Added experimental escrow based send-to-social support

.beads/.gitignore

@@ -0,0 +1,29 @@
+# SQLite databases
+*.db
+*.db?*
+*.db-journal
+*.db-wal
+*.db-shm
+
+# Daemon runtime files
+daemon.lock
+daemon.log
+daemon.pid
+bd.sock
+
+# Legacy database files
+db.sqlite
+bd.db
+
+# Merge artifacts (temporary files from 3-way merge)
+beads.base.jsonl
+beads.base.meta.json
+beads.left.jsonl
+beads.left.meta.json
+beads.right.jsonl
+beads.right.meta.json
+
+# Keep JSONL exports and config (source of truth for git)
+!issues.jsonl
+!metadata.json
+!config.json

.beads/README.md

@@ -0,0 +1,81 @@
+# Beads - AI-Native Issue Tracking
+
+Welcome to Beads! This repository uses **Beads** for issue tracking - a modern, AI-native tool designed to live directly in your codebase alongside your code.
+
+## What is Beads?
+
+Beads is issue tracking that lives in your repo, making it perfect for AI coding agents and developers who want their issues close to their code. No web UI required - everything works through the CLI and integrates seamlessly with git.
+
+**Learn more:** [github.com/steveyegge/beads](https://github.com/steveyegge/beads)
+
+## Quick Start
+
+### Essential Commands
+
+```bash
+# Create new issues
+bd create "Add user authentication"
+
+# View all issues
+bd list
+
+# View issue details
+bd show <issue-id>
+
+# Update issue status
+bd update <issue-id> --status in_progress
+bd update <issue-id> --status done
+
+# Sync with git remote
+bd sync
+```
+
+### Working with Issues
+
+Issues in Beads are:
+- **Git-native**: Stored in `.beads/issues.jsonl` and synced like code
+- **AI-friendly**: CLI-first design works perfectly with AI coding agents
+- **Branch-aware**: Issues can follow your branch workflow
+- **Always in sync**: Auto-syncs with your commits
+
+## Why Beads?
+
+✨ **AI-Native Design**
+- Built specifically for AI-assisted development workflows
+- CLI-first interface works seamlessly with AI coding agents
+- No context switching to web UIs
+
+🚀 **Developer Focused**
+- Issues live in your repo, right next to your code
+- Works offline, syncs when you push
+- Fast, lightweight, and stays out of your way
+
+🔧 **Git Integration**
+- Automatic sync with git commits
+- Branch-aware issue tracking
+- Intelligent JSONL merge resolution
+
+## Get Started with Beads
+
+Try Beads in your own projects:
+
+```bash
+# Install Beads
+curl -sSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | bash
+
+# Initialize in your repo
+bd init
+
+# Create your first issue
+bd create "Try out Beads"
+```
+
+## Learn More
+
+- **Documentation**: [github.com/steveyegge/beads/docs](https://github.com/steveyegge/beads/tree/main/docs)
+- **Quick Start Guide**: Run `bd quickstart`
+- **Examples**: [github.com/steveyegge/beads/examples](https://github.com/steveyegge/beads/tree/main/examples)
+
+---
+
+*Beads: Issue tracking that moves at the speed of thought* ⚡

.beads/config.yaml

@@ -0,0 +1,63 @@
+# Beads Configuration File
+# This file configures default behavior for all bd commands in this repository
+# All settings can also be set via environment variables (BD_* prefix)
+# or overridden with command-line flags
+
+# Issue prefix for this repository (used by bd init)
+# If not set, bd init will auto-detect from directory name
+# Example: issue-prefix: "myproject" creates issues like "myproject-1", "myproject-2", etc.
+# issue-prefix: ""
+
+# Use no-db mode: load from JSONL, no SQLite, write back after each command
+# When true, bd will use .beads/issues.jsonl as the source of truth
+# instead of SQLite database
+# no-db: false
+
+# Disable daemon for RPC communication (forces direct database access)
+# no-daemon: false
+
+# Disable auto-flush of database to JSONL after mutations
+# no-auto-flush: false
+
+# Disable auto-import from JSONL when it's newer than database
+# no-auto-import: false
+
+# Enable JSON output by default
+# json: false
+
+# Default actor for audit trails (overridden by BD_ACTOR or --actor)
+# actor: ""
+
+# Path to database (overridden by BEADS_DB or --db)
+# db: ""
+
+# Auto-start daemon if not running (can also use BEADS_AUTO_START_DAEMON)
+# auto-start-daemon: true
+
+# Debounce interval for auto-flush (can also use BEADS_FLUSH_DEBOUNCE)
+# flush-debounce: "5s"
+
+# Git branch for beads commits (bd sync will commit to this branch)
+# IMPORTANT: Set this for team projects so all clones use the same sync branch.
+# This setting persists across clones (unlike database config which is gitignored).
+# Can also use BEADS_SYNC_BRANCH env var for local override.
+# If not set, bd sync will require you to run 'bd config set sync.branch <branch>'.
+# sync-branch: "beads-sync"
+
+# Multi-repo configuration (experimental - bd-307)
+# Allows hydrating from multiple repositories and routing writes to the correct JSONL
+# repos:
+#   primary: "."  # Primary repo (where this database lives)
+#   additional:   # Additional repos to hydrate from (read-only)
+#     - ~/beads-planning  # Personal planning repo
+#     - ~/work-planning   # Work planning repo
+
+# Integration settings (access with 'bd config get/set')
+# These are stored in the database, not in this file:
+# - jira.url
+# - jira.project
+# - linear.url
+# - linear.api-key
+# - github.org
+# - github.repo
+sync-branch: beads-sync

.beads/metadata.json

@@ -0,0 +1,4 @@
+{
+  "database": "beads.db",
+  "jsonl_export": "issues.jsonl"
+}

.eslintignore

@@ -6,4 +6,5 @@ dist
 .vscode
 .env
 postgres_*
-aptos_examples_ts
+aptos_examples_ts
+local_tests

.eslintrc.cjs

@@ -30,6 +30,7 @@ module.exports = {
         "@typescript-eslint/ban-types": ["off"],
         "@typescript-eslint/no-empty-function": ["off"],
         "@typescript-eslint/no-explicit-any": ["off"],
+        "@typescript-eslint/ban-ts-comment": ["off"],
         "switch-colon-spacing": ["error", { after: true, before: false }],
         "no-extra-semi": "error",
         "comma-dangle": ["error", "always-multiline"],

.gitattributes

@@ -0,0 +1,3 @@
+
+# Use bd merge for beads JSONL files
+.beads/issues.jsonl merge=beads

.gitignore

@@ -160,3 +160,14 @@ http-capture-1762008909.pcap
 http-traffic.json
 PR_REVIEW_FINAL.md
 REVIEWER_QUESTIONS_ANSWERED.md
+.
+src/features/zk
+PR_REVIEW_RAW.md
+PR_REVIEW.md
+BUGS_AND_SECURITY_REPORT.md
+PR_REVIEW_COMPREHENSIVE.md
+CEREMONY_COORDINATION.md
+ZK_CEREMONY_GIT_WORKFLOW.md
+ZK_CEREMONY_GUIDE.md
+attestation_20251204_125424.txt
+prop_agent

.serena/memories/escrow_security_patterns.md

@@ -0,0 +1,113 @@
+# Escrow Security Patterns and Best Practices
+
+## Critical Security Validations
+
+### Input Validation Pattern
+All escrow operations must validate:
+1. **Length limits**: Platform ≤20 chars, Username ≤100 chars
+2. **Unicode normalization**: NFKC normalization to prevent collision attacks
+3. **Delimiter protection**: Prevent `:` in platform/username fields
+4. **Non-empty validation**: Require trimmed non-empty strings
+
+### Balance Protection Pattern
+```typescript
+const MAX_BALANCE = BigInt("1000000000000000000000") // 1 sextillion DEM
+
+// Always check overflow before applying
+const newBalance = previousBalance + BigInt(amount)
+if (newBalance > MAX_BALANCE) {
+    // Reject operation
+}
+```
+
+### Time-Based Validation Pattern
+```typescript
+const MIN_EXPIRY_DAYS = 1
+const MAX_EXPIRY_DAYS = 365 // Prevent indefinite fund locking
+
+// Validate expiry on deposit creation
+if (requestedExpiry < MIN_EXPIRY_DAYS || requestedExpiry > MAX_EXPIRY_DAYS) {
+    // Reject operation
+}
+```
+
+### Access Control Pattern
+```typescript
+// Always check flagged status before allowing fund operations
+if (account.flagged) {
+    return {
+        success: false,
+        message: "Account is flagged and cannot perform this operation"
+    }
+}
+```
+
+## Attack Vectors Mitigated
+
+### 1. Unicode Collision Attack
+**Attack**: Different Unicode strings generating same hash
+**Defense**: NFKC normalization + delimiter validation
+**Example**: `alice` vs `ａｌｉｃｅ` (fullwidth) → normalized to same value
+
+### 2. Fund Locking Attack  
+**Attack**: Creating escrow with distant future expiry
+**Defense**: 365-day maximum expiry validation
+**Impact**: Prevents permanent fund locks
+
+### 3. Balance Overflow Attack
+**Attack**: Deposit amounts causing integer overflow
+**Defense**: BigInt arithmetic + MAX_BALANCE check
+**Impact**: Prevents theft via wrapping
+
+### 4. DoS via Large Input
+**Attack**: Submitting 10MB usernames to exhaust SHA3 computation
+**Defense**: Length limits (20/100 chars)
+**Impact**: Protects network from computational DoS
+
+### 5. Flagged Account Bypass
+**Attack**: Banned accounts claiming escrow funds
+**Defense**: Flagged status check before claim
+**Impact**: Enforces access control policies
+
+## Code Review Checklist
+
+When reviewing escrow-related code, verify:
+- [ ] All string inputs have length validation
+- [ ] Unicode normalization applied to user-provided identifiers
+- [ ] BigInt used for all balance arithmetic
+- [ ] Overflow checks before balance updates
+- [ ] Time-based validations have reasonable bounds
+- [ ] Flagged account checks before sensitive operations
+- [ ] No delimiter characters allowed in structured identifiers
+
+## Constants Reference
+
+```typescript
+// Escrow limits
+const MIN_EXPIRY_DAYS = 1
+const MAX_EXPIRY_DAYS = 365
+const MS_PER_DAY = 24 * 60 * 60 * 1000
+const MAX_BALANCE = BigInt("1000000000000000000000")
+const MAX_PLATFORM_LENGTH = 20
+const MAX_USERNAME_LENGTH = 100
+
+// Rate limits
+escrow_deposit: { maxRequests: 10, windowMs: 60000 }
+escrow_claim: { maxRequests: 5, windowMs: 60000 }
+escrow_refund: { maxRequests: 5, windowMs: 60000 }
+```
+
+## Testing Recommendations
+
+### Security Test Cases
+1. **Unicode attacks**: Submit fullwidth, combining marks, homographs
+2. **Overflow attacks**: Test max values, boundary conditions
+3. **DoS attacks**: Submit maximum allowed lengths, measure performance
+4. **Time attacks**: Test min/max expiry bounds, expired escrows
+5. **Access control**: Verify flagged accounts rejected
+
+### Performance Benchmarks
+- Hash computation time with MAX_USERNAME_LENGTH input
+- Database query latency with GIN indexes
+- Rate limiter eviction performance at 100K IPs
+- Point calculation latency (should be 4x faster)