Deon's Drips Cleanup

[0xDeon]

Context

A full audit of the repository was run against the current state of `main` (as of 2026-04-02). The audit focused on PRs that were merged into the `bugs` branch, cross-referencing their claimed closures against actual code present on `main`, and identifying any features that were partially or never implemented.

The result is this single consolidated cleanup issue. Everything listed here is either missing, broken, or incomplete relative to the acceptance criteria of its original issue. Nothing here is speculative — each item is backed by a direct code check.

---

1. Ghost Merges — Bugs Branch PRs That Never Reached Main

The following PRs were merged into the `bugs` branch. Because GitHub issue-close keywords only trigger on merges to the default branch, the issues they referenced were either never closed or were closed by mistake. The code from these PRs is not on `main`.

PR #129 → Issue #102: Stellar Event Indexer

The PR claimed to implement a real-time background worker that listens to Horizon for Soroban contract events and indexes them into the database.

What is actually on main:

• admin_service.go:248 has a checkEventIndexer() stub that reads a last_event_indexed_at timestamp from the database
• No event consumer, no Horizon polling loop, no background worker process exists anywhere in apps/api/
• The admin health endpoint will always report event_indexer: degraded because nothing ever writes to the timestamp it reads

What is needed:

• A background worker (goroutine or separate service) that polls Horizon's event stream for contract-emitted events
• Writes indexed events to the DB table the admin health check reads from
• Proper shutdown handling so the worker stops cleanly with the rest of the server

PR #127 → Issue #97: Contract Deployment Scripts

The PR claimed to deliver deployment scripts for testnet and mainnet along with a CI pipeline step.

What is actually on main:

• No contracts/ directory exists in the repo root
• No deployment scripts of any kind (shell, Makefile target, or otherwise) exist for the Soroban contracts
• CI pipeline has no deploy step

What is needed:

• Deploy scripts (Makefile or shell) for each contract targeting testnet
• A CI pipeline stage that triggers on version tags and runs the deploy

---

2. Skeleton Implementations — PRs Merged With Missing or Incomplete Code

These PRs were merged (some to `main`, some to `bugs`) but the actual implementation either never existed or was committed as bytecode/stubs with no source.

PR #82 → Issue #15: Prometheus AI Relay (Intelligence Endpoints in Go API)

The PR described adding an intelligence relay layer to the Go backend with caching, circuit breaking, and three endpoints.

What is actually on main:

• Searching apps/api/ for intelligence, prometheus, recommendation, insight returns zero matches across all Go files
• No handler file, no service file, no config, no routes registered anywhere
• The Python intelligence service (apps/intelligence/) has a claude.py service file and a health router only — no relay endpoints

What is needed:

• prometheus_client.go — Go client wrapping the Python intelligence service with TTL caching and circuit breaker
• intelligence.go handler with:
  • GET /api/v1/vaults/{id}/recommendations
  • GET /api/v1/intelligence/market
  • GET /api/v1/users/{id}/insights
• Routes wired into main.go

PR #130 → Issue #113: AI Fraud Detection / Anomaly Scoring

The PR claimed to implement an anomaly scorer in the Python intelligence service with risk evaluation and alerting endpoints.

What is actually on main:

• apps/intelligence/app/services/__pycache__/anomaly_scorer.cpython-314.pyc exists — a compiled Python bytecode file
• No corresponding anomaly_scorer.py source file exists in apps/intelligence/app/services/
• apps/intelligence/app/main.py only registers the health router — no risk or anomaly routes are wired
• No routers/risk.py file exists

What is needed:

• apps/intelligence/app/services/anomaly_scorer.py — the source file (currently only bytecode, which should not be committed)
• apps/intelligence/app/routers/risk.py with:
  • POST /risk/evaluate — scores a transaction pre-execution (amount deviation, velocity, settlement account novelty)
  • GET /users/{id}/risk/alerts — lists active risk alerts for a user
• Both routes registered in main.py
• Unit tests for each scoring factor

---

3. Partial Implementations — Code Exists But Acceptance Criteria Not Met

Issue #101 / Issue #10: Per-Route-Group Rate Limiting

Rate limiting middleware exists (ratelimit.go) and IS wired into the server (main.go). However, only two tiers are applied globally: a flat IP limiter and a write-method limiter. The original spec requires per-route-group tiers.

What is actually on main:

• IPRateLimiter — global, applies to all requests
• WriteMethodRateLimiter — applies to POST/PUT/PATCH/DELETE globally
• Both applied as a flat stack in main.go with no route awareness

What is needed:

• Different limits per route group, e.g.:
  • /api/v1/auth/* — strictest (brute-force protection)
  • /api/v1/vaults reads — relaxed
  • /api/v1/settlements/* writes — tightest
• Retry-After header included in all 429 responses (verify this is present)

---

4. Repository Hygiene

Committed Bytecode

apps/intelligence/app/services/__pycache__/anomaly_scorer.cpython-314.pyc is committed to the repository. Python __pycache__ directories should never be in version control.

Fix:

• Remove apps/intelligence/app/services/__pycache__/ from git history
• Add __pycache__/ and *.pyc to apps/intelligence/.gitignore if not already present

---

Checklist

Ghost Merges

• Stellar event indexer background worker implemented and writing events to DB (feat(backend): build real-time event indexer for Stellar contract events #102)
• Contract deployment scripts added with CI deploy stage (feat(contracts): contract deployment scripts and testnet deployment pipeline #97)

Skeleton Implementations

• Prometheus relay client added to Go API with caching + circuit breaker (Implement Prometheus AI service relay endpoint #15)
• Intelligence endpoints wired: /recommendations, /intelligence/market, /insights (Implement Prometheus AI service relay endpoint #15)
• anomaly_scorer.py source file restored in apps/intelligence/app/services/ (feat(AI): AI-powered fraud detection and anomaly alerting for vault activity #113)
• Risk routes (/risk/evaluate, /users/{id}/risk/alerts) implemented and registered in Python service (feat(AI): AI-powered fraud detection and anomaly alerting for vault activity #113)

Partial Implementations

• Per-route-group rate limiting tiers implemented (Implement API rate limiting and authentication middleware #10 / feat(backend): implement rate limiting, request validation, and API security hardening #101)
• Retry-After header confirmed on all 429 responses

Hygiene

• __pycache__/anomaly_scorer.cpython-314.pyc removed from version control
• *.pyc / __pycache__/ added to .gitignore for the intelligence service

[2411015047-afk]

Hi! I can help with the Drips Cleanup task. I have experience with Stellar/Soroban and can help audit the repository, identify unclaimed Drips, and implement cleanup logic.

If this is something you need paid help with, let me know! I can give you a quick quote.

Contact: 2411015047-afk

[0xDeon]

This was a meta cleanup audit from April 2026. Every item it identified is now tracked as a specific, actionable issue (#441–#454 for bugs/security, plus the existing open feature issues). Closing as superseded.