Changelog
The latest updates, improvements, and fixes for the Remlo infrastructure.
Anchor escrow M-4 audit fix deployed
Approved verdicts on the remlo_escrow Anchor program now require positive confidence on-chain. Same program ID, same integrations.
- require!(confidence_bps > 0) on VerdictState::Approved
- New InvalidConfidence error variant
- Devnet upgrade landed at slot 459837277
Notification fan-out across the lifecycle
Dashboard notification bell now fires on all seven lifecycle events: payroll finalized or failed, escrow settled or refunded, council decision, KYC update, and reputation write failure.
- escrow_settled and escrow_refunded fire from settleOrRefund and refundExpiredEscrow
- council_decision summarizes vote breakdown after consensus tallies
- reputation_write_failed only fires on terminal failure (5+ retries)
- payroll_failed surfaces actual revert reason via try/catch around writeContract
Multi-rail x402 (Tempo + Base + Solana)
Most paid endpoints now accept payment on three chains in one 402 challenge. Agents pick whichever rail their wallet has balance on.
- 7 multi-rail endpoints: yield-rates, agent/pay, compliance/check, escrow/post, escrow/deliver, escrow status, memo/decode
- Single 402 surfaces all rails: WWW-Authenticate header for Tempo, accepts[] for Base + Solana
- CDP facilitator handles Base + Solana verify + settle out of band
- State-mutating endpoints (payroll execute, fiat off-ramp) intentionally Tempo-only
Bridge KYC integration rewritten + Resend transactional email
Bridge KYC link flow corrected against the actual Bridge sandbox docs. Branded transactional email shipped with five templates and webhook-driven suppression.
- Standalone KYC Links flow (Bridge creates customer record from submitted data)
- RSA-SHA256 webhook signature verification with 10-minute replay protection
- New bridge_kyc_link_id column for resolving kyc_link.completed events
- Five branded React Email templates: invite, welcome, payroll receipt, payroll failed, KYC reminder
Contract redeploy with full audit fix pass
All five Solidity contracts redeployed on Tempo Moderato with 22-finding audit fix pass applied. Stuck-funds class of bug eliminated by enforcing memo prefix at deposit.
- PayrollTreasury M-1 memo prefix enforcement
- PayrollBatcher H-4 optional EmployeeRegistry validation
- YieldRouter H-5 strategy allow-list
- StreamVesting H-2 unclaimed-refund queue
- EmployeeRegistry C-6 O(1) reverse lookup