[jim-counter]

Closes out the two remaining §2 items from #30.

§2.2 — release-verification runbook (docs/release-verification.md)

The manual testnet round-trip is the only way to validate the Autonomys SDKs and contracts by value — they're trusted black boxes, so the audit confirmed the app passes them correct, exact-precision arguments but not what they do internally. The doc is a copy-pasteable checklist covering wrap, unwrap, and both XDM directions on Chronos testnet (no real funds), each with "confirm the exact amount and destination on the explorer" steps. It also records the automated checks and the standing fund-safety invariants in one place.

§2.3 — tx-input invariant tripwire (test/tx-input-invariant.test.ts)

Fails if any transaction-submission file — pages/xdm/send.tsx, pages/wrap.tsx, components/SendForm.tsx — starts reading URL query params (router.query / useSearchParams / window.location.search). That's the most likely way the "no transaction input from external data" invariant would regress (e.g. a "prefill recipient from a shared link" feature wiring a param into the form).

Honest scope: it targets the URL-param vector — a smell test, not a proof. Indexer/RPC-sourced inputs still need to be caught in review. The test comment and the doc both say so, and both say re-audit, don't just delete the check if it fires on an intentional change.

Validation

• npm test → 7 passed / 6 skipped (the 3 new tripwire cases pass against current code).
• Tripwire regex sanity-checked both ways: matches router.query / useSearchParams / window.location.search; ignores the router.push and new URLSearchParams(...) idioms the app already uses.
• npm run lint clean; npm run build exports cleanly.

Issue status (#30 §2)

• §2.3 is now enforced + documented → tickable on merge.
• §2.2's runbook is delivered, but the box stays open until someone actually runs the testnet round-trip — the SDK validation is the human step; this PR just enables it.

---

Note

Low Risk
Documentation and static source-pattern tests only; no runtime, auth, or transaction logic changes.

Overview
Adds docs/release-verification.md, a pre-release checklist that ties together existing CI checks (config/on-chain tests) with a manual Chronos testnet round-trip (wrap, unwrap, both XDM directions) and documents standing fund-safety invariants (no external tx inputs; exact confirmed amount strings).

Adds test/tx-input-invariant.test.ts, a Vitest tripwire that fails if pages/xdm/send.tsx, pages/wrap.tsx, or components/SendForm.tsx start reading URL query params via router.query, useSearchParams, or window.location.search. The doc and test comments state this is a smell test for the URL-param regression vector—not proof against indexer/RPC-sourced inputs—and that intentional changes require re-audit before relaxing the check.

^{Reviewed by Cursor Bugbot for commit 69be3c3. Configure here.}

[jim-counter]

Closing unmerged. On reflection both additions were disproportionate for this codebase and beyond the scope of the audit:

• The §2.3 guard as a source-scanning Vitest test isn't a standard pattern — if this invariant were ever mechanically enforced it should be an ESLint rule (no-restricted-syntax), not a grep-test. For a three-file property, a documented invariant upheld in code review is proportionate.
• A standalone per-flow runbook goes stale as tools are added, and the underlying 'test fund-moving changes on testnet' discipline is largely implicit.

The §2.3 invariant is now documented on #30 and upheld in review; §2.2 remains a manual testnet round-trip (verify exact amount + destination on the explorer). Reasoning recorded in #30 ("Considered" §6).