Developer architecture

System map

Browser / Next.js UI
  ├─ Mera passkey → short-lived signing account → Monad
  ├─ wagmi + viem → contract reads and confirmations
  └─ signed app session → Next.js social API → Supabase

Monad events → Envio HyperSync (or RPC)
  → resumable Next.js indexer → atomic Supabase projections
  → dashboard / Circle snapshots and public activity

App verification queue → Mac Node worker → official CRE CLI simulation
  → authorized EOA attestation → existing Monad Core
Mera PRF vault → encrypted device-local journal / backups
Production CRE receiver → future live DON delivery; not deployed

Contracts and events

BondlineCore owns escrow, verification, evidence voting, settlement, and reward accounting. CircleFactory creates and registers Circle clones. Each Circle contains its own member list, invitation state, threshold, and Pot.

The ABI retains Bond terminology and the existing status enum. Product copy uses commitment. Do not reinterpret a CommitmentBacked event as a Cosigned evidence approval. Membership events from Circle clones are decoded only against known selectors so clone initialization does not block ingestion.

Envio indexing

The application consumes Envio HyperSync through an HTTP event ingestion path; it is not a deployed HyperIndex/Envio Cloud project. RPC transport is the fallback. The indexer scans an explicitly configured chain, deployment block, and finality margin, records finalized logs, and builds queryable projections.

Atomic ingestion and a per-chain advisory lock prevent cursor advancement without applied events. Replayed and overlapping batches are safe no-ops; unknown housekeeping logs are filtered before strict event decoding. Contract reads remain the authority for actions and rewards.

Verifier architecture and CRE status

cre/github-verifier/product-worker.mjs polls an authenticated service-only job queue, runs the compiled CRE workflow through the official CLI, validates bound progress against finalized Monad state, and submits permitted attestations from a separate authorized EOA. The verifier rule is immutable in the existing Core. Worker authentication secrets and signing material stay outside the browser. The older scripts/verifier.mjs remains separate.

The generic workflow supports GitHub activity and successful direct contract-call evidence. Developer mode retains local Anvil CLI simulation; product mode uses the deployed testnet Core with the operator’s signer. contracts/src/BondlineCREVerifier.sol retains strict forwarder/workflow authentication for future DON delivery and is not weakened for simulator reports. See cre/PRODUCT.md for the runtime, trust model and confirmed live receipt.

Mera and PRF

mera.ts creates or opens a PRF-enabled passkey, derives m/44'/60'/0'/0/0 through the pinned Mera/scure stack, opens a signing session, and closes it in finally. During connection the same session signs the server authentication challenge. Transaction signing prepares chain, gas, nonce, fees, and funding requirements before the ceremony.

No Mera app ID is required by the integration used here. RP_ID defaults to the current hostname; coordinate changes with existing credentials. The device-local private journal reuses the passkey with separate random PRF salts and Mera’s encryption-specific HKDF/AES-GCM vault APIs. Journal context, titles, text, and timestamps are encrypted; backups bind to the account, network, domain, and credential. Signing keys and journal encryption keys are not stored.

Local development

cd web
pnpm install --frozen-lockfile
cp .env.example .env.local
# Fill in your deployment and social-service values.
pnpm dev

pnpm typecheck
pnpm test
pnpm build

# From the repository root:
forge test --root contracts --offline

Database and jobs

For a new dedicated v2 database, run supabase/bootstrap-v2.sql once. It includes the schema and the required ingestion changes; do not blindly reapply older initialization files over an active deployment. Existing databases need reviewed migrations, not a destructive reset.

Configure the database’s scheduled indexer using supabase/schedule-indexer.sql and the matching server-side secret. Run pnpm indexer:backfill from web to catch up. Scheduler installation does not repair wrong API credentials, schema mismatch, or a decoder error. Verify HTTP responses and the finalized cursor.

The GitHub verifier needs a separate recurring process. The indexer cron does not run it. Prefer one chain/deployment database until projections are explicitly namespaced for multiple deployments.