCKET" ], "steps": [ "Use wallet/DID proof for membership.", "Encrypt message bodies client-side.", "Relay ciphertext through Cloudflare without plaintext access.", "Rotate room keys and log policy events." ], "pitfalls": [ "Metadata can still leak; minimize room/user/event metadata.", "Do not log plaintext message bodies." ], "scaffold": "server-blind-encrypted-room" }, { "id": "implementation-blueprint-planner", "title": "Implementation blueprint planner", "use_cases": [ "product architecture", "agent build planning", "module selection", "release gate mapping" ], "difficulty": "beginner", "needs_keys": false, "layers": [ "38-implementation-blueprints", "33-infra-pattern-library", "37-reference-cards" ], "primary_files": [ "38-implementation-blueprints/product-blueprints.json", "38-implementation-blueprints/blueprint-selector.js", "38-implementation-blueprints/ARCHITECTURE_ATLAS.md" ], "deps": [], "optional_deps": [], "env": [], "steps": [ "Choose the closest product blueprint.", "Run blueprint-selector.js to generate an implementation plan.", "Review controls and ship gates before selecting templates.", "Map each gate to tests, evidence packs, and release checklist items." ], "pitfalls": [ "Do not skip ship gates because a prototype works locally.", "Do not merge bank, stablecoin, and on-chain promises into one customer disclosure." ], "scaffold": "node" }, { "id": "runtime-policy-receipts", "title": "Runtime policy engine with hash-chained receipts", "use_cases": [ "agent action guard", "wallet transaction approval", "bank-rail action gating", "MCP tool policy" ], "difficulty": "advanced", "needs_keys": false, "layers": [ "39-runtime-policy-engine", "21-agent-authority", "28-mcp-governed-connectors", "29-observability-evidence" ], "primary_files": [ "39-runtime-policy-engine/runtime-policy-engine.js", "39-runtime-policy-engine/policy.schema.json", "21-agent-authority/AUTHORITY_MODEL.md" ], "deps": [], "optional_deps": [], "env": [], "steps": [ "Define allowed action kinds, subjects, resources, and caps.", "Evaluate proposed actions before invoking signers, bank rails, or MCP tools.", "Commit only allowed decisions and persist the policy receipt.", "Verify receipt chains in CI and before examiner/auditor export." ], "pitfalls": [ "Never let an LLM bypass the policy engine.", "Treat approval_required as a blocking state, not a warning.", "Do not execute if receipt persistence fails." ], "scaffold": "node" }, { "id": "sovereign-ui-system-kit", "title": "Self-contained sovereign developer console UI", "use_cases": [ "static developer portal", "internal operator console", "wallet-gated data room shell", "demo landing page" ], "difficulty": "beginner", "needs_keys": false, "layers": [ "40-ui-system-kit", "36-modern-dev-portal", "31-signed-publication-wallet-gate" ], "primary_files": [ "40-ui-system-kit/sovereign-console.html", "40-ui-system-kit/design-tokens.css", "36-modern-dev-portal/index.html" ], "deps": [], "optional_deps": [], "env": [], "steps": [ "Copy the self-contained HTML for zero-dependency demos.", "Use design-tokens.css for application shells.", "Serve through Cloudflare/R2 or behind the wallet gate when content is private." ], "pitfalls": [ "Do not add third-party scripts to the secure static console.", "Keep demo UI separate from production secret handling." ], "scaffold": "node" }, { "id": "release-integrity-ledger", "title": "Release integrity ledger", "use_cases": [ "handoff verification", "audit evidence", "package diff review", "release notarization prep" ], "difficulty": "intermediate", "needs_keys": false, "layers": [ "41-release-integrity", "30-production-hardening", "34-quality-gates" ], "primary_files": [ "41-release-integrity/release-integrity.mjs", "41-release-integrity/release-integrity.json", "30-production-hardening/RELEASE_CHECKLIST.md" ], "deps": [], "optional_deps": [], "env": [], "steps": [ "Run release-integrity.mjs after final edits.", "Store the generated aggregate root in release notes.", "Compare file hashes during handoff verification." ], "pitfalls": [ "Regenerate after every file change.", "Do not treat the aggregate root as a signature unless it is separately signed or anchored." ], "scaffold": "node" }, { "id": "multisignature-walletconnect-preview", "title": "Static multisignature.io Tezos X + WalletConnect preview", "use_cases": [ "article-to-control-plane demo", "wallet integration preview", "static deploy preview", "evidence receipt UX" ], "difficulty": "intermediate", "needs_keys": false, "layers": [ "42-walletconnect-static-preview", "24-multisignature-publication", "31-signed-publication-wallet-gate", "41-release-integrity" ], "primary_files": [ "42-walletconnect-static-preview/index.html", "42-walletconnect-static-preview/js/tezosx-wallets.js", "42-walletconnect-static-preview/js/receipts.js", "42-walletconnect-static-preview/tools/validate-static.mjs" ], "deps": [], "optional_deps": [ "@tezos-x/octez.connect-sdk", "@walletconnect/ethereum-provider" ], "env": [ "WALLETCONNECT_PROJECT_ID optional for real WalletConnect testing" ], "steps": [ "Run npm run preview-walletconnect from the package root.", "Serve the static layer locally or on Cloudflare Pages.", "Set WalletConnect project ID for live WalletConnect testing.", "Route production signing through nonce-bound server verification and evidence receipts." ], "pitfalls": [ "Do not treat localStorage receipts as production audit evidence.", "Do not authorize transfers from static UI without server-side nonce verification.", "Re-check Tezos X Previewnet constants before live testing." ], "scaffold": "node" }, { "id": "sovereign-flow-simulator", "title": "Deterministic sovereign flow simulator", "use_cases": [ "integration planning", "policy/evidence demo", "developer onboarding", "agent action dry run" ], "difficulty": "intermediate", "needs_keys": false, "layers": [ "43-sovereign-flow-simulator", "39-runtime-policy-engine", "29-observability-evidence" ], "primary_files": [ "43-sovereign-flow-simulator/sovereign-flow-simulator.js", "43-sovereign-flow-simulator/scenario.allow.json", "43-sovereign-flow-simulator/scenario.deny.json" ], "deps": [], "optional_deps": [], "env": [], "steps": [ "Run npm run simulate-flow.", "Inspect the policy decision and evidence pack output.", "Modify the scenario JSON for the product action being designed.", "Move to live adapters only after the simulated decision path is understood." ], "pitfalls": [ "Do not mistake a simulator receipt for a production on-chain or bank-rail receipt.", "Do not bypass the policy runtime when replacing the simulator with live adapters." ], "scaffold": "node" }, { "id": "deployment-readiness-runbooks", "title": "Deployment readiness runbooks", "use_cases": [ "Cloudflare deployment", "release gating", "staging promotion", "agent authority rollout" ], "difficulty": "intermediate", "needs_keys": false, "layers": [ "44-deployment-runbooks", "30-production-hardening", "41-release-integrity" ], "primary_files": [ "44-deployment-runbooks/README.md", "44-deployment-runbooks/readiness-checker.js", "44-deployment-runbooks/cloudflare-worker-r2-d1.md" ], "deps": [], "optional_deps": [], "env": [], "steps": [ "Run npm run readiness.", "Complete all required gates before controlled staging.", "Attach readiness output to release notes.", "Regenerate release integrity after final edits." ], "pitfalls": [ "Do not promote if secrets are still in source.", "Do not treat optional gates as optional once handling customer funds or regulated data." ], "scaffold": "node" }, { "id": "contract-schema-kit", "title": "Portable contract schema kit", "use_cases": [ "MCP schema design", "wallet action validation", "capability delegation", "banking rail envelopes" ], "difficulty": "intermediate", "needs_keys": false, "layers": [ "45-contract-schemas", "39-runtime-policy-engine", "28-mcp-governed-connectors" ], "primary_files": [ "45-contract-schemas/schema-catalog.json", "45-contract-schemas/wallet-action.schema.json", "45-contract-schemas/mcp-tool-call.schema.json", "45-contract-schemas/capability-token.schema.json" ], "deps": [], "optional_deps": [], "env": [], "steps": [ "Select the schema for the surface being built.", "Bind schema validation before policy evaluation.", "Emit an evidence event for accepted and rejected intents." ], "pitfalls": [ "Do not use schema validation as a substitute for authorization.", "Do not accept additional properties on regulated action envelopes." ], "scaffold": "node" }, { "id": "threat-model-compiler", "title": "Compile a release threat model", "description": "Generate a hash-stable threat model for wallet, agent, banking, Cloudflare, and encrypted-collaboration surfaces.", "primary_files": [ "48-threat-model-compiler/README.md", "48-threat-model-compiler/threat-catalog.json", "48-threat-model-compiler/threat-model-compiler.js" ], "steps": [ "Select in-scope surfaces.", "Run the compiler.", "Attach the model hash to the release record." ], "use_cases": [ "Generate a hash-stable threat model for wallet, agent, banking, Cloudflare, and encrypted-collaboration surfaces." ], "difficulty": "advanced", "needs_keys": false, "layers": [ "48-threat-model-compiler/README.md" ], "deps": [], "optional_deps": [], "env": [], "pitfalls": [ "Do not promote to production without running tests, quality gates, doctor, and integrity checks." ], "scaffold": "node" }, { "id": "compliance-evidence-control-plane", "title": "Build a compliance evidence plan", "description": "Map controls to evidence events and release gates for regulated blockchain/agentic workflows.", "primary_files": [ "49-compliance-evidence-control-plane/README.md", "49-compliance-evidence-control-plane/control-map.json", "49-compliance-evidence-control-plane/evidence-control-plane.js" ], "steps": [ "Select domains.", "Generate evidence plan.", "Attach release gates to staging checklist." ], "use_cases": [ "Map controls to evidence events and release gates for regulated blockchain/agentic workflows." ], "difficulty": "advanced", "needs_keys": false, "layers": [ "49-compliance-evidence-control-plane/README.md" ], "deps": [], "optional_deps": [], "env": [], "pitfalls": [ "Do not promote to production without running tests, quality gates, doctor, and integrity checks." ], "scaffold": "node" }, { "id": "wallet-session-policy-kit", "title": "Create wallet session policies", "description": "Create bounded, revocable wallet-session policies for humans, operators, and agent mandates.", "primary_files": [ "50-wallet-session-policy-kit/README.md", "50-wallet-session-policy-kit/session-policy-presets.json", "50-wallet-session-policy-kit/session-policy-kit.js" ], "steps": [ "Select preset.", "Bind subject and chain.", "Evaluate sample actions before signing." ], "use_cases": [ "Create bounded, revocable wallet-session policies for humans, operators, and agent mandates." ], "difficulty": "advanced", "needs_keys": false, "layers": [ "50-wallet-session-policy-kit/README.md" ], "deps": [], "optional_deps": [], "env": [], "pitfalls": [ "Do not promote to production without running tests, quality gates, doctor, and integrity checks." ], "scaffold": "node" }, { "id": "performance-budget-harness", "title": "Run static/edge performance budgets", "description": "Verify deployable static consoles and Worker assets remain lightweight and free of remote analytics/font dependencies.", "primary_files": [ "51-performance-budget-harness/README.md", "51-performance-budget-harness/performance-budgets.json", "51-performance-budget-harness/performance-budget-checker.js" ], "steps": [ "Run performance checker.", "Review any budget failures.", "Keep UI/edge artifacts audit-friendly." ], "use_cases": [ "Verify deployable static consoles and Worker assets remain lightweight and free of remote analytics/font dependencies." ], "difficulty": "advanced", "needs_keys": false, "layers": [ "51-performance-budget-harness/README.md" ], "deps": [], "optional_deps": [], "env": [], "pitfalls": [ "Do not promote to production without running tests, quality gates, doctor, and integrity checks." ], "scaffold": "node" }, { "id": "prestige-launch-console", "title": "Ship the prestige launch console", "description": "Use the self-contained launch console as a polished entry point for staging handoff.", "primary_files": [ "52-prestige-launch-console/README.md", "52-prestige-launch-console/index.html" ], "steps": [ "Open index.html locally.", "Host behind Cloudflare wallet gate.", "Link to threat model, evidence plan, and release integrity artifacts." ], "use_cases": [ "Use the self-contained launch console as a polished entry point for staging handoff." ], "difficulty": "advanced", "needs_keys": false, "layers": [ "52-prestige-launch-console/README.md" ], "deps": [], "optional_deps": [], "env": [], "pitfalls": [ "Do not promote to production without running tests, quality gates, doctor, and integrity checks." ], "scaffold": "node" } ] }