Changelog — vorepo

v1.5 α 2026-05-06 · Wars + Data API + Skills library

Three-feature drop. Repo Wars (weekly battles between 2 quiet repos with 60/30/10 pool split), B2B Data API (Starter/Pro/Enterprise tiers), 1360+ skills library for Claude agent quality. All built on dev overnight, awaits founder review + deploy.

Wars (Repo Battles)

NEW Weekly head-to-head battle: cron picks 2 quiet repos every Monday 00:05 UTC
NEW User opt-in routes 1% of trade fees to active war pool (anti-exploit gates: account ≥14d, email verified, lifetime volume ≥$20)
NEW Pool split 60% charity / 30% winners / 10% Vorepo
NEW Tier rewards: MVP 30 days Plus + Champion's Pick, Podium 14 days Plus, Top 10 $0.50 trade credit, Top 50 $0.15, Top 100 badge
PHASE 1 Charity payout deferred to Phase 2 (after legal review + JDG); 60% pool accumulates in vorepo charity_reserved wallet, charity_tx_signature stays NULL
NEW Public page /wars.html, settle cron Sunday 23:50 UTC

Data API (B2B)

NEW Three tiers — Starter $500/mc (10K req/day, 30d historical), Pro $2K/mc (100K req/day, 90d, webhooks, replay), Enterprise $5K/mc (1M req/day, unlimited historical, per-sector breakdowns)
NEW 7 endpoints: /api/data/{tiers,me,top-100-momentum,csv-export,historical/<ticker>,breakdown/<sector>,webhooks}
NEW Customer portal /api-portal.html — paste key, see usage, browse tiers
NEW Admin: /admin/vorepo/data-api/{issue,usage,revoke/<id>} for manual key management
PHASE 1 Keys issued manually by admin until automated billing wired (Stripe/USDC checkout)

Skills library (1360+)

NEW 12 repositories cloned to /opt/github-repository-exchange/skills/ (gitignored, 93 MB) — anthropic-official, marketing-coreyhaines (40), marketing-openclaudia (64), multi-domain-232 (241), security-trailofbits (74), community-superpowers (14+8), expo-mobile, playwright
NEW SKILLS.md top-level documentation + SKILLS_AUDIT_VOREPO.md with top 50 use cases for Vorepo
NEW Iron rule: every new session reads SKILLS.md and checks for matching skill before writing code

Other improvements

IMPROVED Cache pre-warming cron (_job_prewarm_caches) — every 4 min refreshes /api/stats/public, /api/founders/list, /api/status/uptime, /api/wars/* so users never see cold-start latency (caught 27s cold-start issue 2026-05-05)
IMPROVED Admin /szmal.html gets 2 new sections: Wars dashboard + Data API key management
IMPROVED 50 new unit tests (28 Wars + 22 Data API) → suite 234 → 284 PASS

v1.4 α 2026-05-04 · Plus full bundle + 2FA tier withdrawal

Major security + monetization release. Tiered withdrawal authorization, Plus subscription expanded with 4 new features, custody honest copy locked.

2FA tier withdrawal flow

NEW Withdrawals up to $50 — email confirmation only (as before)
NEW Withdrawals $50–$300 — email + TOTP code (Google Authenticator, Authy, Apple Passwords iOS 18+, or any TOTP app)
NEW Withdrawals $300+ — email + TOTP + 24-hour security delay (Plus subscribers skip the delay)
NEW 10 one-time recovery codes generated on 2FA setup — bcrypt-hashed, shown once
NEW Recovery code endpoint to disable 2FA + regenerate-codes endpoint
Vorepo does not use SMS verification (SIM-swap risk)

Plus full bundle ($4.99/mo, $44.91/year — 25% off annual)

NEW Telegram bot integration — alerts via Telegram in real time
NEW Tax CSV export — annual P&L report with FIFO calculations
NEW Priority withdrawal — skip 24h security delay on $50–$300 withdrawals
NEW Unlimited price alerts (free users still get 3)
NEW Annual subscription endpoint — $44.91 for 365 days
Existing benefits: 50% off fees, unlimited watchlist, 200 items per list, limit/stop orders, gold username, API access 10k req/day

Custody model (Opcja C — locked)

NEW Honest custodial copy on terms.html, security.html, privacy.html, reserves.html — Vorepo holds USDC during trading, multisig hardening in active rollout
NEW Custody architecture will continue to evolve to enhance security and user protection as the platform grows.
Public copy never publishes specific thresholds, dates, or vendor names

Onboarding + retention

NEW Welcome email after email verification — 3-step quick start + optional next steps (2FA, Plus, security)
NEW Onboarding modal on first /portfolio.html visit — 3-step walkthrough with skip option
NEW /how-to-start.html step 06 added — withdrawal security tiers explained
Founding Trader Status cron — first 100 users with 1+ active referee promoted automatically

Pricing engine + Algo MM

FIX Algo MM sell-down phase — adjusts floor from -2% to -3% so positions can rotate, holding window 12h → 6h
FIX Watchdog SOLVENCY_MIN_RATIO 1.05 → 1.00 (eliminated 646 false alerts/24h driven by config drift)
FIX /szmal.html top-10 volume display — replaced star_velocity × price proxy with real volume_24h_usd

v1.3 α 2026-04-30 · Sponsored Listings + de-Toporio sweep

Pay-for-placement infra live, full Toporio brand strip from Vorepo tree (94 files / 9300 lines deleted), trust pages softened to honest beta language.

OpenAPI + Plus pricing fixes

FIX OpenAPI snapshot: 200 → 27 endpoints (stripped Toporio celebrity/wars/agent/tiktok leftovers)
FIX Plus fee discount: backend now applies 50% off on each trade (was advertised but not implemented)
FIX /api/status/uptime real endpoint (was 405, falling back to client-side fake)

Brand purity (de-Toporio)

FIX Removed 31 dead frontend JS files, 8 backend modules, 8 endpoints (claim/wars/fame-index/etc)
FIX User-Agent strings: toporio.com → vorepo.com on Wikipedia/MusicBrainz/Wikidata fetches
FIX Redis namespace toporio: → vorepo: across all modules

v1.2 α 2026-04-27 · Money loop + trust audit

42 commits in one evening. Real money flow E2E verified, full audit pass on pricing engine + custodial transparency.

Money loop (deposit → trade → withdraw)

NEW Solana hot wallet generated, secured (chmod 400), funded with 1 SOL — withdrawal of $5 USDC verified live on chain (TX 34CQRty…JjnMdqa)
NEW Withdrawal email-confirmation flow — 6-digit code sent to user's email, 30-min TTL, balance auto-refunded if not confirmed in time. Replaces the 24h whitelist cooldown.
FIXED auto_consolidate, auto_withdraw, get_hot_wallet_usdc_balance were all reading the wrong env var path or not wrapping USDC_MINT as Pubkey — withdrawals stayed pending forever. Single helper now used everywhere.
NEW Hot wallet auto-creates its USDC ATA on first consolidate. Per-trade impact cap and per-user 24h volume cap added (specifics not published — industry standard).

Pricing engine

FIXED price_24h_ago was seeded once and never rotated — every recompute compounded into the 24h-change calculation. Fixed by rolling the historical reference values from real OHLC on each recompute.
NEW Volume-aware drift cap — quiet tickers move slower than busy tickers, so pure-metric drift is dampened until real volume validates the move.
NEW Circuit breakers wired in scheduler — auto-halt trading when hourly/24h moves cross internal thresholds.
NEW Quote endpoint exposes price_impact_pct + would_be_blocked. Trade form disables Submit when the pending order would breach the impact cap.

Trust + transparency

NEW /security.html + RFC 9116 /.well-known/security.txt ([email protected])
NEW /reserves.html with on-chain custody address + Solscan/Explorer/Solana.fm deep links
NEW Daily proof-of-reserves Merkle snapshot, served by GET /api/proof-of-reserves/latest. Each user can verify their balance is in the published root without seeing other users.
NEW price_source field on every RepoSummary — UI shows ⚠ "metric-implied" pill when the displayed price hasn't been backed by a real trade in >6h.

Admin panel

NEW Standalone admin login — separate admin_users table, separate ADMIN_JWT_SECRET. Public-user JWT never decodes against admin endpoints. Username + password + TOTP, with in-panel password change + authenticator setup.
IMPROVED 8 → 22 admin sections: Hot wallet, Recent deposits/withdrawals/trades, Users, Infrastructure, Cron jobs, Error log, Security monitor, Anti-manipulation, Platform health, Reserve pools.
NEW /api/openapi.json + /docs + /redoc blocked at nginx — admin endpoints + their schemas no longer leak.

Brand + cleanup

IMPROVED BETA tags stripped from 20 pages. Vorepo favicon (mint cube + arrow) on every page (36 pages got <link rel="icon"> for the first time).
FIXED portfolio.html killed its localStorage demo — now reads real holdings from /api/portfolio and trades through /api/trade/sell.
FIXED Synthetic Math.random price-tick simulators in js/app.js and repo-demo.html removed. Charts now move only on real data.
FIXED Removed synthesised "fake votes/pool/winners" placeholder content from inactive feature pages — honest "coming soon" empty state.
IMPROVED CSP, X post copy, TikTok success page, CSV download filenames — all consolidated under vorepo.com.

v1.1 α 2026-04-24 · Live feel sprint

Chart rebuild + 4 new pages + live slippage + watchlist + alerts. 25 commits in one afternoon.

Charts

FIXED OHLC continuity bug — each candle's open now equals the previous close. Zero gaps between bars.
NEW lightweight-charts candlestick series on hero + terminal + equity curve
NEW OHLC legend overlays with crosshair-driven hover values
NEW Real volume histogram (was synthetic high-low proxy)
NEW Moving-average overlays on terminal chart — MA 20, MA 50, Bollinger Bands (toggleable)
NEW Cumulative depth chart under the order book (bids left, asks right)
NEW 12-week commit activity heatmap on every repo page
IMPROVED Sparklines everywhere: Catmull-Rom → Bézier smoothing, per-sparkline gradient, end-point dot

New pages

NEW /compare.html — head-to-head momentum overlay, normalized to entry, 10-metric table
NEW /activity.html — unified live tape (trades + alpha + big moves), auto-refresh 15s
NEW /alerts.html — custom price/velocity thresholds, Browser Notification API wired
NEW /changelog.html — this page

Trading UX

FIXED Quote endpoint 403'd every repo (entity_kind blind on ORM), impact_price always 0. Both paths repaired — real VWAP slip now shown.
NEW Live quote + slippage impact-viz on every slider/input change (debounced 350ms)
NEW Price flash 600ms animation — symbol bar + markets table row cells
IMPROVED Chart auto-refresh synced with orderbook/trades on 30s interval

Portfolio + watchlist

NEW Watchlist — track repos you don't hold; cross-page (star button on terminal, markets row, and portfolio section)
NEW Per-position sparklines in holdings table (parallel-fetched)
NEW Real CSV export — vorepo-trades and vorepo-holdings timestamped downloads

Admin + status

NEW Admin analytics panel — 30d active repos, 24h API calls, top 10 volume bars
NEW Status latency section — p95 response time + requests/minute

Platform

NEW Global alert badge — pill in top-right of every page, shows triggered count
NEW Interactive break-even calculator on /pricing.html
NEW Search results in vorepo topbar now show mini-sparklines per hit
NEW Alpha signals get per-card 24h spark + 2σ/3σ/4σ severity colour
NEW Leaderboard: per-trader 30d equity curve on podium + row
FIXED Orderbook 500 on depth ≥ 10 — md5 seed pool was shorter than requested. Chained hash extends it.
IMPROVED Consistent top nav across all pages (Markets · Trade · Compare · Activity · Portfolio · …)

2026-04-24 · Pre-launch

First public alpha. 15 pages, 22 API endpoints, live at vorepo.com.

Trading terminal

NEW Binance-style 3-column layout — chart · order book · trade panel
NEW Real candlestick chart via lightweight-charts.js (TradingView engine)
NEW 5 timeframes: 15m · 1H · 4H · 1D · 1W
NEW Synthetic order book seeded from mid-price (not tradable, visualisation-only)
NEW BUY/SELL segmented trade panel with 25/50/75/100% quick sliders

Pages

NEW / — exchange landing with ticker tape, hero chart, alpha signals, markets table
NEW /portfolio.html — equity curve + holdings + P/L + trade history
NEW /leaderboard.html — top-50 traders with podium + full ranking
NEW /pricing.html — 3-tab (Trading fees / Plus / API tiers)
NEW /docs.html — API reference with 12 endpoints + curl examples
NEW /about.html — story, 4 principles, timeline
NEW /how-to-start.html — 5-step onboarding + 6 rookie tips
NEW /status.html — system health + 90-day uptime bars
NEW /terms.html · /privacy.html · /risk.html · /disclaimer.html — full legal docs (draft, pending counsel)

Platform UX

NEW Cmd+K global command palette — live search across tickers + pages
NEW Chat AI assistant — floating widget on every page, rule-based + Anthropic-ready
NEW Mobile hamburger drawer — slides from right < 900px
NEW PWA manifest — "Add to Home Screen" on iOS / Android
NEW Category + sort filter tabs on markets table

Backend

NEW 22 public API endpoints (markets, search, chart, orderbook, quote, trade, signals, stats, trades, CSV)
NEW Admin console with 6 endpoints (dashboard, scrapers, quota, suggestions, scrape, approve/reject)
NEW Alpha Signals — 2σ velocity filter with mean/stddev/threshold transparency
NEW /api/chat — rule-based responder with 14 topic rules + Anthropic fallback
IMPROVED PostgreSQL schema — 5 new vorepo tables via migration 001 (RepoSuggestion, StargazerTrust, ListingBond, GithubApiQuota, AutoHealLog)

Infrastructure

NEW systemd service ghex-dev.service active on :8005
NEW 152 curated repos seeded (9 categories: web, ai-ml, systems, tools, data, crypto, security, gamedev, education)
NEW Dockerfile + compose.yaml (Postgres 16 + Redis 7 + app)
NEW GitHub Actions CI — offline checks + integration with real DB

Product changelog