kira-wallet 0.1.0 → 0.1.3

package/README.md

@@ -1,116 +1,135 @@
-# Kira Wallet
+<p align="center">
+  <img src="https://raw.githubusercontent.com/realproject7/kira-wallet/v0.1.2/viewer/static/kira-explain.png" width="140" alt="Kira, your wallet research partner">
+</p>
 
-A local EVM wallet research workspace with Kira and durable research jobs.
-It records direct holdings, Mint Club bonding curves and DEX liquidity evidence.
-Missing coverage and prices stay unknown.
+<h1 align="center">Kira Wallet</h1>
+<p align="center"><strong>Manage your wallets. With your own AI.</strong></p>
+<p align="center">
+  <a href="https://kirawallet.app">Website</a> ·
+  <a href="https://github.com/realproject7/kira-wallet/releases">Releases</a> ·
+  <a href="docs/CLI.md">CLI guide</a>
+</p>
 
-Original code and character assets are open source under MIT. Third-party
-references retain their own terms; see [notices](THIRD_PARTY_NOTICES.md). The npm
-first npm publication is prepared for the operator. No signing, transfers or trades
-are implemented.
+Bring the AI you already use to your wallets. Add public wallet addresses, see
+what you hold across supported EVM chains, and ask Kira to research your tokens
+or refresh your holdings. Kira runs on your computer and uses your existing
+Codex or Claude Code account.
 
-## Local installation
+![Kira portfolio overview with network allocation and research priorities](docs/screenshots/kira-readme-overview.jpg)
 
-Requirements: Node.js 22 or newer and Python 3.11 or newer. macOS is verified.
-Analysis and daemon lifecycle currently require POSIX process and file-lock APIs.
+## Get started
+
+**Requires Node.js 22+ and Python 3.11+. macOS is verified.** The research and
+background-process features require a POSIX environment.
+
+Install Kira:
 
 ```sh
-npm install --ignore-scripts
-node bin/kira.cjs init
-node bin/kira.cjs doctor
-node bin/kira.cjs setup
+npm install -g kira-wallet
+kira setup
 ```
 
-The viewer starts at http://127.0.0.1:8787. Data defaults to
-`~/.local/share/kira-wallet`, separate from the installed package. Use
-`--data-dir /absolute/private/directory` before the command for another portfolio.
-The existing workspace viewer can still run at port 8765.
+Open the local app at [127.0.0.1:8787](http://127.0.0.1:8787).
 
-For an isolated sample with synthetic data:
+After your first setup, open Kira with:
 
 ```sh
-node bin/kira.cjs --data-dir /tmp/kira-sample demo --port 8790
-node bin/kira.cjs --data-dir /tmp/kira-sample stop
+kira start
 ```
 
-## Research
+It starts your local app and opens the browser. Use `kira stop` to stop it.
+For a viewer without wallet or research actions, use `kira start --read-only`.
+
+Prefer an archive? [GitHub releases](https://github.com/realproject7/kira-wallet/releases/tag/v0.1.2)
+include the same package and its checksum.
+
+1. **Add a watching wallet.** Paste a public address and give it a name. Add more
+   wallets whenever you need them.
+2. **Set up discovery.** In **Workspace settings**, connect an indexer for broad
+   ERC20 discovery. Public RPC alone has limited discovery; incomplete coverage
+   stays visible.
+3. **Connect your AI.** Install and sign in to the
+   [Codex CLI](https://developers.openai.com/codex/cli) or
+   [Claude Code](https://code.claude.com/docs/en/quickstart), then choose your
+   account from **Connect a model** in Kira Chat. Select one wallet or your whole
+   portfolio, test the connection, and choose whether to allow research tools.
+4. **Ask Kira.** Start with a question, or ask it to refresh a wallet's holdings
+   or prices. Follow the job in **Activity** while it runs.
+
+Want to look around first? Try the demo:
 
 ```sh
-kira add <operator-supplied-address> --tag '<exact tag>'
-kira refresh '<registered address or tag>'
-kira prices '<registered address or tag>'
+kira --data-dir /tmp/kira-demo demo --port 8790
 ```
 
-From source, substitute `node bin/kira.cjs` for `kira`. Commands create private
-runtime data. The viewer detects local updates within five seconds; it does
-not poll providers. Resume a failed analysis with the same command and
-`--resume <relative snapshot directory>`.
+Open [127.0.0.1:8790](http://127.0.0.1:8790). Stop it with
+`kira --data-dir /tmp/kira-demo stop`.
+
+## What can I ask?
+
+- “Which chains do I have ETH worth $10 or more on?”
+- “Find tokens I may have overlooked. Show their quantity, recorded price,
+  market venues and any available full-balance exit quote.”
+- “Review my Blast holdings across all my wallets. What is known, and where
+  is coverage missing?”
+- “Compare my saved analyses. What changed?”
+- “Refresh prices for my daily wallet, then tell me what the job actually found.”
+
+Kira can read approved records, compare saved analyses, and start holdings or
+price research when you enable its wallet tools. It distinguishes recorded spot
+value from an execution quote. Missing prices and holdings stay unknown;
+transfer inactivity needs transfer-history evidence. Testnets and pool liquidity
+are excluded from your portfolio's USD value.
 
-The engine checks official Mint Club deployment scope, discovers indexed held
-tokens when configured, pins chain reads to blocks, enumerates reachable bond
-registries, queries ERC20 and registered ERC1155 token ID 0 balances, records
-curve reserves and burn quotes, and verifies supported DEX pool contracts.
-Shared caches contain asset identities, never another wallet's balances.
-Registry publication is atomic and analysis writers are serialized.
+![USDC markets and balances by wallet with matching Kira analysis](docs/screenshots/kira-readme-markets.jpg)
 
-Public RPC can read native balances, known tokens and reachable bond registries.
-General ERC20 discovery requires an indexed provider and successful responses.
-Testnets, pool TVL and shared curve backing are excluded from wallet USD totals.
-Spot value is distinct from an executable redemption estimate.
+*Markets, paired token logos and each wallet's balance in one view.*
 
-See [CLI and provider configuration](docs/CLI.md) and
-[viewer behavior](viewer/README.md). Development reports, design concepts and
-generation records remain in the source checkout under `docs/` and `prototype/`.
+## Your wallets, your controls
 
-## Verification
+- **Watch an existing wallet** using its public address. Watching does not grant
+  Kira permission to spend.
+- **Create an OWS wallet** with **Create wallet** in the sidebar, powered by
+  [Open Wallet Standard](https://openwallet.sh/).
+  Enter the encryption passphrase in the local form. Kira connects the public
+  EVM account; keys stay in the local OWS vault.
+- **Choose what AI can see.** Wallet access can be off, limited to one wallet,
+  or cover your portfolio. Approved context is sent through your selected
+  native CLI and model account. Their data policies still apply.
+- **Keep records locally.** No Kira account or hosted portfolio database is
+  required. Chat drafts stay in memory; saving Kira chat history is opt-in.
+
+Chat currently handles research and wallet records. Signing, transfers and trade
+execution are not implemented. [Wallet onboarding details](docs/CLI.md#browser-and-local-ows-wallets).
+
+## Useful commands
+
+```sh
+kira add <public-address> --tag 'Daily wallet'
+kira refresh 'Daily wallet'
+kira prices 'Daily wallet'
+kira status
+kira stop
+```
+
+Data defaults to `~/.local/share/kira-wallet`, separate from the installed
+package. Use `--data-dir /absolute/private/directory` before a command to choose
+another workspace. For connection, model or provider help, see the
+[CLI guide](docs/CLI.md) and [viewer guide](viewer/README.md).
+
+## Build and contribute
 
 ```sh
+npm install --ignore-scripts
+node bin/kira.cjs setup
 npm test
-node --check pipeline-onchain.cjs
-node --check onchain.cjs
+python3 scripts/check-public.py
 ```
 
-UI changes also require responsive browser and keyboard checks. Installation
-checks must use a fresh directory without operator credentials or data.
-
-## Durable local workspace
-
-Development build 0.1.0-dev.2 adds persisted research jobs and opt-in protected
-browser controls. Start with `kira start --controls`; the usual start stays
-read-only. CLI and browser use the same typed job service for research, exact
-wallet names and connection references. Jobs preserve prior results, retain
-partial evidence and require explicit interruption recovery. Price jobs keep
-immutable overlays. Saved analyses can be compared with exact decimal balance
-changes and missing records remain unknown.
-
-`kira tools` is a read-only local MCP adapter, with no automatic account or
-model connection. See [CLI usage](docs/CLI.md), [job contract](docs/JOB_CONTRACT.md),
-[tool setup gate](docs/AGENT_TOOLS.md) and [continuation evidence](docs/KIRA_JOBS_BUILD_REPORT.md).
-
-## Kira research workspace
-
-The workspace places Kira's local briefing and connected conversation
-beside the evidence. The brand link returns Home. Overview, All tokens
-and Activity have distinct tabs; wallet controls stay together. On small
-screens, switch directly between Portfolio and Kira.
-
-All tokens uses existing recorded aggregates with chain-plus-contract identity,
-search, network and pricing filters, and 50 rows per page. It does not query
-providers. Activity separates active work from persisted job history and shows
-state, elapsed time, last progress and recovery controls. Missing progress does
-not silently turn a running job into a completed or failed job.
-
-Run `kira setup` to connect your installed Codex or Claude Code CLI account.
-Choose no wallet context, one registered wallet or the whole portfolio. A real
-response check verifies the selected model before permissions are saved. Drafts
-stay in memory. Kira-local conversation retention is opt-in; provider and native
-CLI policies remain separate. Context or model changes start a fresh conversation.
-Chat does not sign, trade or automatically start research. See the
-[onboarding and conversation contract](docs/ONBOARDING_CHAT_CONTRACT.md), the
-[redesign report](docs/KIRA_REDESIGN_REPORT.md) and
-[agreed wallet capability direction](docs/WALLET_CAPABILITIES.md).
-
-For a contribution, use synthetic data and run `python3 scripts/check-public.py`
-before a push. Never attach a personal portfolio screenshot, registry, snapshot,
-job, credential, local path or log to an issue or PR. Repository history uses a
-public noreply identity. The `kira-workspace-v1` tag preserves the prior UI.
+From source, use `node bin/kira.cjs` in place of `kira`.
+[Local AI tool setup](docs/AGENT_TOOLS.md) ·
+[Release preparation](docs/RELEASE.md).
+
+Original code and Kira character assets are available under the [MIT license](LICENSE).
+Third-party artwork and references retain their own terms; see
+[Third-party notices](THIRD_PARTY_NOTICES.md).

package/THIRD_PARTY_NOTICES.md

@@ -11,3 +11,20 @@ license does not relicense them.
   [Mint Club](https://github.com/Steemhunt/mint.club-v2-contract).
 - Installed dependencies retain their package licenses. Remote token and chain
   artwork is referenced from its provider; the app does not claim ownership.
+- Native coin prices and artwork reference [CoinGecko market metadata](https://docs.coingecko.com/reference/coins-markets).
+  Provider availability and rate limits apply. Artwork belongs to the respective projects.
+
+Open Wallet Standard Node SDK (`@open-wallet-standard/core` 1.4.3) and its
+optional platform bindings are distributed under MIT by their upstream owner.
+The SDK is an optional dependency used for human-submitted encrypted wallet
+creation and public account listing. See
+[Open Wallet Standard](https://github.com/open-wallet-standard/core).
+
+The official Open Wallet Standard wordmark in `viewer/static/ows-logo.svg` and
+`site/assets/ows-logo.svg` is copied unchanged from
+[openwallet.sh](https://openwallet.sh/footer-logo.svg). CSS displays its original
+white artwork in black on light backgrounds. The mark belongs to its owner and
+identifies the OWS wallet-creation integration without implying endorsement.
+Its retrieval date and source digest are in `site/assets/ows-artwork-source.json`.
+
+CASHCAT, BLAST and USDB artwork in the public reconstructed demo comes from lpTOKEN.fun token metadata, DEX Screener and CoinGecko. Token marks belong to their respective owners and identify the assets without implying affiliation or endorsement. The source URLs and chain-specific contract identities are recorded in `site/assets/token-artwork-sources.json`.

package/curve_pricing.py

@@ -17,11 +17,15 @@ def resolve(graph, prices):
         if key in seen:return None
         existing=known.get(key)
         node=nodes.get(key)
-        if existing and existing.get('usd') is not None and existing.get('quality')!='unreliable':
+        unfunded=node and not node.get('error') and node.get('is_curve') and node.get('funded') is False
+        if existing and existing.get('usd') is not None and existing.get('quality') not in ('unfunded','unreliable') and (existing.get('basis')!='Curve spot' or not unfunded):
             cache[key]=existing;return existing
         if not node or node.get('error') or not node.get('is_curve'):return None
         if not node['funded']:
-            return {'chain_id':key[0],'address':node['address'],'usd':None,'basis':'Curve spot','quality':'unfunded'}
+            record={'chain_id':key[0],'address':node['address'],'usd':None,'basis':'Curve spot','quality':'unfunded',
+                    'curve_reserve':node.get('curve_reserve'),'source':node.get('source'),
+                    'observed_at':node.get('observed_at'),'block_number':node.get('block_number')}
+            cache[key]=record;return record
         parent=visit((key[0],node['reserve_token'].lower()),seen|{key})
         if not parent or parent.get('usd') is None:return None
         usd=float(node['price_in_reserve'])*parent['usd']

package/docs/AGENT_TOOLS.md

@@ -24,30 +24,39 @@ args = ["--data-dir", "<private-portfolio>", "tools"]
 Replace the placeholder locally. Do not commit portfolio paths or credentials.
 Kira does not edit the operator's Codex configuration automatically.
 
-## Account connection gate
-
-The browser's Kira notes remain deterministic. Connected chat, OAuth handling
-and conversation reconnect are not delivered by this adapter.
-
-Before connecting a Kira-owned model session, the operator must select the
-account/authentication route and approve which portfolio facts may reach the
-model. The current official ChatGPT-plan app-server guide describes an app-owned
-OAuth access token, Responses provider configuration and token renewal. It does
-not establish this account's eligibility. Client registration, consent and
-login are operator actions. Do not copy desktop authentication files or use the
-internal-only external ChatGPT-token schema variant. No billing claim follows
-from a tool handshake or model catalog.
-
-After the gate, implement the selected auth route and app-server session driver
-with saved thread IDs, terminal turn states, reconnect and interruption. Keep
-those states distinct from engine jobs. Pin the installed protocol again and
-independently review permissions before connecting real private data.
-
-Sources checked on 2026-10-03:
-
-- [Official Codex app-server guidance](https://developers.openai.com/siwc/token-sharing-open-source/codex-app-server)
-- [Official Codex MCP guidance](https://learn.chatgpt.com/docs/extend/mcp?surface=cli)
-- [MCP stdio transport contract](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports)
-
-Local verification uses synthetic portfolios and a stdin transcript only.
-It does not verify a live Codex/MCP client connection or model access.
+## Connected Kira chat
+
+The in-app conversation uses a supported installed Codex or Claude CLI account.
+A generic response check is required before saving a selected provider, model,
+wallet scope and research permission. It sends no wallet facts. Authentication
+stays with the installed CLI. No desktop tokens or authentication files are copied.
+
+With research enabled, a bounded host-mediated loop provides portfolio_read,
+wallet_read, token_read, snapshots_list, snapshot_read, snapshots_compare,
+job_list, job_read, holdings_refresh and prices_refresh. Every operation is
+scoped to registered wallets allowed by the conversation. Historical reads use
+normalized financial projections. Unknown values and historical quote times
+remain explicit. Native shell, file, browser and MCP execution stay disabled.
+
+Chain evidence includes explicit native balances, including observed zero,
+their observation times and blocks, and registry scan blocks. Empty positive
+holding inventories do not remove these observations. Saved-analysis reads
+also retain snapshot price-reference values and times without provider URLs
+or debug fields. A comparison flag can reflect observation or reference changes
+without proving a balance change or a different set of checked networks.
+Research job reads include the approved wallet identity directly.
+
+Refresh tools admit typed durable engine jobs. Current scope and cancellation
+are checked immediately before admission. Queued work is visible in Activity;
+chat cancellation does not cancel engine work already accepted. Duplicate
+refresh requests within one turn reuse the same job. At most eight tool calls,
+420 seconds and bounded context are permitted per turn. Existing configurations
+keep their research permission off until explicitly enabled.
+
+OWS create/list and browser wallet connection are human interfaces, not model
+tools. The agent never receives passphrases, mnemonics, private keys or provider
+credentials. Messages and approved wallet facts reach the selected model service
+through the user's CLI; local storage does not imply an offline model.
+
+See [the conversation contract](ONBOARDING_CHAT_CONTRACT.md).
+The standalone stdio MCP adapter above remains read-only and separate.

package/docs/CLI.md

@@ -1,21 +1,57 @@
 # CLI and provider configuration
 
-The npm package carries the Python engine, browser assets and declared viem
+The package carries the Python engine, browser assets and declared viem
 dependency. It needs no Python packages and no sibling project. The package
 file list excludes wallets, snapshots, conversations, caches, logs and private settings.
-The first release is prepared as a tarball. Registry publication remains an
-operator action. The code and original character assets use the MIT license.
+Install Kira from npm, then run `kira setup`:
+
+```sh
+npm install -g kira-wallet
+kira setup
+```
+
+The npm registry currently offers version 0.1.2. The same archive and checksum
+are available from the [GitHub release](https://github.com/realproject7/kira-wallet/releases/tag/v0.1.2).
+Registry publication remains an operator action. The code and original character assets use the MIT license.
 
 ## Lifecycle
 
-`kira init` prepares an empty private data directory. `kira start --port 8787`
-starts a loopback-only read-only viewer. `kira status` identifies the managed
-instance. `kira stop` checks its live instance ID and OS process identity.
+Use `kira setup` for your first setup. For everyday use, `kira start` starts
+the local app with browser controls and opens it in your browser. The default
+port is 8787. Use `--port` to choose another port, or `--no-open` to print the
+URL without opening a browser. `kira status` identifies the managed instance.
+`kira stop` checks its live instance ID and OS process identity before stopping it.
+
+`kira init` prepares an empty private data directory. `kira start --read-only`
+starts a loopback-only viewer without wallet or research actions.
 Another portfolio never silently reuses that server.
 
 `kira setup` starts the loopback viewer with local controls and opens its setup
 screen. Use `--no-open` to print its URL instead. If a read-only viewer is already
-running, stop it explicitly before setup. The normal `kira start` remains read-only.
+running, stop it explicitly before setup or a normal start. Changing between
+read-only and control modes requires an explicit stop and restart. Starting
+an already-running app in the same mode reuses its URL. The old `--controls`
+option remains accepted for existing scripts but is no longer needed.
+
+These startup defaults apply from 0.1.3. In the published 0.1.2 package, use
+`kira setup` or `kira start --controls` for the full app.
+
+The 0.1.2 GitHub release starts with a wallet checklist. Add a public EVM
+address or use the browser wallet picker. Registration starts one explicit
+research job; follow it in Activity and read the saved portfolio report.
+No signature, seed phrase or private key is needed.
+
+Public RPC checks known assets and Mint Club. For broader ERC20 discovery,
+open Research connections, select Alchemy and name the private environment
+variable holding its key. Never paste the key into the browser. `kira doctor`
+checks whether the configured key is available. Configuration alone does not
+prove complete coverage; inspect the recorded results and gaps.
+
+Connecting Codex or Claude is optional. Use Connect your AI when ready, verify
+a generic response and explicitly choose context permissions. Assistant answers
+render a safe Markdown subset; raw HTML, images and links remain inert text.
+Install the 0.1.1 GitHub archive for this wallet-first setup. The npm registry's
+0.1.0 package continues to use the earlier account-first setup.
 
 ## Your model account
 
@@ -41,7 +77,7 @@ Kira-local history is opt-in and uses private `conversations/` files. With histo
 off, conversations and drafts stay in memory. A new server process starts a fresh
 conversation; saved files remain available locally and are not automatically
 replayed. Native CLI, administrator policy and provider data policies remain a
-separate trust boundary. Chat cannot sign, trade or automatically start research.
+separate trust boundary. With wallet research enabled, Kira can read saved analyses, compare history and queue holdings or price updates. Jobs appear in Activity and continue independently of chat. Signing and trading stay outside the agent.
 See [the conversation contract](ONBOARDING_CHAT_CONTRACT.md).
 
 Global `--data-dir` precedes the command. `KIRA_DATA_DIR` provides the same
@@ -80,10 +116,7 @@ kira discovery alchemy --key-env ALCHEMY_API_KEY --explorers
 kira config show
 ```
 
-Custom mode disables public fallback by default. Add `--public-fallback` to
-explicitly enable it. That preference applies to all custom-mode chains.
-Chains without a configured endpoint remain unavailable while fallback is
-disabled. Plain HTTP is accepted only for loopback endpoints.
+Public fallback is automatic for new configurations. A missing or failing custom endpoint uses verified public endpoints, including failures after the initial connection. Reads keep the selected block. `--custom-only` explicitly disables fallback; an existing opt-out is preserved. `--public-fallback` restores it. Plain HTTP is accepted only for loopback endpoints. Public RPC does not provide complete ERC20 discovery.
 
 Discovery is independent. Without an indexer, native and reachable Mint Club
 reads still run and general discovery stays incomplete. Configuring an RPC
@@ -129,9 +162,9 @@ cancelled jobs retain their last good result and unpublished evidence.
 interrupted jobs. Price jobs retain immutable overlays before updating the
 viewer projection. A viewer stop does not cancel research jobs.
 
-Start with `kira start --controls` to enable protected browser actions. The
-usual start remains read-only. Stop an existing read-only instance before
-starting one with controls. Actions need the local session and same origin.
+Start with `kira start` to use protected browser actions. Use `--read-only`
+for a viewer without those actions. Stop an existing instance before switching
+modes. Actions need the local session and same origin.
 The supported URL uses 127.0.0.1. Browser controls offer wallet registration,
 exact names, holdings/price refresh, cancel/resume, saved analysis comparison,
 RPC references and discovery references. The synthetic demo cannot start
@@ -140,5 +173,29 @@ secrets and URLs remain outside the browser.
 
 Use `kira --data-dir <private-portfolio> tools` for the read-only stdio adapter.
 See [the tool guide](AGENT_TOOLS.md) and [job contract](JOB_CONTRACT.md).
-Connected chat still requires the operator's account setup and a later session
-integration. The local development package remains private and unlicensed.
+Connected chat uses the native CLI account and approved context from setup.
+The published package and original Kira assets are MIT licensed.
+
+## Browser and local OWS wallets
+
+Use **Connect wallet** to choose an EIP-6963 browser wallet such as MetaMask.
+The app shows the provider and public accounts, lets you review the account
+before registering it, and provides **Disconnect from Kira**. Disconnecting does
+not remove recorded wallets or revoke extension permissions. Without a browser
+wallet, the chooser explains how to open this same local URL in a compatible
+browser. A phone cannot reach another computer's loopback URL.
+
+**Local OWS wallet** lists public EVM descriptors from Open Wallet Standard.
+The optional pinned SDK is `@open-wallet-standard/core` 1.4.3. The vault defaults
+to `~/.ows`; `KIRA_OWS_VAULT` selects another local vault. Creating a new wallet
+requires a human-entered encryption passphrase and uses OWS's encrypted local
+storage. Kira never returns the mnemonic or private key. Back up and recover
+with OWS owner tools. Existing keys and tags are preserved.
+
+A private owner receipt serializes creation across apps using the same vault.
+Retrying an interrupted creation recovers its request identity instead of
+creating a second wallet. The browser keeps only the public request identity
+in session storage. It clears password fields immediately. Recovery keeps the
+original encryption passphrase. No signing, key export or account deletion
+endpoint is exposed. OWS absence does not block ordinary address or browser
+wallet onboarding.

package/docs/KIRA_LIVE_QA.md

@@ -0,0 +1,154 @@
+# Local live acceptance, 2026-10-05
+
+The operator requested thorough local product testing while npm publication
+remained unavailable. Testing used a separate empty workspace, the supplied
+public watching address, a separate disposable encrypted OWS vault, configured
+research providers and the installed native Claude CLI. Existing operator
+workspaces and their conversations were preserved.
+
+## Real agent questions
+
+Ten questions completed with real native model calls. One additional real turn
+was deliberately stopped through the UI. The connection test is separate from
+this count. No fixture response was substituted for a live answer.
+
+| Case | Request | Observed result |
+| --- | --- | --- |
+| 1 | Research progress while the first wallet is still being scanned | Distinguished pending work from saved results and unknown balances. |
+| 2 | Newly created wallet state and available actions | Found an incorrect duplicate-name explanation for an unregistered queued wallet. Fixed the lookup error. |
+| 3 | Recheck wallet identity and native ETH by chain | Corrected the duplicate-name claim. Kept native ETH separate from ERC20 assets and testnets. |
+| 4 | Dormant tokens, market prices, pools and possible sale proceeds | Returned dated balances, prices and recorded burn outputs. Did not invent inactivity or executable DEX quotes. |
+| 5 | Blast mainnet versus Blast Sepolia | Kept networks and wallets separate. Did not infer ownership of popular tokens missing from the record. |
+| 6 | LP ownership versus market links | Identified distinct unpriced token contracts without inventing LP redemption. Exposed an incorrect retraction caused by omitted market details. |
+| 7 | Read specific token market details again | Verified recorded, displayed and omitted pool counts. Corrected the summary/detail misunderstanding after the projection fix. |
+| 8 | Queue exactly one holdings refresh | Created one real durable job. Reported queued/running status without claiming it had already completed. |
+| 9 | Verify the final publication and compare saved analyses | Located the published snapshot. Exposed ambiguous interpretation of coverage metadata and ERC20 versus native RPC checks. |
+| 10 | Recheck ERC20 discovery versus native RPC coverage | Corrected the coverage interpretation and identified unknown native balances. Both snapshots retained the same per-chain completeness/availability flags. |
+
+These were not uniformly correct on the first attempt. Cases 2, 6 and 9 drove
+implementation changes and follow-up questions. Case 10 still described the
+exact cause of metadata differences as a possibility rather than using the
+comparison definition; its per-chain conclusion matched the records. Model
+answers remain interpretations of recorded evidence.
+
+## Second question round
+
+Ten additional Korean questions completed through the real native Claude CLI.
+All ten received answers without a transport or model-process failure. This
+does not mean every initial answer was factually correct. No new research job,
+wallet, signature or trade was requested by this round.
+
+| Case | Request | Observed result |
+| --- | --- | --- |
+| 1 | Mainnet totals, priced/unpriced counts and testnet exclusion | Counts and totals matched. Native observation times were missing from the supplied projection. |
+| 2 | Same-symbol LP tokens and recorded market routes | Kept distinct contracts and quantities separate. Did not infer LP ownership or redemption from a market link. |
+| 3 | Dormant tokens and full-balance disposal | Did not invent transfer history, inactivity or executable dollar proceeds. Preserved historical burn outputs. |
+| 4 | ETH, WETH, Blast mainnet and Blast Sepolia | Kept identities, quantities and valuation scope separate. Exposed the same missing native observations. |
+| 5 | Compare two saved analyses | Incorrectly described changes as timestamps only and treated an empty positive inventory as missing native evidence. |
+| 6 | Verify the comparison flags | Corrected the flag interpretation, but normalized reads still omitted native observations and underlying reference values. |
+| 7 | Read an unregistered wallet name | Returned wallet_not_registered. Did not substitute another wallet or invent a duplicate-name problem. |
+| 8 | Detailed stablecoin markets and best exit | Distinguished recorded/displayed/omitted pools, quote-token prices and absent execution quotes. |
+| 9 | Wallet-specific ERC20 discovery versus native RPC | Correctly separated coverage flags and known holdings from unknown networks. Native observation times remained omitted. |
+| 10 | Chat capabilities and actual research completion | Correctly reported published partial jobs and unsupported creation/trading tools. Job-to-wallet identity required inference because the field was omitted. |
+
+The follow-up fix includes explicit native balance observations, their times
+and blocks, registry scan blocks and safe snapshot price-reference values.
+An observed zero remains evidence without becoming a positive holding or
+changing portfolio totals. Unavailable RPC balances remain null. Reference
+source/debug fields remain excluded, including for mixed-case cbBTC references.
+Scoped research job reads now name their approved wallet explicitly.
+
+Two additional real questions verify the fix. One continued the original chat
+and checked observations, reference changes and job identities. A separate
+fresh-conversation test repeated the saved-analysis question without older
+answers. Both returned the recorded zero/unknown distinction and correct
+block/reference changes. The continued-chat check also matched every explicit
+job-to-wallet identity. These verification questions are separate from the ten-case count.
+Raw responses, original failures and financial evidence remain private.
+
+The final regression suites passed 94 root Python tests and 46 viewer Python
+tests, plus the declared Node and syntax checks. Two independent read-only
+reviews checked the final projection delta. Their mixed-case reference finding
+was corrected and rechecked.
+
+## Wallet and research flows
+
+- Added the exact operator-supplied watching address through the real form,
+  review step and submission. The research job published after 4m 55s.
+- Created a real encrypted wallet with the pinned OWS SDK through the protected
+  local creation endpoint. The disposable passphrase was generated in memory.
+  Replaying the same creation identity recovered the same wallet and job.
+  No plaintext passphrase was found in the test workspace files.
+- Checked the creation UI and required password validation. No new credential
+  was entered through browser automation. Human passphrase entry remains a
+  separate device acceptance step.
+- Exercised OWS disconnect, existing-wallet selection and public-account
+  relinking through the UI. These preserved the existing registered wallet.
+- The new-wallet research and agent-requested refresh each published after
+  roughly 37 seconds. Both retained coverage gaps. Three real research jobs
+  were saved, with no duplicate refresh admission.
+- Opened both saved analyses and ran the actual comparison UI. Missing records
+  remained unknown. Coverage observations and price references were separate
+  from token balance changes.
+- Tested a fresh unregistered-wallet deep link. It now opens Activity instead
+  of an empty or stale wallet panel.
+
+## UI and design checks
+
+Real browser checks covered Overview, watching and newly created wallet pages,
+All tokens, Activity, token and network details, research notes, settings,
+OWS forms, chat history, new chat, expanded chat and the mobile pane switch.
+The actual browser sizes were 1728 by 941 and 537 by 941. The automation viewport
+setting did not produce 390px, so phone-sized device acceptance is not claimed.
+
+The catalog retained unpriced assets, supported testnet inclusion, reset search
+pagination, paged after 50 rows and showed an explicit no-results state.
+A token with many markets showed two pools initially and exposed all remaining
+routes through disclosure. Token artwork loaded for the previously missing
+contract. Token-specific wallet rows measured about 170px with a position and
+107px without one. Neither browser width had page-level horizontal overflow.
+
+The chat header, separate floating composer and background remained aligned.
+Opening hidden mobile chat now follows the latest answer. Switching away and
+back preserves an existing reading position. Clicking the already-active pane
+and resizing the composer do not discard that position. Draft text survived
+page navigation. Deliberate Stop returned an editable draft and no late answer.
+Research notes currently open as the plain Markdown export in another tab.
+
+## Fixes delivered
+
+1. Allow exact-host top-level navigation to the public HTML shell from a link.
+   Cross-site API, session, asset and mutation access remain rejected.
+2. Distinguish an absent wallet from multiple wallets sharing a name.
+3. Route missing/pending wallet details through Activity, including initial
+   state polling.
+4. Refresh custom dropdown labels after loading saved connection settings.
+5. Keep code spans opaque inside Markdown emphasis, including literal stars.
+6. Preserve recorded pool counts and summary notes in scoped agent reads.
+   Explain that omitted detail is available through a token-specific read.
+7. Display registered OWS names or pending connection tags instead of internal
+   creation identities, without changing wallet IDs or SDK names.
+8. Clarify empty holdings, ERC20 discovery versus native RPC availability, and
+   timestamp/block changes in comparison evidence.
+9. Follow the latest mobile answer initially while preserving historical
+   reading positions through pane switches and composer resizing.
+10. Retain scoped native zero/time/block observations and safe historical
+    price-reference evidence for accurate saved-analysis comparisons.
+11. Name the approved wallet in research job reads instead of requiring
+    inference from blocks or receipts.
+
+## Verification and release boundaries
+
+`npm test` passed: 94 root Python tests, 46 viewer Python tests, all declared
+Node suites and syntax checks. Independent backend and frontend reviewers
+rechecked the final functional deltas. Their findings were fixed and verified.
+A clean 71-member installation passed, including real encrypted OWS creation
+with the pinned SDK and the installed viewer lifecycle. Package privacy checks
+run before packing; the candidate manifest records the exact reviewed source commit.
+
+The new candidate is 0.1.2. GitHub v0.1.1 and its archive remain immutable.
+npm latest was still 0.1.0 when checked during this run. No registry publication,
+PR merge, direct default-branch push or production deployment was performed.
+Private screenshots, transcripts, wallet addresses and financial observations
+remain outside the public source and package. The test vault received no funds,
+and no signing or trading was performed.