Instawards/pay batch sac

.env.example

@@ -37,7 +37,8 @@ ADMIN_WALLETS=""
 ORACLE_SECRET_KEY=""
 
 # ========== NETWORK CONFIGURATION ==========
-# Network to use: testnet or public
+# Network to use: testnet or public. Anything else (including empty) resolves
+# to testnet -- the app never silently selects a network where funds are real.
 NEXT_PUBLIC_STELLAR_NETWORK=testnet
 
 # ========== STELLAR READ ADDRESS ==========
@@ -46,13 +47,21 @@ NEXT_PUBLIC_STELLAR_NETWORK=testnet
 NEXT_PUBLIC_STELLAR_READ_ADDRESS=
 
 # ========== CONTRACT CONFIGURATION ==========
-# The deployed CoreFlow contract address on Testnet or Mainnet.
-# Update this after deploying the contract.
+# The deployed CoreFlow contract address, on the network selected above.
+#
+# REQUIRED. There is no fallback: an unset value raises a clear error rather
+# than defaulting to a hard-coded address. A previous default pointed at the
+# MAINNET contract while the network defaulted to testnet, so an unconfigured
+# deployment aimed a mainnet contract at testnet RPC and every call failed --
+# and a developer running locally was pointed at the live contract.
 NEXT_PUBLIC_STELLAR_CONTRACT_ID=
 
 # Settlement token: the Stellar Asset Contract (SAC) address used for custody.
 # On escrow creation the contract pulls this token from the manager and releases
 # it to workers on finalize. Use the USDC SAC for the configured network.
+# The Stellar Asset Contract used for custody and settlement (e.g. the USDC
+# SAC). Escrow creation refuses to build a transaction without it -- there is
+# no default, because guessing the settlement asset is not recoverable.
 NEXT_PUBLIC_STELLAR_TOKEN_ID=
 
 # ========== WALLET CONFIGURATION ==========
@@ -63,3 +72,40 @@ NEXT_PUBLIC_FREIGHTER_TIMEOUT=5000
 # Selected automatically from NEXT_PUBLIC_STELLAR_NETWORK:
 #   Testnet: https://soroban-testnet.stellar.org
 #   Mainnet: https://mainnet.sorobanrpc.com
+
+# ========== VARIABLES WRITTEN BY `vercel env pull` ==========
+# A `vercel env pull` overwrites .env / .env.local with the DEPLOYMENT's values,
+# including these. On 2026-09-11 that silently repointed local development at the
+# production database and Mainnet v1. If you pull, re-check the environment:
+#
+#   npm run check:env
+#
+# These must be LOCAL in development. `npm run check:env` refuses otherwise, and
+# it runs automatically before dev, db:migrate, db:deploy and db:seed.
+PRISMA_DATABASE_URL=""
+POSTGRES_URL=""
+# Short-lived Vercel OIDC token. Never commit; never needed locally.
+VERCEL_OIDC_TOKEN=""
+
+# ========== CRON ==========
+# Bearer secret Vercel Cron presents to GET /api/indexer/run. Preferred over
+# INDEXER_SECRET on Vercel. Generate with:
+#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+CRON_SECRET=""
+
+# ========== BOOTSTRAP ==========
+# One-time secret for POST /api/admin/bootstrap, which claims the first admin.
+# Unset it again once the first administrator exists.
+BOOTSTRAP_SECRET=""
+
+# ========== SETTLEMENT ASSET CODE ==========
+# Display code for the asset NEXT_PUBLIC_STELLAR_TOKEN_ID issues, e.g. USDC.
+# An escrow holds exactly ONE Stellar Asset Contract, so this is the only asset
+# a payroll CSV may name here. CoreFlow never infers a SAC address from a symbol.
+NEXT_PUBLIC_SETTLEMENT_ASSET_CODE=USDC
+
+# ========== PREFLIGHT OVERRIDES (never set these by default) ==========
+# Each is a per-run, deliberate escape hatch for `scripts/check-env.mjs`:
+#   COREFLOW_ALLOW_MAINNET=1           act against Mainnet on purpose
+#   COREFLOW_ALLOW_REMOTE_DB=1         act against a non-local database on purpose
+#   COREFLOW_ALLOW_UNKNOWN_CONTRACT=1  use a contract absent from the registry

.gitignore

@@ -20,11 +20,18 @@ coverage
 node_modules/
 
 # dotenv environment variables files
+#
+# Deny EVERY .env variant and re-admit only the example. The previous list named
+# .env, .env.local and .env.*.local individually, which left .env.production,
+# .env.development and anything else a tool decides to write unignored — and a
+# `vercel env pull` writes real production secrets into files like those.
 .env
-.env.local
-.env.*.local
+.env.*
 !.env.example
 
+# Local TLS certificates for `next dev --experimental-https`
+certs/
+
 # IDE & OS
 .vscode/
 .idea/
@@ -60,3 +67,8 @@ contracts/*/target/
 # Playwright
 /playwright-report/
 /test-results/
+
+# Exported environment dumps (e.g. `vercel env pull`) — these hold LIVE secrets
+prodenv.txt
+*env*.txt
+.env*.txt

README.md

@@ -32,6 +32,24 @@
 
 ## 🔗 Deployed Contract
 
+> ## Two deployments — read this first
+>
+> CoreFlow has **two distinct on-chain deployments** with **different security properties**:
+>
+> | | Network | Contract | Status |
+> |---|---|---|---|
+> | **v2** (hardened) | **Testnet** | `CDN4FIKLJ72WYNPBIKWYSDJWDZG22QNPLWI37VTUAE4EKKIBVAQRG5F4` | Active. Domain-separated attestations, admin-managed oracle registry, work/amount invariant, pinned admin. |
+> | **v1** (historical) | Mainnet | `CCTF5WBOQR7JP2KPLQT372X7JCGCINHDFRSAPF4YTYRKZXZ3J2XPRFFW` | Deployed earlier. Carries **none** of v2's hardening. |
+>
+> **v2's security improvements are NOT deployed on Mainnet.** Mainnet activity
+> referenced below was produced against **v1**. Full detail:
+> [`docs/DEPLOYMENTS.md`](docs/DEPLOYMENTS.md) ·
+> [`docs/evidence/REVIEWER_EVIDENCE.md`](docs/evidence/REVIEWER_EVIDENCE.md)
+>
+> Testnet activity is labelled **Testnet validated**; Mainnet contract calls are
+> labelled **v1 Mainnet deployed**. Neither is revenue, pilot usage, or a
+> commercial deployment.
+
 > **Live on Stellar Mainnet** — View and verify the deployed CoreFlow smart contract on Stellar Expert:
 >
 > 🔗 **[View Deployed Contract on Stellar Expert](https://stellar.expert/explorer/public/contract/CCTF5WBOQR7JP2KPLQT372X7JCGCINHDFRSAPF4YTYRKZXZ3J2XPRFFW)**