Skip to content

ROADMAP.md

Latest commit

 

History

History
175 lines (133 loc) · 12.2 KB

ROADMAP.md

File metadata and controls

175 lines (133 loc) · 12.2 KB

Roadmap

Internal — what's next, what's parked. Updated alongside STRATEGY.md (multi-year vision) and MANIFESTO.md (public-facing philosophy). When in doubt: this doc is "what are we shipping this month?".

Last updated 2026-06-04.

Right now — close out v0 (blocked on Venice)

  • Vault deployed (0xa5A9E6D38Ff4b20e99f80039eD637EE1CC521cd2), Safe-owned, 0.5 DIEM staked
  • Operator EOA wired as keeper + authorizedSigner via Safe
  • Venice API key minted via ERC-1271 (vault-bound) — confirmed Venice supports it ✓
  • 19 active offers on Surplus (niche models — premium ones pending allowance)
  • Smart pricer (P25 of healthy + available) deployed, hourly cron live
  • UI live at cache.puttowork.co with correct 24-decimal vDIEM display
  • Live-vault fork test proves full redeem cycle works
  • Venice fix lands — Venice team has the PR ready; flips daily allowance on for contract wallets. Should land in an epoch boundary near-term.
  • Re-run register-seller → adds ~60 premium offers (claude, gpt, etc.)
  • Self-test buy via Surplus → confirm USDC settles to vault
  • Manual harvest → confirm USDC → DIEM round-trip works
  • Redeem the 0.5 DIEM (or part of it) → real-world confirmation of withdraw flow

Pre-public-launch hardening (Ed's security pass — Tier 1)

  • Alchemy URL — split into two apps; browser one domain-locked to cache.puttowork.co; server one IP-locked or unrestricted with stricter quota
  • WalletConnect Project ID — domain-restrict in WalletConnect Cloud
  • Security headers in next.config.ts:
    • X-Frame-Options: DENY (or CSP: frame-ancestors 'none')
    • X-Content-Type-Options: nosniff
    • Referrer-Policy: strict-origin-when-cross-origin
    • Permissions-Policy: camera=(), microphone=(), geolocation=()
  • GitHub footer link — make repo public OR remove the link
  • Contracts section on the UI / a /contracts page with all official addresses + Basescan links
  • CORS wildcard note in web/README.md for future API routes
  • SECURITY.md additions:
    • Document soft-pauses (setDepositCap(0) / setKeeper(0x0)) as the no-formal-pause equivalents
    • Document why flush() / unstakeBatch() / claimRedeem() are permissionless
  • Public launch post — once all of the above is done

Tier 2 — Architecture + distribution (3-6 weeks, overlapping)

2a. Trustless keeper + HYBRID mode (MetaMask × 1Shot × Venice hackathon entry)

Massively expanded scope 2026-06-06/07 — all code built, mainnet deploy pending.

The hackathon pivot: cache. became "the autonomous DIEM sell-side vault" with hybrid mode — depositors get free self-consumption of inference up to their proportional share of cache.'s daily Venice allowance, alongside yield on the residual sold via marketplaces. Identical UX to Venice direct (regular API key), SIWE-authenticated setup, weekly Merkle-root attestation on-chain.

Built (branch agent/tier2-5-buildout, HEAD 1ead231):

  • Smart Account + ERC-7715 keeper — Sprint 1 (scripts/lib/smart-account.ts, deploy scripts, Safe Tx grants)
  • 1Shot relayer integration — Sprint 2 (scripts/lib/oneshot.ts, relay-harvest, relay-settle, webhook receiver)
  • CacheSellerDelegation AntSeed seller façade — Sprints 3 + 4b (capped+timelocked fee switch, broadcast-gated deploy with vault/stake sanity checks)
  • CacheUsageLogger weekly Merkle attestation — Sprints 6 + 6b (revokePublisher emergency, 24h publisher rotation timelock)
  • Backend proxy (HYBRID core) — Sprints 5 + 5b (Hono + SIWE + sqlite quota ledger, atomic check-and-debit, settle reconciliation, streaming-501)
  • Depositor /inference dapp — Sprint 7 (API key issuance + dashboard + AES-GCM localStorage)
  • cache-antseed-node scaffolding — Sprint 4 (Railway-ready, @antseed/node@0.2.89)
  • All gates green: forge 164 + proxy 54 + scripts 105 unchanged, slither 0 high/medium, 4 verifier passes confirmed
  • Hackathon pitch + architecture diagrams + demo script drafted (agent/cache-hackathon-pitch.md, agent/cache-architecture.md, agent/cache-demo-script.md)

Hands-on (2026-06-08+, blocked on Venice whitelist for non-degraded demo):

  • Mainnet deploys: CacheSellerDelegation + CacheUsageLogger + MetaMask Smart Account
  • Safe transactions: ownership transfers, setOperator × 2, vault.setKeeper rotation, ERC-7715 grants × 2
  • Revoke deployer EOA from isOperator (per Sprint 6b runbook addition)
  • 1Shot signup + Railway env wiring
  • Deploy proxy/ to Railway → DNS api.cache.puttowork.co
  • Deploy cache-antseed-node/ to Railway → generate node identity → Safe-register as operator
  • Demo recording per agent/cache-demo-script.md
  • Submission on hackquest.io by Mon June 15

External waits:

  • Venice / Erik V whitelist for vault 0xa5A9...cd2 (message sent 2026-06-07)
  • AntSeed team intro reply (sent 2026-06-07)

2b. Multi-channel distribution

Per STRATEGY §11 (vault/marketplace separation): cache only sells through neutral marketplaces. Never deposits into other vaults, never becomes a marketplace itself.

  • AntSeed marketplace integration — run an API-proxy provider pointing at Venice, set our own prices, settle in USDC on Base via payment channels (AntseedDeposits/AntseedChannels, EIP-712 SpendingAuth). USDC routes through the existing harvest() swap. Sell through, never deposit into (§11 ✅). Pricer prices it P25-style like Surplus, gated on ANTSEED_BASE_URL. See scripts/lib/ANTSEED_SPEC.md, backlog AS-MARKETPLACE-1.
  • Internal smart router — pricer becomes a multi-channel allocator across (Surplus, AntSeed, future markets) allocating fresh credit to the highest-expected-yield channel each tick. Pure distribution strategy for our own inventory.
  • carpe-diem.xyz integration — ❌ SHELVED 2026-06-06 (Angus reframe). Reclassified as a managed-capacity vault (provider hands over the key; carpe-diem sets the price, sells the capacity, pays back 65% — a 35% take), not a seller-managed marketplace. Per STRATEGY §11 we do not outsource our daily allowance to other people's vaults. Code retained but @deprecated and pricer-gated off. Reconsider only if the structure becomes truly seller-managed (we set the price, we keep 100% minus a flat marketplace fee). Rationale: backlog CD-SHELVED.
  • AntSeed deposit (airdrop farming) — Dropped per STRATEGY §11. The separate diem.antseed.com "DIEM Provider Capacity Program" is a DIEM vault; depositing cache's DIEM into it would mean taking on their SC risk + custody fragmentation. (The antseed.com marketplace — above — is a sell-through channel and IS pursued; only the DIEM-deposit program is dropped.)

2c. Transparency dashboard

  • Public dashboard at cache.puttowork.co/dashboard: harvest history, pricer decisions per model, daily fill rates, treasury balance over time
  • Indexed event log: every Harvested / Deposited / Redeemed / Flushed event with searchable history

Tier 3 — Protocol-Owned Inference (3-6 months)

Treasury

  • Treasury contract that accumulates DIEM from vault surplus
  • Surplus-revenue split — define what fraction of harvested DIEM routes to treasury vs back to depositors (and how it's adjusted over time)
  • On-chain treasury dashboard — public balance + history, no admin sells

Token decision

  • Decide on $CACHE token — sequence: prove vault first, treasury accumulating from vault revenue alone for ~3 months, then launch token as an accelerator of the working POI mechanism
  • If yes: tokenomics design (trading-fee buyback pattern, not bootstrapping-ICO), legal review, distribution model, treasury allocation

Tier 4 — Internal smart router (6-12 months)

Per STRATEGY §11: no public buyer-side aggregator. Cache stays in the vault layer. This tier evolves the internal pricer into a sophisticated multi-channel allocator for our own credit.

  • Per-tick channel allocation — pricer decides not just price but which marketplace gets our fresh credit each tick, based on net yield + reliability + demand signals
  • Real-time fill tracking — measure actual sell-through per channel, feed back into allocation decisions
  • Channel reliability scoring — track marketplace downtime / settlement delays / fee changes; auto-reduce allocation to degraded channels
  • Cross-chain consideration — bring vault to other L2s if DIEM markets emerge there. Same vault pattern; new channels.

Direct buyer endpoint — Deferred / dropped per STRATEGY §11. Would put cache in the marketplace layer. If a buyer-side aggregator is needed, it should be a separate neutral protocol — not a cache feature.

Tier 5 — Liquid vDIEM + in-house composability (12-24 months)

Re-framed 2026-06-06 — see STRATEGY §Tier 5. The original "vDIEM as Aave collateral" framing was a fantasy (no listing path exists at our scale). The realistic tier builds the composability surface in-house.

  • Liquid vDIEM wrapper (lvDIEM) — built on agent/tier2-5-buildout with multi-user batch-mispay fix. Wraps vDIEM 1:1, maintains a working- capital pool of DIEM for instant redemptions, arbed against the vault's batched cycle.
  • DIEM oracle adapter (Chainlink-shape) — built on agent/tier2-5-buildout with monotonic round IDs and VaultEmpty revert. Reads vault.convertToAssets(). Honest staleness signal.
  • lvDIEM ↔ DIEM AMM pool on Aerodrome — the cheap real win. Seed initial liquidity from treasury. Anyone can swap lvDIEM↔DIEM at near-NAV instantly; arbitrageurs maintain the peg via the batched-redeem cycle. Solves the 24-48h cooldown UX problem without any external listing.
  • Pilot integrations — Aave-style listing, Pendle PT, perp markets — Dropped per STRATEGY §Tier 5 reframe. Neither DIEM nor VVV are listed on those venues; vDIEM has zero path. The AMM solves the underlying user-need.

Tier 6 — Inference-backed stablecoin (24-36 months, conditional)

See STRATEGY §Tier 6. Sister product, not vault feature. Gated by five prerequisites: $1M+ vault TVL, 6+ months treasury accumulation, deep DIEM/USDC liquidity, completed regulatory legal review, and a second-mover signal from a comparable exotic-collateral stable surviving a market downturn. Captured as a possibility, not as roadmap.

  • [?] iUSD design doc — write only when all five gates are partially met. Decision is Angus's.

Parked — not now, may revisit later

  • Permissionless harvest with TWAP protection — original round-4 audit caught flashloan sandwich risk on permissionless harvest. Reverted to keeper-permissioned for v0. Tier 2's Smart Account + relayer approach is a cleaner substitute (anyone can trigger the relayer; vault still checks keeper). Reconsider if relayer approach proves problematic.
  • Multi-hop swap fallback — USDC → VVV → DIEM via the VVV/DIEM pool, in case the SlipStream USDC/DIEM pool ever thins. Defensive only.
  • Failed-settlement monitoring — Surplus retries 5x then permanently fails; track + alert on permanently-failed settlements. Worth doing once we have any real settlement volume.
  • Sherlock contest / paid audit at $50k+ TVL (~30 DIEM at current prices).
  • Per-model adaptive pricing v2 — track captured volume per model over time; deepen discount on models where we're not winning the route despite undercutting. Builds on v1 once we have real volume data.

Won't do

  • Yield farming with emissions — no inflationary token, ever
  • ChatGPT-style chatbot UI — not our scope; users hit inference via Surplus, carpe-diem, or (Tier 4) our own aggregator endpoint
  • USDC-payout primary strategy — contradicts the accumulate-inference thesis. Available as secondary strategy if real demand emerges, but the default is always "convert to DIEM and re-stake"
  • TEE / inference gateway — Surplus and carpe-diem already proxy through their own infra; no benefit to running our own enclave layer (this was originally proposed when we thought we'd hold the inference key directly, before ERC-1271 worked)