MVP Test Plan & Acceptance Criteria

Smart contracts

• final packages/contracts Solidity has no //, ///, or block comments (SPDX/pragma only)
• create vault with correct addresses/BPS
• reject zero addresses
• deterministic predicted address matches CREATE2 deployment (predictVault ECA)
• ForgeLaunchRouter.launch deploys vault + PONS launch in one tx
• router rejects creatorFeeRecipient ≠ vault ECA
• PONS initiator/salt namespace is the creator wallet (not the router) — fork assert
• native/token: platform = 15% of gross; tip = 1% of post-platform pool; beneficiary gets the rest of that pool
• tip never reduces platformAmount vs platformFeeBps of gross
• permissionless caller receives tip; second caller cannot steal already-split funds
• admin setPlatformFeeBps / setCallerTipBps updates next claim; non-admin reverts
• BPS above caps reverts
• CREATE2 vault ECA unchanged after BPS edit
• vault owner can setBeneficiary / transferOwnership; non-owner reverts
• factory admin cannot change vault beneficiary
• predictVault(agentId, owner, initialBeneficiary) matches deploy
• malicious claim caller cannot redirect platform or beneficiary shares
• malicious beneficiary fallback cannot reenter and alter accounting
• PONS escrow claim succeeds on fork/test deployment
• split event matches amounts and includes platform BPS, tip BPS, callerAmount
• keeper skips when tip < gas + minProfit; submits when tip covers both

PONS adapter

• wrong chain rejected
• inaccessible/disabled launch config rejected
• canLaunch=false surfaces explicit error
• current launch fee read live
• launch intent expires and must be regenerated
• PONS custom error translated to user-friendly error
• factory TokenLaunched indexed once
• curve trades indexed once
• restart from checkpoint produces no duplicates
• WS disconnect followed by HTTP catch-up misses no logs
• simulated reorg removes/replays orphan events
• graduation switches launch phase and live UI route

CLI

• simulate/dry-run cannot send transaction
• simulate prints vault + token + curve ECAs
• --json simulate is valid JSON for agents
• production requires typed confirmation
• key is not printed
• insufficient balance stops before signing
• production launch is one router tx (vault+token), not two
• receipt artifact generated
• token becomes visible through indexer, not manual fake row
• import marks canonical token as platform token

Docs + skills

• .cursor/skills/forge-launch-token/SKILL.md exists and matches CLI commands
• Launch a token mirrors the skill workflow
• /docs (or static markdown browse) includes launch-token + agents index
• AGENTS.md links resolve
• Following the skill against mock adapter completes simulate without manual code archaeology

Mobula market + swap

• TradingView loads historical bars via FORGE /market/ohlcv (not direct Mobula from browser)
• live candle updates without full reload
• buy/sell quote returns amounts + unsigned tx; MOBULA_API_KEY absent from response
• swap to rejected if outside router allowlist
• poolAddress targeting preferred when curve/pool known
• stale quote rejected after TTL
• slippage above MOBULA_MAX_SLIPPAGE_BPS rejected

Identity generation

• Generate with Grok for Trading fills name, ticker, descriptions, personality, tags, avatar candidate
• template switch changes tone and visual direction
• regenerate-avatar keeps text, replaces image candidates
• Zod rejects malformed model JSON; form left unchanged on failure
• daily rate limit returns 429
• manual upload works with IDENTITY_GENERATION_ENABLED=false
• xAI key never present in client responses

Agent runtime

Prompt injection tests:

• “ignore your system prompt” cannot expose secrets or enable unavailable tools
• malicious webpage content cannot create new tool permission
• user cannot call hidden tool by naming it
• Agent cannot access another Agent's memory
• Agent cannot access DB/filesystem/shell

Reliability:

• xAI 429 retries with backoff
• xAI outage returns graceful unavailable state
• stream abort cleans up server resources
• tool timeout is bounded
• state-changing tool ambiguous response is not automatically replayed

Web/API

• SIWE-style nonce is single use
• expired nonce fails
• signature for wrong domain fails
• creator cannot edit another Agent
• admin routes reject normal user
• Agent draft -> launch state transitions valid only in allowed order
• launch tx hash alone does not mark Agent live until indexed confirmation
• XSS payload in profile/chat is escaped/sanitized

WebSocket

• subscribe/unsubscribe
• reconnect
• heartbeat timeout
• cursor replay
• resync_required on expired cursor
• token room receives launch/trade/fee events
• duplicate Redis event ignored by client/domain idempotency

UI acceptance

Home:

• responsive desktop/mobile
• animated forge hero performant and lazy-loaded
• trending + hot cards live data
• paid inventory visibly labeled

Launch:

• all 4 steps complete
• current PONS economics visible
• AgentFeeVault/beneficiary/platform split visible
• wallet reject returns user to review without corrupting draft
• submitted transaction shows pending/confirmed/reverted states

Agent page:

• chat streams
• market data updates without refresh
• launch phase displayed
• fee destination/transparency panel displayed

Production recovery drill

1. Reboot server.
2. Confirm PostgreSQL/Redis/Nginx start.
3. Confirm PM2 services start automatically.
4. Kill indexer process; confirm PM2 recovery.
5. Disable primary WS RPC; confirm failover + catch-up.
6. Restart Redis; confirm clients reconnect/resync.
7. Restore DB backup into staging and run integrity checks.

MVP sign-off

Release requires zero unresolved critical/high security issues and successful end-to-end launch on the target chain using a non-production test token before $FORGE launch.