Verification and limits

The repository contains executable checks for ranking limits, actor/scoped authorization, wallet call matching, payment access, receipt-derived performance, public revenue visibility, bundle integrity, artwork admission and community/revenue contracts. Automated checks use synthetic accounts, receipts and venue fixtures. Independently reconciled mainnet records are listed separately below.

Release verification#

The clean source release is built and tested in a separate environment before publication. The optional manually triggered GitHub workflow defines installation, both contract builds, main-client/auth builds, Python suites, isolated EVM contract checks and browser smoke checks for a dedicated isolated runner. Runner registration and automatic public-PR execution are not enabled by this source release. A passing fixture test is not labelled a mainnet fill.

The 2026-10-08 verification passed:

• 141 Python tests: ranking boundaries, OAuth rotation/replay/audience and actor scopes, discovery/access/performance, public launch activity, bundle integrity, artwork and launch ingestion, exact smart-account calls and approvals, collateral/payment delivery and Privy identity verification.
• 90 isolated contract checks: 52 custom community factory/vault checks and 38 external-token revenue-vault checks.
• 90 browser checks: ten pages at three viewport sizes, rendering/errors/overflow.
• 14 auth dependency checks: UUID bounds, patched wallet URI parsing through its consumers, and bounded malformed-input decoding.
• Zero known advisories: both complete locked npm graphs and resolved Python application requirements; no advisory suppressions.
• Solidity compilation, content-addressed application build and separately locked Privy bundle build.

Rebuilt ABI, creation bytecode and runtime bytecode matched the corresponding production artifacts for all three custom community contracts and the external-token revenue vault. This proves artifact reproducibility against that deployed application's artifacts; it does not replace fresh onchain deployment checks or an independent audit.

Reconciled mainnet records#

On 2026-10-08, a read-only recheck independently matched these existing transactions against finalized canonical receipts and the expected application calls:

RALLY's exact token address is 0x6a834ff24ed4a59c17960a4fbccd46cfd558833a. These records establish issuance and this purchase. The recheck itself submitted no transactions and requested no wallet signatures. Automated contract checks cover subscription allocation, reserve protection and buyback behavior using explicit mock venues.

The public market screenshot was captured from the deployed app in an anonymous browser with no write requests. Source publication excludes private state and the owner-specific funding-test interface; no production wallet session or provider credential was used for these tests.

The browser suite covers ten representative pages at 390, 768 and 1,440 pixels. It checks rendering, runtime errors and page overflow, with all providers disabled and network writes forbidden. This checks layout and application integration, not live price completeness, every modal gesture or authenticated wallet behavior.

Measured loading improvements#

Recent production loading work coalesced startup fetches, removed unnecessary market inventory from the initial Discover/Memes bootstrap, bundled the main module graph, rendered meme rows progressively and introduced small background-generated public artwork.

The controlled measurements used a 390-pixel viewport, 120 ms network latency, 200,000 bytes/second bandwidth, four-times CPU throttling and three cold-cache samples:

The metric is first rendered content in the test harness, not a global real-user percentile or a claim of instant provider responses. Warm figures are separate individual samples. The production UI pass for that change covered 230 checks and made no wallet requests or financial transactions.

The source retains timestamped prices and full fetched catalogs; unavailable logos have a fallback. Thumbnail generation does not change token identity, price or executable transaction logic.

Evidence levels#

Execution requires the venue's applicable oracle, keeper, access and market conditions. Payment and buyback accounting uses finalized delivery evidence. See Trading and Community tokens.