Skip to content

TODO.md

Latest commit

 

History

History
103 lines (88 loc) · 4.79 KB

TODO.md

File metadata and controls

103 lines (88 loc) · 4.79 KB
Raw

TODO

1) Security and Integrity

  • Enforce signature verification on every read of snapshots and ledger
    • storage.readIssueSnapshot: verify with verifySnapshot; reject if invalid
    • ledger.readLedger: already verifies; keep consistent
  • Add optimistic concurrency retries (seq-based)
    • On trade: read -> compute -> write (seq+1); re-read and compare seq; retry N times (e.g., 3) on mismatch
    • Apply same pattern for ledger writes
  • Add write receipts for partial failures
    • If ledger updated but market snapshot write fails, post a bot comment noting partial update and suggesting retry/reconcile
  • Harden snapshot block parsing
    • Ensure only one snapshot block exists; if multiple, prefer the first and remove extras; always re-render at top of body

2) Permissions and Governance

  • Trading permissions
    • Restrict to repo collaborators or org members (octokit.repos.getCollaboratorPermissionLevel)
    • Optional: team-based allowlist via config
  • Conflict-of-interest flags
    • If commenter can close the target issue, flag their trades in comments and (optionally) cap trade size
  • Max exposure per user per market
    • Cap shares per side (e.g., 1,000) to limit manipulation

3) Market Discovery and Metadata

  • Label market issues on creation
    • Labels: forecast-market, target-issue-<n>
    • Store target linkage in snapshot (already present)
  • Fast lookup by label
    • In resolution and helpers, query by labels instead of scanning titles
  • Support multiple markets per target
    • Encode marketId in a label (e.g., market-id:<id>) and in the title to disambiguate

4) UX: Commands and Feedback

  • Add /help command listing supported commands and examples
  • Add /sell yes|no <shares> (optional)
    • MVP: model sell as buying the opposite side; display cost/refund at current price
  • Improve trade feedback
    • Show pre-trade and post-trade price, slippage, and remaining balance
  • Balance/portfolio
    • /portfolio to list all open market positions and total exposure
  • Leaderboard
    • Scheduled (GitHub Actions cron) job posts top balances to the Ledger Issue

5) PR Integration

  • For PR-targeted markets, update a "Forecast" check on relevant events
    • On trade and on PR sync, call checks.upsertForecastCheck with latest probability
  • Optionally display a badge in PR description via a bot comment that updates on trades

6) Resolution Improvements

  • Deadline handling
    • Use explicit timezone (UTC) and display local time hints
  • Manual override command
    • /market resolve <yes|no> reason:"..." with audit log in the market issue
  • Auto-resolve scheduler
    • GitHub Actions workflow that hits a maintenance endpoint or uses the API to scan and resolve past-deadline markets periodically

7) Reliability and Performance

  • Add retry with backoff on GitHub API 5xx / rate limits
  • Add minimal request queueing to avoid burst writes on hot markets
  • Cache repo metadata (collaborator permission levels) in-memory with TTL
  • Paginate issue listing calls (currently per_page=100) and/or filter via labels

8) Data Model Extensions

  • Record trade receipts
    • Append a small JSON receipt inside the market issue as a separate block or dedicated comments with a trade-receipt marker
    • Include: user, side, shares, cost, pre/post price, seq, timestamp
  • Transaction IDs
    • Include a monotonic txId field in comments to assist audit/reconciliation

9) Configuration and Policy

  • Repo-level config via a .ganttmarket.yml
    • startingCredits, b parameter, rate limits, allowed roles/teams, max shares
  • Environment variables validation with human-friendly errors
  • Toggle features via labels (e.g., forecast-enabled)

10) Testing and Tooling

  • Add unit tests for lmsr, parsing, and snapshot/ledger signing
  • Add integration tests using nock to stub GitHub API
  • Prettier/ESLint minimal setup for consistency

11) Observability

  • Structured logging (JSON) with request IDs and event types
  • Optional webhook delivery logging for debugging signature/headers
  • Health endpoint to verify env and GitHub App configuration (without secrets)

12) Documentation

  • Expand README with:
    • Resolution criteria and edge cases (reopen after deadline, edited titles)
    • Governance policies (who can trade, caps)
    • Security model (signed blocks, seq)
    • Troubleshooting guide (common webhook errors)

13) Enterprise/Privacy Options

  • Redact PII in logs (only show GitHub login when necessary)
  • Data residency note (all state is in GitHub; no external DB)
  • Optional export command /export to produce CSV summary of markets, trades, balances

14) Future Features

  • Conditional/scenario markets ("If +2 engineers, probability?")
  • Milestone and release markets with auto-deadlines from GitHub metadata
  • Slack/Teams notifications on big price moves
  • Visualization: tiny sparkline image rendered and posted as a comment (optional)