Must fix before mainnet - 09-user-security-documentation by konard · Pull Request #324 · xlabtg/TONAIAgent

konard · 2026-04-10T09:02:58Z

Summary

Closes #314

This PR implements all acceptance criteria from Issue #314 — user-facing security documentation and safe defaults before mainnet launch.

Documentation (3 new files)

docs/user-security-guide.md — Comprehensive step-by-step guide covering:
- Simulation vs. Live Trading comparison table
- 6-step pre-launch checklist (2FA, wallet verification, risk limits, etc.)
- Risk disclosures summary
- How platform data is collected and protected
- Safe configuration recommendations
- Ongoing monitoring guidance
- Emergency procedures (how to stop an agent, account compromise response)
docs/mainnet-readiness-checklist.md — 7-section checklist users must complete before enabling live trading:
- Account security (Telegram 2FA, session review)
- Wallet readiness (dedicated wallet, backup, test transaction)
- Platform understanding (simulation mode, risk disclosures)
- Simulation review (minimum 7-day run, trade history review)
- Risk configuration (conservative initial settings)
- Monitoring setup (notifications, daily check-in plan)
- Final acknowledgment (explicit confirmation of all risks)
docs/risk-disclosures.md — Legal risk disclosures covering:
- No guarantee of profit
- Risk of total loss
- Cryptocurrency market risks (volatility, liquidity, manipulation)
- Smart contract risk
- Platform and technology risks
- Authentication and account security risk
- Regulatory risk (unregulated, no investor protection)
- Limitation of liability

UI Changes (Telegram Mini App)

Simulation mode banner (index.html, styles.css):

Prominent ⚠️ SIMULATION MODE — No real funds at risk banner at the top of the portfolio dashboard
Banner updates to LIVE TRADING — Real funds in use when live mode is active
One-tap "Switch to Live" / "Back to Simulation" button

Live trading confirmation modal (index.html, components/security.js, styles.css):

Triggered when user taps "Switch to Live"
Displays irreversibility warning
Requires user to tick all 3 acknowledgment checkboxes before the confirm button becomes active:
- I understand I may lose money, including my entire investment
- I have verified my wallet address is correct
- I have set appropriate risk limits and reviewed the security guide
"Enable Live Trading" button is disabled until all boxes are checked

Risk warnings in onboarding (components/onboarding.js, styles.css):

Added risk warning box to the agent creation confirm step listing 3 key risks
Relabeled CTA button from "Start Agent" to "Start Agent in Simulation" to make the default mode clear
Added note explaining simulation mode and link to security guide

New security component (components/security.js):

Manages simulation/live trading state in localStorage
Wires up all banner and modal interactions
Dispatches tonai:live_trading_enabled and tonai:simulation_mode_enabled events for other components to react to mode changes

Test plan

Open the Mini App — simulation mode banner is visible at the top of the portfolio page
Tap "Switch to Live" — live trading modal opens with 3 unchecked boxes and a disabled confirm button
Check all 3 boxes — confirm button becomes enabled
Click "Enable Live Trading" — banner updates to show LIVE TRADING mode
Tap "Back to Simulation" — confirmation dialog appears, accepting returns to simulation banner
Complete onboarding as a new user — risk warning box is shown on the confirm step
Verify the CTA reads "Start Agent in Simulation"
Read docs/user-security-guide.md, docs/mainnet-readiness-checklist.md, docs/risk-disclosures.md

🤖 Generated with Claude Code

Adding .gitkeep for PR creation (default mode). This file will be removed when the task is complete. Issue: xlabtg#314

- Create docs/user-security-guide.md with step-by-step pre-launch guide, simulation vs live comparison, data protection info, and emergency procedures - Create docs/mainnet-readiness-checklist.md with full 7-section pre-launch checklist covering account security, wallet readiness, risk config, and final acknowledgment - Create docs/risk-disclosures.md covering all key trading, market, smart contract, platform, and regulatory risks - Add prominent simulation mode banner to portfolio dashboard with one-tap "Switch to Live" button - Add live trading confirmation modal requiring users to check 3 mandatory acknowledgments before enabling live trading; confirm button is disabled until all boxes are ticked - Add risk warning box to the onboarding agent creation confirm step, relabeling the CTA to "Start Agent in Simulation" for clarity - Add security.js component to manage simulation/live state and wire up all UI interactions Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

konard · 2026-04-10T09:08:58Z

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

Public pricing estimate: $1.399084
Calculated by Anthropic: $1.399084 USD
Difference: $0.000000 (0.00%)

📊 Context and tokens usage:

Context window: 79.2K / 1M (8%) input tokens, 18.7K / 64K (29%) output tokens

Total: (81.1K + 2.7M cached) input tokens, 18.7K output tokens, $1.399084 cost

🤖 Models used:

Tool: Anthropic Claude Code
Requested: sonnet
Model: Claude Sonnet 4.6 (claude-sonnet-4-6)

📎 Log file uploaded as Gist (1309KB)

View complete solution draft log

Now working session is ended, feel free to review and add any feedback on the solution draft.

konard · 2026-04-10T09:14:26Z

✅ Ready to merge

This pull request is now ready to be merged:

All CI checks have passed
No merge conflicts
No pending changes

Monitored by hive-mind with --auto-restart-until-mergeable flag

This reverts commit 64bd05f.

…#325) Independent verification of 9 critical security fixes (PRs xlabtg#316–xlabtg#324): - HSM key management: Ed25519 TON-incompatibility flagged as remaining blocker - MPC threshold signatures: real crypto implemented, centralization risk noted - Smart contracts: Tact contracts present, external audit still needed - KYC/AML: enforcement gates exist but disabled by default (must fix before mainnet) - Secrets management, API validation, AI safety: implemented, wiring pending - Monitoring, documentation: complete with integration caveats Overall verdict: conditionally not yet ready for mainnet (5 medium-high gaps remain). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…labtg#324 Research notes documenting the implementation approach, gaps, and findings for each of the 9 security fix PRs analyzed during the re-audit for Issue xlabtg#325. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

konard and others added 2 commits April 10, 2026 09:02

Initial commit with task details

64bd05f

Adding .gitkeep for PR creation (default mode). This file will be removed when the task is complete. Issue: xlabtg#314

konard changed the title ~~[WIP] Must fix before mainnet - 09-user-security-documentation~~ Must fix before mainnet - 09-user-security-documentation Apr 10, 2026

konard marked this pull request as ready for review April 10, 2026 09:08

Revert "Initial commit with task details"

57b3993

This reverts commit 64bd05f.

xlabtg merged commit c82aedf into xlabtg:main Apr 10, 2026
7 checks passed

xlabtg mentioned this pull request Apr 10, 2026

[RE-AUDIT] Verification of the implementation of 9 critical fixes and the final check of readiness for the Mainnet #325

Open

54 tasks

konard mentioned this pull request Apr 10, 2026

[RE-AUDIT] Verification of 9 critical fixes — TONAIAgent v2.35.1 #326

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Must fix before mainnet - 09-user-security-documentation#324

Must fix before mainnet - 09-user-security-documentation#324
xlabtg merged 3 commits intoxlabtg:mainfrom
konard:issue-314-52713d86df42

konard commented Apr 10, 2026 •

edited

Loading

Uh oh!

konard commented Apr 10, 2026

Uh oh!

konard commented Apr 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

konard commented Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Documentation (3 new files)

UI Changes (Telegram Mini App)

Test plan

Uh oh!

konard commented Apr 10, 2026

🤖 Solution Draft Log

💰 Cost estimation:

📊 Context and tokens usage:

🤖 Models used:

📎 Log file uploaded as Gist (1309KB)

Uh oh!

konard commented Apr 10, 2026

✅ Ready to merge

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

konard commented Apr 10, 2026 •

edited

Loading