@deeeed/metamask-harness 0.38.1 → 0.40.0

package/dist/live-adapter-contract.js

@@ -9,6 +9,7 @@ import { build } from "esbuild";
 import { init, parse } from "es-module-lexer";
 import { resolveRequiredLocalProtocolRoot, runnerDir } from "./paths.js";
 import { corePnpNodeOptions } from "./commands/core-readiness.js";
+import { serializeTrustedMutationContext } from "./funding-execution-context.js";
 function actionFileStem(action) {
   return String(action).replace(/[^a-zA-Z0-9._-]/g, "_");
 }
@@ -306,7 +307,8 @@ async function runLiveAdapterScript({ platform, action, node, context, prepared
     context: {
       nodeId: context.nodeId,
       projectRoot: context.projectRoot,
-      artifactsDir: context.artifactsDir
+      artifactsDir: context.artifactsDir,
+      ...context.trustedMutation ? { trustedMutation: serializeTrustedMutationContext(context.trustedMutation) } : {}
     },
     outputPath
   };

package/dist/metamask-action-validation.js

@@ -1,14 +1,41 @@
 function isRecord(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
-function validateMetaMaskActionInputs(recipe, adapter) {
+function resolveMetaMaskParameterValue(value, params) {
+  if (typeof value === "string") {
+    const exact = /^\{\{params\.([A-Za-z0-9_.-]+)\}\}$/u.exec(value);
+    if (!exact) return value;
+    let current = params;
+    for (const segment of exact[1].split(".")) {
+      if (!isRecord(current) || !Object.hasOwn(current, segment)) return value;
+      current = current[segment];
+    }
+    return current;
+  }
+  if (Array.isArray(value)) return value.map((entry) => resolveMetaMaskParameterValue(entry, params));
+  if (!isRecord(value)) return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => [key, resolveMetaMaskParameterValue(entry, params)])
+  );
+}
+function validateMetaMaskActionInputs(recipe, adapter, params) {
   if (!isRecord(recipe) || !isRecord(recipe.workflow)) return [];
   const nodes = isRecord(recipe.workflow.nodes) ? recipe.workflow.nodes : void 0;
   if (!nodes) return [];
   const findings = [];
-  for (const [nodeId, node] of Object.entries(nodes)) {
+  for (const [nodeId, rawNode] of Object.entries(nodes)) {
+    const node = params ? resolveMetaMaskParameterValue(rawNode, params) : rawNode;
     if (!isRecord(node)) continue;
     const action = node.action;
+    const maximum = (name, limit) => {
+      if (typeof node[name] !== "number" || node[name] <= limit) return;
+      findings.push({
+        severity: "error",
+        code: "recipe.invalid_param",
+        path: `workflow.nodes.${nodeId}.${name}`,
+        message: `${action} ${name} must not exceed ${limit}`
+      });
+    };
     if (action === "metamask.perps.read_snapshot" && adapter === "extension") {
       if (node.market !== void 0 && node.markets !== void 0) {
         findings.push({
@@ -54,9 +81,148 @@ function validateMetaMaskActionInputs(recipe, adapter) {
           message: `${action} timeout_ms must not exceed 60000`
         });
       }
+      if (isRecord(node.sampling)) {
+        if (typeof node.sampling.count === "number" && node.sampling.count > 10) {
+          findings.push({
+            severity: "error",
+            code: "recipe.invalid_param",
+            path: `workflow.nodes.${nodeId}.sampling.count`,
+            message: `${action} sampling.count must not exceed 10`
+          });
+        }
+        if (typeof node.sampling.interval_ms === "number" && node.sampling.interval_ms > 3e4) {
+          findings.push({
+            severity: "error",
+            code: "recipe.invalid_param",
+            path: `workflow.nodes.${nodeId}.sampling.interval_ms`,
+            message: `${action} sampling.interval_ms must not exceed 30000`
+          });
+        }
+      }
+      if (isRecord(node.expect)) {
+        if (typeof node.expect.minimum_changed_market_count === "number" && node.expect.minimum_changed_market_count > 100) {
+          findings.push({
+            severity: "error",
+            code: "recipe.invalid_param",
+            path: `workflow.nodes.${nodeId}.expect.minimum_changed_market_count`,
+            message: `${action} expect.minimum_changed_market_count must not exceed 100`
+          });
+        }
+        if (typeof node.expect.minimum_history_count === "number" && node.expect.minimum_history_count > 500) {
+          findings.push({
+            severity: "error",
+            code: "recipe.invalid_param",
+            path: `workflow.nodes.${nodeId}.expect.minimum_history_count`,
+            message: `${action} expect.minimum_history_count must not exceed 500`
+          });
+        }
+      }
+    }
+    if (action === "metamask.perps.assert_visible_consistency" && adapter === "extension") {
+      maximum("sample_count", 10);
+      maximum("sample_interval_ms", 3e4);
+      maximum("minimum_changed_count", 200);
+      maximum("minimum_recent_activity_count", 50);
+      maximum("timeout_ms", 12e4);
+      maximum("max_items", 200);
+    }
+    const fundedVisibleMutation = adapter === "extension" && (action === "metamask.perps.close_visible_position" || action === "metamask.perps.close_orders" || action === "metamask.perps.edit_margin" || action === "metamask.perps.update_position_tpsl" || action === "metamask.perps.place_order" && node.confirm_live === true);
+    if (fundedVisibleMutation) {
+      const required = (name, pattern, message) => {
+        if (typeof node[name] === "string" && pattern.test(node[name])) return;
+        findings.push({
+          severity: "error",
+          code: "recipe.invalid_param",
+          path: `workflow.nodes.${nodeId}.${name}`,
+          message
+        });
+      };
+      const decimal = action === "metamask.perps.close_visible_position" || action === "metamask.perps.update_position_tpsl" ? node.funding_amount : node.amount ?? node.notional;
+      const decimalText = String(decimal ?? "");
+      const match = /^([1-9][0-9]*)(?:\.([0-9]{1,6}))?$/u.exec(decimalText);
+      if (!match) {
+        findings.push({
+          severity: "error",
+          code: "recipe.invalid_param",
+          path: `workflow.nodes.${nodeId}.${action === "metamask.perps.close_visible_position" || action === "metamask.perps.update_position_tpsl" ? "funding_amount" : "amount"}`,
+          message: `${action} funded decimal amount must be positive plain decimal text with at most six places`
+        });
+      }
+      if (action === "metamask.perps.place_order" && node.submit_attempts !== void 0 && node.submit_attempts !== 1) {
+        findings.push({
+          severity: "error",
+          code: "recipe.invalid_param",
+          path: `workflow.nodes.${nodeId}.submit_attempts`,
+          message: `${action} funded visible submission requires submit_attempts=1`
+        });
+      }
+      if (action === "metamask.perps.close_visible_position" || action === "metamask.perps.edit_margin" || action === "metamask.perps.update_position_tpsl") {
+        required("funding_side", /^(?:long|short)$/u, `${action} requires the authorized position side`);
+      }
+      if (action === "metamask.perps.edit_margin" || action === "metamask.perps.update_position_tpsl") {
+        required(
+          "funding_position_size",
+          /^(?=[0-9.]*[1-9])[0-9]+(?:\.[0-9]+)? [A-Z0-9:_-]{2,20}$/u,
+          `${action} requires the exact visible position size`
+        );
+      }
+      if (action === "metamask.perps.close_visible_position" && node.cleanup_only === true) {
+        required(
+          "funding_position_size",
+          /^(?=[0-9.]*[1-9])[0-9]+(?:\.[0-9]+)? [A-Z0-9:_-]{2,20}$/u,
+          `${action} cleanup requires the exact visible position size`
+        );
+        if (node.amount != null) {
+          findings.push({
+            severity: "error",
+            code: "recipe.invalid_param",
+            path: `workflow.nodes.${nodeId}.amount`,
+            message: `${action} cleanup must close the full exact position`
+          });
+        }
+      }
+      if (action === "metamask.perps.edit_margin" && !/^[1-9][0-9]*(?:\.[0-9]{1,6})?$/u.test(String(node.funding_amount ?? ""))) {
+        findings.push({
+          severity: "error",
+          code: "recipe.invalid_param",
+          path: `workflow.nodes.${nodeId}.funding_amount`,
+          message: `${action} requires the authorized position amount`
+        });
+      }
+      if (action === "metamask.perps.close_orders") {
+        required("side", /^(?:long|short)$/u, `${action} requires the exact order side`);
+        if (!/^[1-9][0-9]*(?:\.[0-9]{1,6})?$/u.test(String(node.limit_price ?? ""))) {
+          findings.push({
+            severity: "error",
+            code: "recipe.invalid_param",
+            path: `workflow.nodes.${nodeId}.limit_price`,
+            message: `${action} requires an explicit positive limit_price for resumable cancellation`
+          });
+        }
+      }
+      if (action === "metamask.perps.place_order" && String(node.order_type ?? "market") === "limit" && !/^[1-9][0-9]*(?:\.[0-9]{1,6})?$/u.test(String(node.limit_price ?? ""))) {
+        findings.push({
+          severity: "error",
+          code: "recipe.invalid_param",
+          path: `workflow.nodes.${nodeId}.limit_price`,
+          message: `${action} funded limit submission requires explicit limit_price; offset-only pricing is not resumable`
+        });
+      }
+      for (const name of ["identity_rounding_tolerance_base_units", "balance_reconciliation_tolerance_base_units"]) {
+        if (node[name] === void 0) continue;
+        const value = String(node[name]);
+        if (!/^(?:0|[1-9][0-9]{0,6})$/u.test(value) || BigInt(value) > 1000000n) {
+          findings.push({
+            severity: "error",
+            code: "recipe.invalid_param",
+            path: `workflow.nodes.${nodeId}.${name}`,
+            message: `${action} ${name} must be an integer string from 0 through 1000000`
+          });
+        }
+      }
     }
     const state = typeof node.state === "string" ? node.state.toLowerCase() : void 0;
-    const createsOrder = action === "metamask.perps.place_order" || (action === "metamask.perps.ensure_positions" || action === "metamask.perps.ensure_orders") && (state === "open" || state === "present");
+    const createsOrder = action === "metamask.perps.place_order" || adapter !== "extension" && (action === "metamask.perps.ensure_positions" || action === "metamask.perps.ensure_orders") && (state === "open" || state === "present");
     if (!createsOrder) continue;
     const requireOneOf = (names, message) => {
       const present = names.some((name) => {
@@ -87,5 +253,6 @@ function validateMetaMaskActionInputs(recipe, adapter) {
   return findings;
 }
 export {
+  resolveMetaMaskParameterValue,
   validateMetaMaskActionInputs
 };

package/dist/mm-harness-cli.js

@@ -234,11 +234,16 @@ Common overrides:
   --platform <ios|android>           Mobile platform preference; use --adapter for the product adapter
   --target <path>                    Checkout path (default: cwd)
   --artifacts-dir <dir>              Override evidence output (default: active task/artifacts, otherwise a checkout-local temp/recipe/runs/<run>)
+  --funding-request <absolute-file>  Original consented mutation request for external-mutation actions
+  --funding-preflight <absolute-file> Eligible funding preflight bound to the request bytes
+  --funding-release-proof <absolute-file> Exact release proof independently bound to funding eligibility
+  --funding-balance-proof <absolute-file> Exact balance proof and contained visible evidence chain
   --library <name=path>              Add/override a recipe-library source (repeatable)
   --heal <off|infra-only|auto>       Healing policy (default: infra-only); auto-ensures the overlay
   --json                             Machine-readable output
   --json-stream                      Line-flushed JSONL progress + terminal event
   --record-video=full-run            Record a video of the run
+  --hud <auto|show|hide>             Recipe HUD policy (default: auto)
 
 Advanced integrations:
   runtime: --cdp-port, --watcher-port/--metro-port, --runtime-dir, --slot,
@@ -250,7 +255,7 @@ Advanced integrations:
 
 Example:
   mm-harness run wallet.smoke --describe
-  mm-harness run perps.clean-market-testnet market=BTC --plan
+  mm-harness run perps.clean-market-testnet market=BTC --plan --adapter mobile
   mm-harness run recipe.json market=ETH --adapter extension`
   },
   {
@@ -458,7 +463,8 @@ Example:
   --verify                           Launch then poll CDP/bridge until ready (absorbs the old \`live\`)
   --runway                           Post-launch runway check (mobile only; teaching error elsewhere)
   --watch                            Persistent webpack watcher then relaunch (extension only)
-  --sidepanel | --fullscreen         Extension display mode (default --fullscreen)
+  --surface <fullscreen|sidepanel>   Extension display mode (default: fullscreen)
+  --sidepanel | --fullscreen         Legacy aliases for --surface
   --url <dapp-url>                    Open a dapp beside the sidepanel (default: MetaMask test dapp)
   --heal <off|infra-only|auto>       Healing policy (default auto); bounds always enforced
   --device <udid|name>               Target simulator/device (env: IOS_SIMULATOR / ADB_SERIAL)

package/dist/recipe-security.js

@@ -3,7 +3,6 @@ import { lstat, readFile, readdir, realpath } from "node:fs/promises";
 import path from "node:path";
 const READ_ONLY_CUSTOM_ACTIONS = /* @__PURE__ */ new Set([
   "ui.locators",
-  "ui.activate_and_observe",
   "metamask.wallet.fixture_status",
   "metamask.wallet.validate_import",
   "metamask.wallet.list_accounts",
@@ -20,21 +19,22 @@ const READ_ONLY_CUSTOM_ACTIONS = /* @__PURE__ */ new Set([
   "metamask.perps.read_orders",
   "metamask.perps.read_account",
   "metamask.perps.read_snapshot",
+  "metamask.perps.assert_visible_consistency",
   "metamask.perps.assert_positions",
   "metamask.perps.assert_orders",
+  "metamask.perps.ensure_positions",
+  "metamask.perps.ensure_orders",
   // Collector reads are host-only; starting capture remains arbitrary-code
   // because it spawns an HTTP listener.
   "metamask.analytics.read_events",
   "metamask.analytics.assert_events"
 ]);
 const APP_MUTATION_CUSTOM_ACTIONS = /* @__PURE__ */ new Set([
-  "ui.activate_and_observe",
   "metamask.assets.verify_sorting",
   "metamask.assets.set_token_visibility",
   "metamask.assets.import_custom_token",
   "metamask.assets.prepare_send",
   "metamask.assets.review_send",
-  "metamask.assets.finish_send",
   "metamask.assets.set_custom_gas",
   "metamask.assets.select_network_scope",
   "metamask.wallet.lock",
@@ -61,8 +61,6 @@ const APP_MUTATION_CUSTOM_ACTIONS = /* @__PURE__ */ new Set([
   "metamask.perps.edit_margin",
   "metamask.perps.edit_order",
   "metamask.perps.update_position_tpsl",
-  "metamask.perps.ensure_positions",
-  "metamask.perps.ensure_orders",
   "metamask.perps.clear_performance_caches",
   "metamask.perps.measure_homepage_visible",
   "metamask.perps.prepare_local_snapshot_endpoint",
@@ -70,14 +68,13 @@ const APP_MUTATION_CUSTOM_ACTIONS = /* @__PURE__ */ new Set([
   "metamask.perps.select_activity_filter",
   "metamask.perps.select_market_filter",
   "metamask.perps.open_balance_action",
+  "metamask.perps.assert_visible_consistency",
   "metamask.perps.start_state",
   "metamask.perps.teardown_state",
   // Consent changes wallet state and is therefore an app mutation.
   "metamask.analytics.set_consent"
 ]);
 const EXTERNAL_MUTATION_CUSTOM_ACTIONS = /* @__PURE__ */ new Set([
-  "ui.activate_and_observe",
-  "metamask.assets.finish_send",
   "metamask.swap_bridge.submit_transaction",
   "metamask.perps.close_positions",
   "metamask.perps.close_orders",
@@ -85,11 +82,7 @@ const EXTERNAL_MUTATION_CUSTOM_ACTIONS = /* @__PURE__ */ new Set([
   "metamask.perps.close_visible_position",
   "metamask.perps.edit_margin",
   "metamask.perps.edit_order",
-  "metamask.perps.update_position_tpsl",
-  "metamask.perps.ensure_positions",
-  "metamask.perps.ensure_orders",
-  "metamask.perps.start_state",
-  "metamask.perps.teardown_state"
+  "metamask.perps.update_position_tpsl"
 ]);
 function metaMaskActionExecutionCapabilities(action) {
   const capabilities = [];

package/dist/runner.js

@@ -6,6 +6,8 @@ import {
   mobileSourceFingerprint,
   recordMobileSourceBaseline
 } from "./adapters/mobile/source-freshness.js";
+import { readAndroidNativeRuntimeIdentity } from "./adapters/mobile/release-artifact.js";
+import { readMobileReleaseArtifactState } from "./adapters/mobile/release-artifact-state.js";
 import {
   createAndroidVideoRecorder,
   createIosSimulatorVideoRecorder
@@ -29,6 +31,10 @@ import {
   importRecipeHarnessRuntimeReactNativeBridge,
   runnerDir
 } from "./paths.js";
+import {
+  selectedIdentityFromWalletImport,
+  trustedMutationForAction
+} from "./funding-execution-context.js";
 const OFFICIAL_ACTIONS = new Set(OFFICIAL_RECIPE_ACTIONS);
 async function createMetaMaskMobileRunner(options = {}) {
   return createMetaMaskRunner(
@@ -89,7 +95,10 @@ async function createMetaMaskRunner(adapter, actionManifest, options = {}) {
   ).filter(
     (entry) => declaredActions.has(entry.action) && !existing.has(entry.action) && !lifecycle.some((lifecycleEntry) => lifecycleEntry.action === entry.action)
   );
-  const autoHudDisabled = options.autoHud === false || process.env.METAMASK_RECIPE_AUTO_HUD === "0" || process.env.METAMASK_RECIPE_AUTO_HUD === "false";
+  const autoHudDisabled = options.autoHud === false || options.autoHud === void 0 && (process.env.METAMASK_RECIPE_AUTO_HUD === "0" || process.env.METAMASK_RECIPE_AUTO_HUD === "false");
+  const externalMutationActions = new Set(
+    Object.entries(actionManifest.actions).filter(([, declaration]) => Array.isArray(declaration.execution_capabilities) && declaration.execution_capabilities.includes("external-mutation")).map(([action]) => action)
+  );
   const logger = deduplicateLibraryResolutionLogs(
     options.quietStdout ? new console.Console(process.stderr) : console,
     options.suppressLibraryResolutionLogs
@@ -99,10 +108,18 @@ async function createMetaMaskRunner(adapter, actionManifest, options = {}) {
   return createRecipeRunner({
     actionManifest,
     adapters: withActionProgress(
-      [...core, ...ui, ...lifecycle, ...custom].map((entry) => ({
-        ...entry,
-        ...adapterSecurity(entry.action, actionSources, options.trustTaskActions)
-      })),
+      withMobileNativeRuntimeIdentity(
+        adapter,
+        withTrustedMutationContext(
+          [...core, ...ui, ...lifecycle, ...custom].map((entry) => ({
+            ...entry,
+            ...adapterSecurity(entry.action, actionSources, options.trustTaskActions)
+          })),
+          options.trustedMutation,
+          externalMutationActions,
+          adapter
+        )
+      ),
       options.onActionEvent
     ),
     logger,
@@ -130,6 +147,83 @@ async function createMetaMaskRunner(adapter, actionManifest, options = {}) {
     }
   });
 }
+function withMobileNativeRuntimeIdentity(adapter, adapters, identity = {
+  state: readMobileReleaseArtifactState,
+  read: readAndroidNativeRuntimeIdentity
+}) {
+  if (adapter !== "mobile") return adapters;
+  return adapters.map((entry) => ({
+    ...entry,
+    async execute(node, context) {
+      const state = identity.state(context.projectRoot);
+      if (!state) {
+        if (context.env.METAMASK_RECIPE_MOBILE_OPAQUE_RUNTIME === "1") {
+          throw new Error("Mobile release-artifact actions require current trusted runtime state. Next: rerun runtime-launch with the exact artifact.");
+        }
+        return entry.execute(node, context);
+      }
+      identity.read(state);
+      const result = await entry.execute(node, context);
+      const nativeRuntimeIdentity = identity.read(state);
+      const output = result.output && typeof result.output === "object" && !Array.isArray(result.output) ? result.output : { result: result.output };
+      return {
+        ...result,
+        output: {
+          ...output,
+          nativeRuntimeIdentity,
+          runtimeSessionId: nativeRuntimeIdentity.runtimeSessionId
+        }
+      };
+    }
+  }));
+}
+function withTrustedMutationContext(adapters, base, externalMutationActions, adapter = "extension") {
+  if (adapter !== "extension") return adapters;
+  let selectedIdentitySha256;
+  const identityProofAction = "metamask.wallet.import";
+  const identityInvalidatingActions = /* @__PURE__ */ new Set([
+    "metamask.wallet.ensure_unlocked",
+    "metamask.wallet.lock",
+    "metamask.wallet.reset",
+    "metamask.wallet.select_account",
+    "metamask.wallet.setup"
+  ]);
+  const identityPreservingUiActions = /* @__PURE__ */ new Set([
+    "ui.capture_surface",
+    "ui.locators",
+    "ui.screenshot",
+    "ui.wait_for"
+  ]);
+  return adapters.map((entry) => ({
+    ...entry,
+    async execute(node, context) {
+      const identityProof = entry.action === identityProofAction;
+      const invalidatesIdentity = identityInvalidatingActions.has(entry.action) || entry.action.startsWith("ui.") && !identityPreservingUiActions.has(entry.action);
+      if (identityProof || invalidatesIdentity) selectedIdentitySha256 = void 0;
+      const externalMutation = externalMutationActions.has(entry.action);
+      if (externalMutation && !base) {
+        throw new Error(
+          "External mutation requires runner-verified --funding-request and --funding-preflight files. Next: rerun with both funding files."
+        );
+      }
+      const trustedMutation = base && externalMutation ? await trustedMutationForAction(base, context.recipe, selectedIdentitySha256) : void 0;
+      const trustedContext = trustedMutation ? { ...context, trustedMutation } : context;
+      const result = await entry.execute(node, trustedContext).catch((error) => {
+        if (identityProof || invalidatesIdentity) selectedIdentitySha256 = void 0;
+        throw error;
+      });
+      if (invalidatesIdentity) selectedIdentitySha256 = void 0;
+      const selected = selectedIdentityFromWalletImport(entry.action, result, base);
+      if (selected) {
+        if (base && base.selectedIdentitySha256 !== selected) {
+          throw new Error("Same-run wallet identity changed after its trusted import proof.");
+        }
+        selectedIdentitySha256 = selected;
+      }
+      return result;
+    }
+  }));
+}
 function deduplicateLibraryResolutionLogs(logger, suppress = false) {
   const seen = /* @__PURE__ */ new Set();
   return {
@@ -412,5 +506,7 @@ export {
   createMetaMaskRunner,
   isAutomaticHudProgress,
   mobileSourceAwareLifecycleAdapters,
-  resolveMobileLifecycleReadinessTimeout
+  resolveMobileLifecycleReadinessTimeout,
+  withMobileNativeRuntimeIdentity,
+  withTrustedMutationContext
 };

package/docs/RECIPES.md

@@ -60,7 +60,9 @@ mm-harness run recipe.json account="Account 2"
 
 Use the shared wallet setup recipe on either Mobile or Extension. `auto`
 reuses a ready fixture-backed profile and otherwise completes visible
-onboarding; `ui` requires a fresh onboarding state.
+onboarding. On Extension, `ui` completes fresh visible onboarding or visibly
+unlocks and proves/selects the exact derived account in an existing session.
+On Mobile, `ui` requires fresh onboarding.
 
 ```bash
 mm-harness run wallet.import method=auto
@@ -74,6 +76,77 @@ fixture. Secret values are redacted from commands and evidence. Visible imports
 default to MetaMetrics off and skip Mobile's optional interests; password terms
 are required and always accepted by the action.
 
+### Extension Perps release recipes
+
+Discover these identifiers with `run --list --adapter extension --json` and
+inspect the exact graph with `run <id> --describe --adapter extension --json`:
+
+| Behavior | Canonical recipe |
+| --- | --- |
+| Activity filter routes | `perps.release-activity-filters` |
+| Deposit and withdraw previews without submission | `perps.release-funds-flows` |
+| Resting limit placement and exact cancellation | `perps.release-live-limit-order` |
+| Filled market placement and exact position close | `perps.release-live-market-order` |
+| Market header and statistics | `perps.release-market-details` |
+| Market categories | `perps.release-market-filters` |
+| Market text search | `perps.release-market-search` |
+| Long/Short and Market/Limit entry controls | `perps.release-order-entry` |
+| Amount, leverage, keyboard, auto-close, and TP/SL validation | `perps.release-order-validation` |
+| Official-build rendered market/activity consistency | `perps.release-visible-consistency` |
+| Favorite persistence and cleanup | `perps.release-watchlist` |
+| Hook-backed controller snapshot consistency | `perps.source-dev-snapshot-consistency` |
+
+The source-development snapshot recipe is compatibility evidence only and must
+not support an official artifact verdict. Activity and funds recipes are
+Extension-scoped because their semantic actions are not shared release
+capabilities. Keep ticket-specific orchestration task-local and compose these
+identifiers with `call` instead of copying their graphs.
+
+Order-entry and order-validation callers must supply a market with no existing
+position; the product exposes Modify/Close instead of New Long/Short for an
+already-open market. Source-development snapshot callers may opt into a
+positive `minimum_changed_market_count`; the default does not require a price
+tick, while typed-history and visible-activity agreement remain strict.
+
+The two live recipes require explicit `confirm_live=true`. The trusted runner
+must also verify the exact consented funding request, preflight, release proof,
+and contained balance proof. Market placement declares the exact provider and
+network; background placement and cancellation refuse a mismatch without
+toggling it. Immediately before publication and dispatch, the action also reads
+the current visible Perps Home balance and requires the runner-trusted minimum.
+The release onboarding session proves artifact, wallet, and origin provenance;
+the fresh balance trace identifies the execution session, so a legitimate
+release-artifact relaunch does not claim false same-session continuity. The
+runner revalidates the current artifact tree and owned CDP profile, persists the
+pre-dispatch receipt, and finishes receipt-bound cleanup and reconciliation. A
+known-not-dispatched receipt is terminal and requires fresh consent and a new
+claim. Selecting or resetting an account, changing its lock/setup session, or
+using a generic UI press invalidates the cached identity proof; a fresh visible
+`wallet.import` proof is required before another external mutation. Extension
+`ensure_positions`, `ensure_orders`, and `teardown_state` only observe and assert
+state that already exists; their schemas reject creation and cleanup inputs.
+Extension does not expose `start_state`, readiness claims, multi-position
+background closure, or the mutating `runner.action-validation` recipe. Financial
+transitions must use an explicitly funded leaf action.
+The shared `perps.clean-market-testnet` convergence recipe is therefore Mobile-
+only: Extension discovery omits it and a direct Extension plan fails statically.
+Planning or calling a recipe never weakens those gates.
+
+### Extension submission boundary
+
+Extension currently exposes read-only Assets and Swap/Bridge evidence plus send
+preparation/review, quote, Max, and slippage actions. It does not expose
+`metamask.assets.finish_send`, `metamask.swap_bridge.submit_transaction`, or
+generic `ui.activate_and_observe`. Those operations remain unavailable until a
+domain-specific funding policy and durable pre-dispatch receipt/recovery
+contract exists. The four former Assets submit recipes are not shipped.
+
+The shared live Swap recipes remain available to Mobile, whose manifest owns a
+separate native submission action. Extension `run --list` omits those recipes,
+and a direct Extension plan fails statically. Extension quote and visible-state
+recipes remain discoverable and plan normally; generic pointer activation is
+not a substitute for a funded financial leaf.
+
 To prove the full real-user recovery journey, delete the current wallet through
 visible client UI and import it again:
 

package/docs/RELEASE-QA-CAPABILITY-MAP.md

@@ -81,6 +81,7 @@ current manifests do not expose the required durable capability.
 | Order entry | Funded Perps balance, market/limit inputs, validation, preview, fill, and duplicate protection | Parameterized order placement plus visible order-entry and validation recipes | **PARTIAL**: live state and provider outcomes remain release-dependent |
 | Position management | Open position, close, margin, and TP/SL changes | Visible position actions, close, edit-margin, and TP/SL actions | **PARTIAL**: exact outcome depends on live account state |
 | Deposit and withdrawal | Wallet funds, Perps balance, confirmations, and resulting activity | Balance actions and confirmation reads with a funds-flow recipe | **PARTIAL**: funds and provider availability are external |
+| Perps state helpers | Deterministic position/order creation or cleanup before and after proof | Mobile state helpers can converge supported testnet state; Extension only exposes observation/assertion helpers and no start/readiness or multi-position background-close claim | **PARTIAL**: Extension convergence is **MISSING** and `perps.clean-market-testnet` plus mutating runner validation are omitted there |
 | Snapshot assertions | Positions, orders, markets, history, and watchlist | Bounded redacted snapshot when the background hook exists; visible-state reads on untouched releases | **AVAILABLE** with runtime-specific observation paths |
 | Deterministic seeded provider state | Balance, positions, limit orders, TP/SL, history, and controlled REST/stream behavior | Existing setup fixtures do not reproduce the complete QA provider model inside an untouched release artifact | **MISSING** |
 
@@ -90,7 +91,7 @@ current manifests do not expose the required durable capability.
 | --- | --- | --- | --- |
 | Token list, prices, details, and sorting | Funded account with known holdings and price data | Visible token-list/details reads, network scope, sorting assertions, and bundled recipes | **AVAILABLE** for EVM token UI |
 | Token search/import/hide/persistence | Known contracts and a persistent profile | Custom-token import, visibility changes, restart-safe recipes, and custom-network composition | **AVAILABLE** for Extension EVM tokens |
-| Native/token send and gas | Funded owned accounts and live gas | Prepare, review, custom-gas, finish, and Max/cancel/send recipes | **PARTIAL**: terminal submission is gated by funds and cost policy |
+| Native/token send and gas | Funded owned accounts and live gas | Extension can prepare and review a send and configure gas, but exposes no terminal send/cancel action or submit recipe | **MISSING** for terminal Extension send until domain-specific funding and durable receipt policy exists |
 | Aggregate Android holdings | Imported wallet with multi-chain assets | Native-accessibility token-list read on an untouched physical-device release | **AVAILABLE** |
 | Balance streaming and aggregation arithmetic | Triggered inbound update and expected cross-network totals | Visible snapshots exist; deterministic inbound trigger and tolerance assertions are not bundled | **PARTIAL** |
 | NFTs, DeFi, Solana send, and Bitcoin details | Indexed owned positions/assets and chain-specific transaction flows | Generic visible UI only | **MISSING** |
@@ -101,8 +102,8 @@ current manifests do not expose the required durable capability.
 | --- | --- | --- | --- |
 | Surface, asset, network, and amount selection | Supported source/destination pair | Exact asset/network selection, amount/Max input, and visible-state reads on Extension; exact native selection and amount input on Android | **AVAILABLE** |
 | Quote and slippage | Live quote services and supported route | Surface, quote, Max-quote, and custom-slippage recipes | **AVAILABLE** |
-| Submit and confirmation | Sufficient source balance and gas | Typed submit action with explicit confirmation policy | **PARTIAL**: live funds and cost policy decide whether submission is allowed |
-| Sequential multi-network journey | Balances delivered by preceding swaps and bridges | Individual steps are composable, but the complete live-funds journey remains task-local and resumable by its case inventory | **PARTIAL** |
+| Submit and confirmation | Sufficient source balance and gas | Mobile retains its typed native submit action; Extension exposes no submission action or live-submit recipe | **MISSING** on Extension until domain-specific funding and durable receipt policy exists |
+| Sequential multi-network journey | Balances delivered by preceding swaps and bridges | Extension selection, amount, quote, Max, and slippage evidence remains composable, but no Extension terminal submit step exists | **MISSING** for an Extension end-to-end live journey |
 | Activity, balance deltas, and completed bridge tracking | Confirmed transactions and indexed activity | Visible-state evidence exists; reusable terminal activity and arithmetic assertions are incomplete | **PARTIAL** |
 
 ### Networks
@@ -112,8 +113,8 @@ current manifests do not expose the required durable capability.
 | Add, select, and remove custom networks | Known RPC configuration and chain identity | Typed custom-network and Chainlist add, visible-state read, select, and remove actions | **AVAILABLE** on Extension |
 | Custom-network tokens and persistence | Known token contract and persistent profile | Network actions compose with Assets import/visibility/persistence recipes | **AVAILABLE** on Extension |
 | Balance stability and fiat visibility | Funded custom network and live price APIs | Visible-state reads and a bounded balance-stability recipe | **PARTIAL**: external price availability remains uncontrolled |
-| Send Max and activity | Funded custom network and recipient | Assets send actions cover the transaction path | **PARTIAL**: exact activity and balance-delta assertions remain task-local |
-| Bridge tracking and details | Completed supported bridge route | Swap/Bridge composition exists; reusable terminal tracking assertions are incomplete | **PARTIAL** |
+| Send Max and activity | Funded custom network and recipient | Extension can prepare and review the send, but cannot terminally submit or cancel it | **MISSING** until Extension send has domain-specific funding and durable receipts |
+| Bridge tracking and details | Completed supported bridge route | Read-only Swap/Bridge evidence exists, but Extension cannot create the terminal bridge transaction | **MISSING** for a complete Extension bridge journey |
 | Android multi-network visibility | Imported wallet with holdings on multiple chains | Native Assets read reports aggregate visible holdings without Metro or a development bridge | **AVAILABLE** |
 
 ## Platform scope

package/library/actions/extension/assets/open_details.mjs

@@ -0,0 +1,30 @@
+import { runAdapter, withExtensionPage } from '../platform/cdp.mjs';
+
+runAdapter(async (input) => withExtensionPage(input, async (page) => {
+  const symbol = String(input.node?.symbol ?? '').trim().toUpperCase();
+  const timeoutMs = Number(input.node?.timeout_ms ?? 30_000);
+  if (!/^[A-Z0-9._-]{2,20}$/u.test(symbol)) {
+    throw new Error('metamask.assets.open_details requires a valid token symbol.');
+  }
+  const selector = await page.evaluate(`(() => {
+    const symbol = ${JSON.stringify(symbol)};
+    for (const [index, row] of [...document.querySelectorAll('[data-testid="multichain-token-list-button"]')].entries()) {
+      const amount = String(row.querySelector('[data-testid="multichain-token-list-item-value"]')?.innerText || '').trim();
+      const observed = amount.match(/\\b([A-Za-z][A-Za-z0-9._-]{1,19})$/u)?.[1]?.toUpperCase();
+      if (observed !== symbol) continue;
+      row.setAttribute('data-mm-harness-asset-index', String(index));
+      return '[data-mm-harness-asset-index="' + index + '"]';
+    }
+    return null;
+  })()`);
+  if (!selector) throw new Error(`Visible asset ${symbol} was not found.`);
+  await page.click(selector);
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() <= deadline) {
+    if (String(await page.evaluate('location.hash')).startsWith('#/asset/')) {
+      return { action: input.action, symbol, proofPath: 'trusted-pointer-visible-ui' };
+    }
+    await page.evaluate('new Promise((resolve) => setTimeout(resolve, 100))');
+  }
+  throw new Error(`Asset details for ${symbol} did not open.`);
+}));