What's pending across every project
74 open · sorted by priority then due-date
todo
urgent
Rotate Razorpay webhook secret — 'hopewell' is guessable
The RAZORPAY_SECRET_WEBHOOK value in /opt/ocpp/.env on the production VM is literally 'hopewell' — a common English word, effectively no protection. HMAC verification against a guessable secret means anyone who learns the plaintext can forge webhook calls and credit any wallet.
Fix:
1. Razorpay Dashboard → Settings → Webhooks → regenerate a long random secret (32+ char base64).
2. Update /opt/ocpp/.env on the VM (SMTP_PASSWORD-style edit).
3. sudo systemctl restart ocpp.service.
4. Send a test webhook from Razorpay dashboard and confirm it verifies.
This is the single most impactful hardening we can do.
/opt/ocpp/.envinternal/handlers/wallet_handler.go:239-254↗ https://dashboard.razorpay.com/app/webhooks
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
from the conversationclaude: RAZORPAY_SECRET_WEBHOOK=hopewell in .env is weak - anyone who guesses the plaintext can forge webhooks (i.e., forge topups). Regenerate a long random secret in the Razorpay dashboard and update .env, then restart the service. This is the single most impactful hardening you can do.
saravanan: put them in my project tracker - scrumclaw.ai
88d ago
07-31 02:51
07-31 02:51
todo
urgent
Close Cloud SQL to the internet: remove 0.0.0.0 authorized network and require SSL
Instance crypto-track-321e8b45 has a public IP (34.57.238.28), requireSsl=false (ALLOW_UNENCRYPTED_AND_ENCRYPTED), and an authorized network "for EV Connection" = 0.0.0.0 — effectively open to the internet with only the postgres password protecting it. Instance is shared with AdaptiveSAT, Vajra, CitrineOS, tracker. Coordinate with Vajra before removing the EV entry; prefer Cloud SQL connector/Auth Proxy for all clients.
gcloud sql instances describe crypto-track-321e8b45
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The database is effectively open to the internet: public IP, SSL optional, authorized network 0.0.0.0.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08
todo
urgent
Rotate the postgres superuser password and remove it from code
Password is committed/hardcoded in crypto538-core-service/config/production.yaml + staging.yaml, ml-core-service/main.py, and every CoinTrends_Python script (with the public DB IP). Rotation affects every service on the shared instance. Move to Secret Manager (db_password secret already exists) and read at runtime.
crypto538-core-service/config/production.yamlcrypto538-core-service/config/staging.yamlml-core-service/main.py::get_db_connectionCoinTrends_Python/*.py
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The postgres superuser password is committed in several places and every service connects as that superuser.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08
todo
urgent
Revoke the committed prod service-account keys and switch to keyless auth
prj-crypto538-prod-260529-*.json key files are in crypto538-core-service, ml-core-service and CoinTrends_Python. Disable/delete those keys in IAM, remove from repos (history too, or treat as burned), rely on Cloud Run service identity / Workload Identity Federation.
crypto538-core-service/prj-crypto538-prod-260529-9964278419d2.jsonml-core-service/prj-crypto538-prod-260529-c7d42674bd4d.json
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: Production service-account key JSONs are committed in two repos and CoinTrends_Python.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08
todo
urgent
Rotate hardcoded API keys (CoinMarketCap, TAAPI, OpenAI) and web-service .env secrets; move to Secret Manager
Keys hardcoded in core main.go constants (per CODE_REVIEW.md #1). web-service .env / .env.staging / .env.production committed with TOKEN_SECRET_KEY, ENCRYPTION_KEY, Stripe keys etc. Rotate, then inject via Secret Manager env refs on Cloud Run.
crypto538-core-service/main.go:157-165crypto538-core-service/main.go:331crypto538-web-service/.envcrypto538-core-service/CODE_REVIEW.md
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: CoinMarketCap, TAAPI and OpenAI keys are hardcoded in main.go; web-service .env files hold JWT and Stripe secrets.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08
todo
urgent
Lock down core service: require auth, especially /db/execStoredProc, /deletefile, /uploadfile, /purgeStageData, /insertdb
crypto538-core-service is deployed --allow-unauthenticated. Options: make it private (IAM invoker = web-service SA + Scheduler SA) and have the webapp go through web-service only; or add an API-key/OIDC check on admin/write routes. Ties to the item about the webapp calling core directly.
crypto538-core-service/main.go:486-532crypto538-core-service/cloudbuild.yaml
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The core service needs no authentication, including /db/execStoredProc, /insertdb, /uploadfile, /deletefile.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:08
10-16 19:08
todo
urgent
Live predictions are worse than "price stays the same" and ~50% on direction — fix before selling predictions
DB query 2026-10-19, last 30 days, slice 24 (2h ahead), all coins except TON: model error is ~2x the naive no-change baseline (BTC 0.555% vs 0.333%, ETH 0.868% vs 0.436%, DOGE 2.80% vs 0.71%), direction hit rate 49-51% (coin flip), and strong up-bias (DOGE predicts up 100% of the time, SOL/AVAX 89%). Also 2,489 predictions stored as NaN in 30 days. dbo.predictionvsactual is empty, so accuracy was never tracked. Retraining (#90) alone may not fix this — evaluate against the naive baseline in #115 and consider the model/target design.
#90#115dbo.<pair>_predictiondatadbo.predictionvsactual
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: I want you to access the database and query how the data looks like
claude: Compared 30 days of 2h-ahead predictions with actual prices: model error ~2x a no-change baseline, direction ~50%.
7d ago
10-19 14:07
10-19 14:07
todo
high
Verify v3.1 conversation_excerpt rendering
OVERDUE 134d
MORNING.md
claude-project-tracker
· claude-project-tracker
· by saravanan@scrumclaw.ai
from the conversationsaravanan: I want to see the excerpt actually show up in the dashboard.
claude: Captured a high-priority todo to test it.
138d ago
06-10 08:07
06-10 08:07
todo
high
Add POST /webhook/github endpoint to the Go server
Accepts GitHub webhook events (configure on the repo with a shared secret). When a pull_request event with action=closed and merged=true comes in, parse the PR body for `Closes #<item_id>` or `Fixes #<item_id>` patterns and call the existing complete_item path for each. Add: HMAC-SHA256 signature verification using `GITHUB_WEBHOOK_SECRET` env var. Route lives in main.go alongside the other public POST endpoints. Probably one new file github_webhook.go.
api-go/main.goapi-go/handlers_api.go
claude-project-tracker
· claude-project-tracker
· by saravanan@scrumclaw.ai
from the conversationclaude: Webhook handler (medium): Add /webhook/github to the tracker server; parse merged-PR bodies for Closes #<item_id> and call complete_item. Single HTTP handler + webhook secret.
saravanan: [agreed, this is the keystone feature]
137d ago
06-11 11:26
06-11 11:26
todo
high
Deploy nightly question-quality audit cron and confirm 7 consecutive clean runs (REQ-13.11)
BRD v3.0 REQ-13.11 is Pending Deploy. Runbook with ready-to-paste gcloud commands exists; needs the Cloud Scheduler job created and 7 days of error-free runs to close the acceptance.
docs/QUESTION_QUALITY_CRON_SETUP.mddocs/BRD_V3_TRACKER.md
Adaptive SAT
· adaptive-sat
· by saravanan@scrumclaw.ai
💬 2 comments
135d ago
06-13 11:14
06-13 11:14
todo
high
Set GCP project ID in terraform/terraform.tfvars and run terraform apply
terraform/terraform.tfvars.exampleterraform/main.tf
RoadIntelix
· roadintelix
· by Prajith
from the conversationclaude: Terraform IaC written for GCS bucket, Artifact Registry, Cloud Run Job (L4 GPU), and IAM.\nprajith: identify and add open items into tracker\nclaude: Next step — copy terraform.tfvars.example to terraform.tfvars, fill in project_id, then run terraform apply.
131d ago
06-18 04:17
06-18 04:17
todo
high
Build and push Docker image to Artifact Registry
Dockerfile
RoadIntelix
· roadintelix
· by Prajith
from the conversationclaude: Dockerfile created with CUDA 12.1 + cuDNN 8, PyTorch cu121, ultralytics, and bundled YOLO weights.\nclaude: After terraform apply, run: docker build -t $IMAGE . && docker push $IMAGE
131d ago
06-18 04:20
06-18 04:20
todo
high
Ship Android to Google Play — build config DONE; account/store/parity pending
Was deferred; now started. Same Expo codebase as iOS. DONE in code/config: eas.json Android build profiles (APK dev/preview, AAB production) + submit track:internal; app.json android block already complete (package com.hopewellpartners.adaptivesat, adaptive icon, App Links intent filters) — no change needed (appVersionSource:remote manages versionCode). Apple Sign-In correctly iOS-gated; Google sign-in works on Android. PENDING (owner): Google Play Developer account ($25); `eas build --platform android --profile preview` then production AAB; Android OAuth client (SHA-1 → add to GOOGLE_OAUTH_CLIENT_IDS); App Links assetlinks.json (SHA-256) on adaptivesat.ai; Play Console listing + IARC content rating (teen audience) + Data Safety + privacy URL; service account + eas submit. Follow-ons: Google Play Billing IAP (source='google' already supported), FCM push (deferred). Full steps: docs/ANDROID_PLAY_STORE_RUNBOOK.md.
docs/ANDROID_PLAY_STORE_RUNBOOK.mdmobile/eas.jsonmobile/app.json
Adaptive SAT
· adaptive-sat
· by saravanan@scrumclaw.ai
💬 1 comment
127d ago
06-22 03:03
06-22 03:03
todo
high
iOS 2nd rejection (2026-07-24) remediation → build 7 resubmit
Apple rejected build 6 (reviewed on iPad Air M3, iPadOS 26.5.2). Four items. CODE FIXES DONE (mobile, typecheck clean, not yet committed/built): (1) 3.1.2(c) MobilePaywall now has tappable Terms of Use (EULA) + Privacy Policy links and shows title/length/price; (2) 2.1(b) SettingsScreen has a visible 'Upgrade to Premium' row opening the paywall so reviewers can locate the IAP; (3) 2.1(a) ExamStartScreen adds a 30s timeout + clear retry error so 'Start Exam' can't silently hang. ASC METADATA DONE: EULA link added to App Description (saved), Privacy Policy URL confirmed (adaptivesat.ai/privacy). PENDING (owner): check/top-up OpenAI credits (prime suspect for the iPad 'Start Exam did nothing' hang) and retest on iPad; commit+push mobile changes via ship.sh; new EAS production build (build 7); fresh screen recording (Start Exam works + Settings→Upgrade to Premium paywall + sandbox purchase); paste reply (asc_submission/apple_reply_draft.md) in Resolution Center; resubmit app+subscription+group together. Refs: MobilePaywall.tsx, SettingsScreen.tsx, ExamStartScreen.tsx.
mobile/src/components/MobilePaywall.tsxmobile/src/screens/SettingsScreen.tsxmobile/src/screens/ExamStartScreen.tsxasc_submission/apple_reply_draft.md
Adaptive SAT
· adaptive-sat
· by saravanan@scrumclaw.ai
from the conversationsaravanan: [pasted Apple's 2nd rejection: 3.1.2c EULA, 2.1a Start Exam no action on iPad, 2.1b can't find IAP]
claude: Made the 3 code fixes + ASC EULA link; remaining = OpenAI check + build 7 + recording + resubmit with reply.
💬 3 comments
94d ago
07-25 04:08
07-25 04:08
todo
high
Fix float equality in webhook amount check (can silently reject real topups)
ProcessTopupWebhook uses `if topup.Amount != amount` — direct float64 equality. A tiny rounding drift (e.g., 500.00 stored vs 499.99999998 derived from Razorpay's paise/100) will falsely reject the webhook as 'amount mismatch', leaving the user paying but not credited.
Change to:
if math.Abs(topup.Amount - amount) > 0.01 { ... }
Or better: store amount as int64 paise everywhere and compare integers.
internal/repositories/wallet_repo.go:100
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
88d ago
07-31 02:51
07-31 02:51
todo
high
Extend ledger reconciliation migration to handle negative balances
Migration 0027 only inserts positive ADJUSTMENT entries when `wallets.balance > 0 AND gap.amount >= 0.01`. Users whose legacy wallets.balance is 0 (never populated) but who accumulated CHARGE entries end up with negative ledger balances and no automatic reconciliation.
Concrete case: saravanan.hp@gmail.com currently shows balance = -11152.52. Ledger has CHARGE entries but no matching TOPUP history was migrated in.
Options:
(a) Backfill missing legacy topups from external Razorpay reports before running the reconcile.
(b) Add a companion migration that reconciles from a manually-curated CSV of legacy balances.
(c) Add an admin credit tool + audit trail so support can fix these case-by-case.
Track down the actual topup history for affected users (query Razorpay payments API filtered by our account) and decide the right long-term reconciliation approach.
migrations/0027_wallet_ledger_balance_reconcile.up.sqlinternal/repositories/wallet_repo.go:30-48
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
88d ago
07-31 02:51
07-31 02:51
todo
high
TDD: Walk-in UPI QR Pay — final technical design document
After BRD + design review are locked, produce the formal technical design doc covering:
- Sequence diagram (customer → Razorpay → backend → OCPP → charger)
- Data model changes (schema migration text)
- API contracts (webhook handler, admin QR provisioning, guest-mode read endpoints)
- Idempotency + concurrency model
- Failure/retry semantics (webhook re-fires, gun offline, RemoteStart rejected, refund flow)
- SMS content + provider integration details
- Observability (metrics + logs to add)
- Test plan (unit + integration + one live pilot station)
- Rollout / rollback plan
- Estimated effort per phase
Commit finalized TDD to docs/TDD-walkin-qr.md in the backend repo. Only after this ships do we start implementation items.</body>
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
88d ago
07-31 03:24
07-31 03:24
todo
high
Register DLT entity + SMS templates for walk-in flow (English/Hindi/Tamil/Telugu/Kannada)
DLT SMS registration is NOT done. 2–4 weeks external timeline. Track in parallel to Phase 1 build.
Templates needed (send via Fast2SMS post-approval):
- **wk_session_start** — "Vajra Volt: Charging started at {station}·Gun {gun}. ₹{reserved} reserved. Support: 88831-61155."
- **wk_session_low_balance** — "Vajra Volt: Wallet running low (₹{remaining}). Scan QR to add money and keep charging."
- **wk_session_end** — "Vajra Volt: Session complete. Used {kwh} kWh, cost ₹{cost}. Balance ₹{remaining}. Reply CLAIM to link this account."
- **wk_payment_gun_busy** — "Vajra Volt: Payment ₹{amount} received but Gun {gun} is unavailable. Amount saved to your wallet. Support: 88831-61155."
- **wk_refund_initiated** — "Vajra Volt: Refund of ₹{amount} initiated to your UPI. Reflects in 1–3 business days."
All 4 languages (Q11 answer). English variants can be filed immediately; regional translations need vendor.
Phase 1 launches WITHOUT SMS (see decision item). SMS goes live in Phase 1.5 once DLT approved.</body>
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
85d ago
08-02 11:44
08-02 11:44
todo
high
Pilot: end-to-end test on real UPI apps (BHIM/GPay/PhonePe/Paytm) at VAJRA0001
Pre-launch gate for Phase 1. Test matrix:\n\n- App: BHIM, Google Pay, PhonePe, Paytm, WhatsApp Pay (5 apps)\n- Amount: ₹100, ₹500, ₹1000 (3 amounts)\n- Scenario: happy path, gun offline (simulate), gun already charging, RemoteStart rejected (simulate)\n\nTotal ~30 test runs at pilot station. Log any UPI-app-specific quirks (BHIM in particular has stricter parsing).\n\nWhoever pilots — use throwaway UPI-linked phone number so we can also validate the walk-in-user creation path (not an existing app user's phone).\n\nBlocked on Phase 1 implementation complete + QR sticker printed.</body>
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
85d ago
08-02 11:53
08-02 11:53
todo
high
Ops: pilot station rollout at VAJRA0001 (2 QR stickers)
Physical rollout for Phase 1 pilot.\n\n- Confirm which station is the pilot (default VAJRA0001)\n- Send print design (#56) to signage vendor (#Q17 answer: existing vendor)\n- Receive 2 laminated A5 stickers (Gun 1 + Gun 2)\n- Physically apply to gun/panel\n- Coordinate with ops staff to be on-site during pilot testing window\n- Document station-owner communications (landlord awareness of pilot)\n\nBlocked on #56 (design finalized) + Razorpay QR issued (#52 + #61).</body>
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
85d ago
08-02 11:53
08-02 11:53
todo
high
Exam: within-module back/forward navigation + change answers + question navigator (Bluebook parity) — web AND mobile
Owner noticed the full exam has no back/forth between answered questions. Root cause: exam engine is forward-only by design. Backend get_next_exam_question serves the next UNSEEN question and immediately consumes it (status→ANSWERED); /answer records a single Attempt; no endpoint to re-fetch a prior question, change an answer, or list the module; ExamQuestionStatusEnum has only UNSEEN/ANSWERED/SKIPPED (no FLAGGED/REVIEW). Same limitation on WEB (frontend ExamSession.tsx) since it's the same backend — whole-product gap, not mobile-only. Real Digital SAT (Bluebook) allows free within-module navigation, changing answers, and a question navigator with mark-for-review until the module timer ends. SCOPE (multi-day, cross-cutting): backend — serve whole module, mutable per-question answers until module submit/timer, add flag/review state, add submit-module step (stop consume-on-serve); web+mobile — question navigator UI (grid + flags), Back/Next, module answer state, submit at module end. NOT an App Store blocker — sequence AFTER build 7 clears review. Refs: backend/app/services/exam_service.py (get_next_exam_question, submit_exam_answer), backend/app/models/exam_module_question.py, mobile/src/screens/ExamSessionScreen.tsx, frontend/src/app/pages/ExamSession.tsx.
backend/app/services/exam_service.pybackend/app/models/exam_module_question.pymobile/src/screens/ExamSessionScreen.tsxfrontend/src/app/pages/ExamSession.tsx
Adaptive SAT
· adaptive-sat
· by saravanan@scrumclaw.ai
from the conversationsaravanan: I need the option to go back and forth for the questions in the full test — why is it not enabled?
claude: Exam engine is forward-only (serves next UNSEEN, consumes it, one Attempt each; no revisit/flag) on web+mobile. Real feature to add; not an App Store blocker — do after build 7.
💬 5 comments
77d ago
08-10 14:05
08-10 14:05
todo
high
Change seeded CMS admin password — admin123 is in the migration file and the CMS is now public
VajraCMS went live at https://cms.vajravolt.com on 2026-09-07. The seed account created by VajraBackendGo/migrations/0033_cms_user.up.sql is admin@vajravolt.in / admin123 — the plaintext password is written in the migration, so anyone with repo access has working credentials to the production CMS.
Saravanan chose to defer this on the day. Not blocking anything, but it should not sit for long.
If there is no change-password UI yet, on the VM:
UPDATE "CMSUser" SET password_hash = crypt('NEW', gen_salt('bf',10)) WHERE email='admin@vajravolt.in';
(pgcrypto bcrypt matches what the CMS auth controller compares against)
Verify the old one stops working:
curl -s -o /dev/null -w '%{http_code}\n' -X POST https://cms-api.vajravolt.com/api/v1/auth/login \
-H 'Content-Type: application/json' -d '{"email":"admin@vajravolt.in","password":"admin123"}'
Expect 401.</body>
migrations/0033_cms_user.up.sql↗ https://cms.vajravolt.com
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
from the conversationclaude: admin@vajravolt.in / admin123 is written in plaintext in migration 0033 and the CMS is now on the public internet — anyone with repo access has working credentials.
saravanan: no pwd change now -
claude: Noted — leaving it, tracked as open.
49d ago
09-07 22:20
09-07 22:20
todo
high
After dev promotion, smoke-test semgrep on a PYTHON repo, not only C#
697e0dd47 raised the declared semgrep version to 1.176.0 for BOTH csharp and python. 76032c488 then made readiness permit a mismatch only when observed >= declared.
So any cell still serving an image built with semgrep 1.70.0 or 1.95.0 will now be refused on both languages — where before, Python worked. The image-digest staleness check in 76032c488 should force reconciliation, but that needs verifying rather than assuming.
A C#-only smoke test will not catch this. Run a Python-language repository and confirm semgrep still produces output. Symptom if a cell does not reconcile: semgrep reporting VERSION_MISMATCH on a language that worked the day before.
697e0dd76032c4backend/database/alembic/catalog_master.py:2161,3738shared/persistence/tool_readiness_policy.py:140-210
Testable (Pramora)
· testable-platform
· by saravanan@scrumclaw.ai
27d ago
09-29 16:26
09-29 16:26
todo
high
Diagnose why coverage and mutation tasks never dispatch (22-26 metrics dark per run)
Every one of the 12 runs reviewed reports Coverlet, altcover, nyc, vitest, Stryker.NET and StrykerJS producing nothing. That is the entire "are the tests any good?" half of the product, dark in every run.
Do NOT accept the claim that the capability is missing. coverlet_runner.py:159-162 runs `dotnet test --collect:"XPlat Code Coverage"`, and altcover_runner.py, stryker_net_runner.py, stryker_ts_runner.py and vitest_coverage_runner.py all exist. Adding a new harness would duplicate working code. (One uploaded consolidated report claimed the opposite and cited runtime_planner.py:120, which is a function that caps planner loop iterations.)
Steps: take one run where these rows read "planned tasks did not start", pull the planner's decision for those specific tool assignments, and establish which of three things happened — the task was never created, it was created and never leased, or it was dropped at the readiness gate. Each has a different fix. Only then write the ticket.
This is fix-plan item 1.6 and is the only item where the cause is genuinely unknown.
backend/wb-cpu-worker/app/analyzers/csharp/coverlet_runner.py:159-162shared/scoring/gate_scoring.py:1692
Testable (Pramora)
· testable-platform
· by saravanan@scrumclaw.ai
27d ago
09-29 16:26
09-29 16:26
todo
high
Move model training to cloud and retrain — prediction models last trained 2025-10-30
Inference runs every 5 min (Scheduler prediction_calls → ml /run_prediction) on 120 DARNN models in gs://nlp_ml_files/prediction_files last written 2025-10-30. Training lives in CoinTrends_Python (local Windows GPU box, localhost Flask chain :17000 → :5000). Target: Cloud Run Job or Vertex AI custom job with GPU, parameterised by asset + minute offset, triggered by Scheduler, creds from Secret Manager, metadata write-back to cryptopredictionslicemaster.
CoinTrends_Python/master_create_update_latest.pyCoinTrends_Python/api_latest.pyCoinTrends_Python/ModelCreation_latest.pygs://nlp_ml_files/prediction_files/
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: Predictions run on year-old models — the 120 model files were last trained 30 Oct 2025 and nothing retrains them.
saravanan: create cointrends in tracker and push these items there
💬 1 comment
10d ago
10-16 19:09
10-16 19:09
todo
high
Fix training pipeline bugs: cursor.commit() and undefined connection in NaN-loss branch
ModelCreation_latest.py calls cursor.commit() — psycopg2 cursors have no commit() (needs cnxn.commit()), and the second NaN branch uses cnxn which is only defined in the first branch. Result: a failed training run never gets marked activeflag='I'. Also .cuda() hard-coded; pyodbc import leftover.
CoinTrends_Python/ModelCreation_latest.py:315-340
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The training pipeline has real bugs: cursor.commit() doesn't exist in psycopg2 and the NaN-loss branch uses an undefined connection.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:09
10-16 19:09
todo
high
Create least-privilege DB users per service and a read-only analysis role
core-service, ml-core-service and web-service all connect as postgres superuser on a shared instance. Create e.g. cointrends_core (rw on CryptoTrack_Prod.dbo), cointrends_ml (read + prediction tables), cointrends_web (CryptoUserBilling_Prod), cointrends_ro (SELECT only, for analysis/Claude).
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: There's no read-only database role, and every service connects as the superuser.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:09
10-16 19:09
todo
high
Replace log.Fatalf in core-service request paths and goroutines with returned errors
insertDataIntoDB and other handlers call log.Fatalf on upstream/DB errors, which kills the whole Cloud Run instance (CODE_REVIEW #7, #17). Return errors and let the handler respond 500.
crypto538-core-service/main.go::insertDataIntoDBcrypto538-core-service/CODE_REVIEW.md
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The core service calls log.Fatalf inside request paths, which kills the whole process on any upstream error.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:09
10-16 19:09
todo
high
Generalise per-asset hard-coding — prerequisite for stocks, commodities and indexes
Each coin has its own table family (pricedata, ohlcv, predictiondata, indicators, indicators_plus + view). Coin list is hard-coded in CASE statements in getcryptodata, getpricedataforcurrencies, getcurrencydetails, and in crypto_id == 1 or ... lists in ml-core-service and CoinTrends_Python. Design an asset-agnostic schema (asset master + long-format tables keyed by asset_id) and drive code from cryptomaster/asset master.
dbo.getcryptodatadbo.getpricedataforcurrenciesdbo.getcurrencydetailsml-core-service/main.py::func
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: Coin-specific logic is hard-coded everywhere; adding any asset means editing many places by hand.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:09
10-16 19:09
todo
high
Training 1/5: Refactor CoinTrends_Python into one secret-free training package (merge orchestrator + trainer)
Take *_latest.py versions only. Fold master_create_update_latest.py decision logic (create vs incremental update, check_record_count) and api_latest.py/ModelCreation_latest.py training into one CLI entrypoint: train --asset BTCUSD --minute 15. Remove Flask/localhost HTTP, hardcoded DB host/password, SA key, Windows paths; read config from env. Fix cursor.commit() and NaN-branch bugs (#91). Make device selection automatic (cuda if available else cpu). Once secret-free, this can go into a git repo (unblocks decision #108).
CoinTrends_Python/master_create_update_latest.pyCoinTrends_Python/api_latest.pyCoinTrends_Python/ModelCreation_latest.pyCoinTrends_Python/darnn.py
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: where is the model training to be moved to CloudRun (GPU based)
claude: Broke #90 into subtasks; step 1 is a single secret-free training entrypoint.
💬 2 comments
10d ago
10-16 19:11
10-16 19:11
todo
high
Training 2/5: Build GPU container image (CUDA PyTorch base) via Cloud Build → Artifact Registry
Dockerfile on a CUDA-enabled PyTorch base, pinned versions, psycopg2 + cloud-sql-python-connector + google-cloud-storage. Push to us-central1-docker.pkg.dev/prj-crypto538-prod-260529/crypto538-container-images/ml-training. Cloud Build config alongside.
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: where is the model training to be moved to CloudRun (GPU based)
claude: Step 2: GPU container image built by Cloud Build into Artifact Registry.
10d ago
10-16 19:12
10-16 19:12
todo
high
Training 3/5: Create Cloud Run Job with L4 GPU, dedicated service account, Secret Manager creds, task-index fan-out
gcloud run jobs create ml-training --gpu 1 --gpu-type nvidia-l4 (us-central1; confirm GPU quota/region availability first). Dedicated SA with only: Cloud SQL Client, read/write on gs://nlp_ml_files/prediction_files, secret accessor on the DB secret. --tasks = assets × 12 offsets (120 today), --parallelism capped to quota; CLOUD_RUN_TASK_INDEX → (asset, minute). Codify in crypto538-terraform. Note: #98 — only this SA should be able to write model files.
#98crypto538-terraform/environments/prod/main.tf
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: where is the model training to be moved to CloudRun (GPU based)
claude: Step 3: Cloud Run Job with L4 GPU, least-privilege SA, task-index fan-out over asset × minute.
10d ago
10-16 19:12
10-16 19:12
todo
high
Training 4/5: Run a full retrain and validate new models against predictionvsactual before switching inference
Write new models to a staging prefix first, backtest vs the Oct-2025 models (MAE/RMSE, directional accuracy) on recent data, then promote by updating cryptopredictionslicemaster paths. Keep the old files as rollback.
dbo.predictionvsactualdbo.cryptopredictionslicemaster
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: where is the model training to be moved to CloudRun (GPU based)
claude: Step 4: full retrain to a staging prefix, backtest vs old models, then promote.
10d ago
10-16 19:12
10-16 19:12
todo
high
Create a dedicated least-privilege DB user for ml-training before scheduling Batch training
Batch training currently connects as `postgres`, the admin of the shared Cloud SQL instance crypto-track-321e8b45, which other products also use. Before scheduling, create a user with access to only the CryptoTrack_Prod objects training needs: getcryptodata, cryptomaster, cryptopredictionslicemaster and updatetracking. Store its password in a new secret and point batch/*.json at it.
HopewellPartners/ml-training batch/*.json#83-#87
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
7d ago
10-20 02:16
10-20 02:16
todo
high
PR "Coin Roster": make cryptomaster the only coin list; onboard any coin with dbo.onboard_coin()
8 steps, one PR per layer: DB onboarding function; DB collection; DB readers; core-service roster cache; ml-core-service; webapp; ml-training Batch task count; end-to-end proof with a new coin. Full instructions: cointrends/plans/PR-coin-roster.md (also in the project docs as claude/PR-coin-roster.md). Open questions: ship before or after Locked Door (#129); how DDL gets executed; which repo holds DB migrations.
plans/PR-coin-roster.md#129#118
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
💬 2 comments
6d ago
10-20 12:53
10-20 12:53
todo
high
Re-enable stopped feeds: news, Fear & Greed, gainers/losers, trade recommendations
fetchCryptoNews, insertFearAndGreedHandler commented out in core insertDataIntoDB; recommendations stopped 2025-03; gainers 2025-10-13. Uncomment / re-schedule, refresh provider keys (via Secret Manager). Brings Market Insights back to life. Gap-fill #1.
crypto538-core-service/main.go
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
💬 1 comment
5d ago
10-22 02:44
10-22 02:44
todo
high
BRD23-C: CB label mapping + review/confirm endpoints + admin queue
Map College Board labels to Skill via skill_aliases (exact match on the normalised form). Unmatched rows persist with skill_id NULL and the raw label, are excluded from weak-topic ranking until mapped, then count retroactively once an alias exists.
Resolution is an ADMIN job, never the student's (REQ-23.14). CB's report taxonomy is a small fixed set, so each unknown label is mapped once and resolved for everyone; after a handful of real reports the queue goes quiet. Students only ever correct numbers they can verify against the report in their hand — they never see our internal taxonomy.
No dependency on the vision model — can start immediately, in parallel with BRD23-D.
backend/app/models/score_report.pybackend/alembic/versions/030_score_report_history.py
Adaptive SAT
· adaptive-sat
· by saravanan@scrumclaw.ai
3d ago
10-24 03:00
10-24 03:00
todo
high
Pricing $1.99/mo + $19.99/yr: Stripe prices + ASC price edit + reviewer notes
Code strings are shipped (#132). Remaining is dashboard config:
- Stripe: price amounts are immutable, so create NEW price objects, then add new secret versions for STRIPE_PRICE_ID and STRIPE_PRICE_ID_MONTHLY.
- App Store Connect: price is a property of the existing subscriptions — edit com.adaptivesat.premium.annual and .monthly in place. Product IDs unchanged, so RevenueCat needs nothing.
- CRITICAL: the App Review notes on version 1.0 currently quote "$0.99 per month" and "$9.99 per year". Update before submitting or the reviewer sees notes that contradict the live price — a rejection risk on its own.
Trial stays annual-only, so billing_service.give_trial needs no change. No existing subscribers, so no grandfathering or price-increase consent flow — materially harder to change later.
PR#132
Adaptive SAT
· adaptive-sat
· by saravanan@scrumclaw.ai
3d ago
10-24 03:00
10-24 03:00
todo
Render refs[] as clickable PR/issue badges on the dashboard
Pure frontend change in the Go templates. When a ref looks like a GitHub URL (github.com/.../pull/N or .../issues/N), render it as a styled badge with the PR/issue number. Other refs render as code chips like today. Templates touched: detail.html, pending.html, possibly dashboard.html log lines.
api-go/templates/detail.htmlapi-go/templates/pending.html
claude-project-tracker
· claude-project-tracker
· by saravanan@scrumclaw.ai
from the conversationclaude: Tracker plugin tweak (small): Make the existing refs field render GitHub URLs as PR/issue badges on the dashboard. Pure frontend.
saravanan: [agreed, included in plan]
137d ago
06-11 11:26
06-11 11:26
todo
Plugin hook: comment on linked PR when a todo is completed
In tracker_complete_item, if the item's refs[] contains a GitHub PR URL and a GITHUB_TOKEN is configured, POST a comment to the PR like "✅ tracker item #<id> ('<title>') marked done by <user>". Best-effort — log on failure, don't block the tracker update. Requires the plugin to know the GitHub token (new optional env var or read from gh CLI config).
plugin/mcp/server.py
claude-project-tracker
· claude-project-tracker
· by saravanan@scrumclaw.ai
from the conversationclaude: [feature in scope] comment on linked PR when a todo completes
saravanan: [agreed, part of plugin-side hooks]
137d ago
06-11 11:26
06-11 11:26
todo
Run deferred QA walkthroughs once shipped: Rush (15.8), Vocab mastery (18.7), Planner scratch→dashboard (19.6), dashboard <500ms p50 (14.8), report→queue→DELETE (13.10)
These BRD v3.0 acceptance items are code-complete but marked Ready for QA / Pending QA — manual walkthroughs and the prod p50 latency measurement were deferred until ship.
docs/BRD_V3_TRACKER.md
Adaptive SAT
· adaptive-sat
· by saravanan@scrumclaw.ai
135d ago
06-13 11:14
06-13 11:14
todo
Upload test video and Location.csv to GCS inputs/ folder
RoadIntelix
· roadintelix
· by Prajith
from the conversationclaude: Job reads VIDEO_BLOB and GPS_BLOB from GCS bucket.\nclaude: gsutil cp your_video.mp4 gs://$BUCKET/inputs/ && gsutil cp Location.csv gs://$BUCKET/inputs/
131d ago
06-18 04:21
06-18 04:21
todo
Technical debt: test enforcement + quality gates + silent-failure/dead-code cleanup
Consolidated tech-debt item (full register: docs/TECH_DEBT.md). Verified against the repo after a whitebox gate report (run 61e7d93e, commit 11639ae) whose own scores were unreliable. Sev1 (test enforcement): backend 51 pytest files but conditional-skip → no-op in CI (seed DB + key/mock); frontend+mobile have 0 unit tests; tsc --noEmit + lint not required PR checks (TS6133 noise). Sev2 (silent failures): bare except:pass in exam_service.py:175/194 + note_service.py:278; insights_service.py:479 most_improved/needs_attention hard-coded None (parent digest degrades). Sev3 (gates): no pre-commit secret scanning (gitleaks), no npm audit/pip-audit in CI. Sev4 (cleanup): delete mobile/App.tsx.full duplicate; remove dead comingSoon/*_ENABLED branches. Sequence Sev1→4; each ships as a small PR. No feature impact.
docs/TECH_DEBT.mdbackend/app/services/exam_service.py:175backend/app/services/insights_service.py:479mobile/App.tsx.full
Adaptive SAT
· adaptive-sat
· by saravanan@scrumclaw.ai
💬 1 comment
127d ago
06-22 02:17
06-22 02:17
todo
Mobile exam: add passage highlighting (parity with web PassageHighlighter, REQ-9.2)
Web has frontend/src/app/components/PassageHighlighter.tsx (Bluebook-style select-to-highlight + per-highlight notes, char-offset ranges). Mobile ExamSessionScreen renders question_text as a plain <Text> (line ~503) with no highlight/annotate. Gap noticed by owner while testing the full exam on mobile. Non-trivial in RN: no DOM selection; needs a custom passage renderer (tappable/selectable spans → highlight ranges), persisted per-question highlights, optional notes, erase/clear. NOT an App Store blocker — sequence AFTER the build-7 resubmission clears review. Ref: mobile/src/screens/ExamSessionScreen.tsx, frontend/src/app/components/PassageHighlighter.tsx.
mobile/src/screens/ExamSessionScreen.tsxfrontend/src/app/components/PassageHighlighter.tsx
Adaptive SAT
· adaptive-sat
· by saravanan@scrumclaw.ai
💬 2 comments
91d ago
07-27 21:18
07-27 21:18
todo
Fix topup amount range mismatch (min=1 vs error message '100')
Backend constant minTopupAmount is 1 but the error message and frontend both say the minimum is 100. Change minTopupAmount to 100 so the backend actually enforces what the message claims — otherwise a bespoke client can top up ₹1 (bypasses the intended floor).
- const minTopupAmount = 1
+ const minTopupAmount = 100
internal/handlers/wallet_handler.go:29-30internal/handlers/wallet_handler.go:87
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
88d ago
07-31 02:51
07-31 02:51
todo
Fix Razorpay prefill.contact — uses email as fallback, breaks UPI autofill
Frontend passes `me.phone_number || storedEmail || ''` into Razorpay's prefill.contact. That field expects a phone number and is used to auto-detect UPI apps. Passing an email makes checkout look wrong and skips UPI autofill.
Fix: only set prefill.contact when we have an actual phone number; put the email into prefill.email instead.
prefill: {
name: userName,
contact: me?.phone_number?.trim() || undefined,
email: storedEmail || undefined,
}
app/(tabs)/profile/add-money.tsx:178-192
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
88d ago
07-31 02:51
07-31 02:51
todo
Rate-limit / IP-allowlist /webhooks/payment endpoint
The webhook endpoint currently accepts any POST from anywhere. HMAC signature check is the only defense — cryptographically sound, but each invalid request still triggers signature compute + JSON parse + DB lookup, so it's a cheap DoS vector.
Two things worth adding (nginx-level is easiest):
1. Restrict source IPs to Razorpay's published webhook IPs (they publish a list): allow only those in the nginx server block for /webhooks/*.
2. Rate-limit /webhooks/* at nginx (limit_req_zone). Even a modest 20 rps burst limit stops volumetric noise.
Doesn't change functionality, just hardens.
internal/routes/routes.go:161-163internal/handlers/wallet_handler.go:239-303/etc/nginx/sites-available/vajraev
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
88d ago
07-31 02:51
07-31 02:51
todo
Design print-ready A5 QR sticker with station+gun ID + typical-cost hint
BRD Q8 spec locked:
- A5 landscape (5.8" × 8.3"), vinyl, laminated for outdoor durability
- Contents: Razorpay QR image (large, centered) + human-readable station+gun ID (e.g., "Vajra Volt · VAJRA0001 · Gun 2") + typical-cost hint ("Typical 30-min charge ≈ ₹150–300")
- Support phone number visible
- English only (Q20 answer)
- Print files: SVG + PDF at 300 DPI
- Vendor: existing signage vendor already identified (Q17)
Sample layout:
[ Vajra Volt logo ] [ QR CODE 4"x4" ]
VAJRA0001 · Gun 2
Scan any UPI app to pay
Typical charge ≈ ₹150–300
Support: 88831-61155
Deliverable: printable design ready for vendor.</body>
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
85d ago
08-02 11:45
08-02 11:45
todo
SMS templates + Fast2SMS integration for walk-in (Phase 1.5)
Behind WALKIN_QR_SMS_ENABLED flag. 5 templates × 4 languages (see #53).\n\nBackend changes:\n- Templates stored in Go source (map[templateKey]map[lang]string) with DLT template IDs from #53\n- Language selection: prefer user.preferred_language if set; fallback to English\n- Dispatch service reuses existing Fast2SMS integration (already in codebase for OTP)\n- Fire-and-forget from webhook handler (async goroutine); log failures but don't block webhook response\n\nBlocked on DLT approval (#53).</body>
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
85d ago
08-02 11:52
08-02 11:52
todo
Admin console: "list payments for QR" endpoint (Razorpay debug aid)
Useful for ops debugging (missing webhook, dispute lookup, reconciliation).
Wraps Razorpay:
GET https://api.razorpay.com/v1/payments/qr_codes/:qr_id/payments
Backend endpoint:
GET /admin/chargers/:charger_id/connectors/:connector_id/payments
Returns array of payments captured against that gun's QR (all-time), each with vpa, contact, email, amount, timestamp, status. Enables ops to answer "who paid at this gun today" without querying our DB.
Small addition to the admin endpoints in #65. Roughly 1 hour of Go + admin console UI work.</body>
scrumclaw#61scrumclaw#65
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
85d ago
08-02 12:10
08-02 12:10
todo
Backlog: Dockerfile.dotnet still never reads INSTALL_MANIFEST
47b5c3a1a worked around fix-plan item 1.2 by reassigning jscpd-cs to the node family and lizard, semgrep, semgrep-perf-static and pydriller to python — a legitimate choice, executed thoroughly (it also fixed the node alias key cve-lite -> cve-lite-cli and updated csharp_tool_readiness.py to return NOT_APPLICABLE for borrowed tools).
But docker/runtime/Dockerfile.dotnet still has no ARG INSTALL_MANIFEST and no COPY of it — confirmed unchanged between origin/qa and origin/dev. Unlike Dockerfile.node:11,24 and Dockerfile.python:15,31, the reconciler generates a manifest for it and the template discards it.
Any future tool assigned to the dotnet family will fail the same way, silently. Not a release blocker; close the gap when the dotnet family next needs a tool it does not already ship.
47b5c3adocker/runtime/Dockerfile.dotnetdocker/runtime/Dockerfile.node:11,24shared/persistence/runtime_install_manifest.py
Testable (Pramora)
· testable-platform
· by saravanan@scrumclaw.ai
27d ago
09-29 16:27
09-29 16:27
todo
Work through open CODE_REVIEW.md issues in core-service (timeouts, goroutines, bounds checks, double Close, T-SQL @ID)
April 2026 review lists 20 open issues. Highlights: no HTTP client timeouts (#6), unbounded goroutines in fetchCryptoNews (#8), Choices[0] with no bounds check (#3), double db.Close() in UpdateCryptoNewsExtractByURL (#4), T-SQL @ID syntax in IsNewsExtractNull fails on Postgres (#5), no MaxBytesReader (#11), rows.Err() unchecked (#12).
crypto538-core-service/CODE_REVIEW.md
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The April code review's 20 issues are still open (timeouts, goroutines, Choices[0], double Close, T-SQL @ID).
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:09
10-16 19:09
todo
Use one shared DB connection pool in core-service instead of a new pool per call
getDbConnection() → connectWithConnector() builds a new sql.DB (and Cloud SQL dialer) on nearly every call, with defer db.Close(). Create one pool at startup and reuse it; set pool limits once.
crypto538-core-service/main.go:570-650
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: A new connection pool is created on almost every call, instead of one shared pool.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:09
10-16 19:09
todo
Route the webapp through web-service only (stop calling core-service directly)
crypto538-webapp uses REACT_APP_COIN_DATA_BASE_URL pointing at the public core-service Cloud Run URL, bypassing web-service auth/plan checks. Needed before core-service can be made private.
crypto538-webapp/.env.production::REACT_APP_COIN_DATA_BASE_URL
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The webapp calls the core service directly, bypassing the web service's authentication layer.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:09
10-16 19:09
todo
Restrict write access to gs://nlp_ml_files — ML service unpickles models with weights_only=False
ml-core-service torch.load(..., weights_only=False) and np.load(allow_pickle=True) on files from GCS: anyone who can write to that bucket can execute code in the ML service. Limit bucket writers to the training job identity; consider safetensors / weights-only state_dict.
ml-core-service/main.py::predict
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The ML service unpickles model files from GCS (weights_only=False); bucket write access = code execution.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:09
10-16 19:09
todo
Revisit the 12-models-per-asset design before scaling to new asset classes
One DARNN per 5-minute offset (desired_minute 0..55) → 12 models per coin, 120 today. Consider one model per asset with minute-of-hour as a feature, and a horizon suited to each asset class (e.g. daily for stocks/indexes).
CoinTrends_Python/trigger_updated.py
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: Each asset needs 12 models (one per 5-minute offset), which multiplies training cost and makes the model count grow fast.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:09
10-16 19:09
todo
Consolidate the three LLM backends and cut always-on Ollama cost
crypto538-askgenie-service (Ollama llama3, 16 GB, 4 CPU, min-instances=1, no CPU throttling — billed 24/7) plus a separate llama-cpu Cloud Run service plus OpenAI calls from core. Pick one backend for Genie/recommendations and scale the rest to zero or delete.
crypto538-askgenie-service/cloudbuild.yamlcrypto538-core-service/main.go::llamaCompletion
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: Three LLM backends run side by side; Ollama runs at 16 GB with min-instances=1 and is billed around the clock.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:09
10-16 19:09
todo
Align pricing page with what exists (analyst chat, trading agent; Premium vs Standard coins)
/pricing promises "Live chat with an Analyst" and "On-demand automated trading agent" (not built). Premium lists the same 10-coin access as Standard. Either build, mark "coming soon", or remove.
↗ https://www.cointrends.ai/pricingcrypto538-webapp/src/subscriptionPlansPage/page.jsx
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The pricing page promises features that don't exist (analyst chat, trading agent); Premium lists the same coins as Standard.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:09
10-16 19:09
todo
Training 5/5: Schedule recurring retrains with Cloud Scheduler and add failure alerting
Cloud Scheduler → Cloud Run Jobs run API (cadence TBD, e.g. weekly full / daily incremental using the existing updatetracking logic). Alert on failed executions and on stale models (modelfile older than N days). Retire the Windows box flow.
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: where is the model training to be moved to CloudRun (GPU based)
claude: Step 5: Scheduler-driven retrains plus alerting; retire the local box.
10d ago
10-16 19:12
10-16 19:12
todo
PR "Open Markets": extend the platform to stocks, indexes, commodities and FX (after Coin Roster)
Design in cointrends/plans/PR-open-markets.md (also in project docs). Main pieces: per-asset prediction config (horizon, step, offsets, feature set); calendar-aware sampling for markets that close; versioned feature sets with model metadata; context data as roster assets (replaces the frozen marketindex/metalsdata); pluggable data providers with locally computed indicators; site routes and entitlements per asset class. Open decisions: pilot assets, data provider and budget, URL scheme, subscriptions model.
plans/PR-open-markets.mdplans/PR-coin-roster.md#130
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
6d ago
10-20 12:55
10-20 12:55
todo
Alerts: prediction flips / confidence changes via email (Azure) for Standard+ users
Watchlist + alert prefs in web-service (CryptoUserBilling_Prod); reuse Azure Communication Email. Gap-fill #4.
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
5d ago
10-22 02:44
10-22 02:44
todo
Paper trading (currently "coming soon") on existing pricedata + predictions
paper_trades table in CryptoUserBilling_Prod, two web-service endpoints, UI page. Premium perk. Gap-fill #5.
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
5d ago
10-22 02:44
10-22 02:44
todo
Ask Genie: retrieval over our own data (indicators, predictions, scorecard, news)
Keep Ollama; add retrieval so Genie answers "why is BTC predicted down?" from our tables. API LLM only as optional fallback. Gap-fill #6.
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
5d ago
10-22 02:44
10-22 02:44
todo
API keys for Premium/Developer in front of existing core endpoints (after Locked Door #129)
API-key middleware in web-service proxying /getPriceData, /getCryptoIndicators, /getActualPrediction etc. Sell as B2B to bot builders / small fintechs. Depends on #129. Gap-fill #7.
#129
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
5d ago
10-22 02:44
10-22 02:44
todo
BRD23-E: mobile screens — upload, review, weak topics, drill
Upload (camera / photo library / file) → review-and-correct (numeric fields only) → score summary + ranked weak topics → drill screen with the four-part feedback block. Upload becomes the mobile front door (REQ-23.9); the full-length exam stays available but stops being the required entry point.
Depends on BRD23-C and BRD23-D.
Note: mobile currently has NO upload path at all — REQ-19.1 excluded it because Expo's document picker isn't installed. Web has had PDF upload since Bundle 11.
mobile/src/navigation/RootNavigator.tsx
Adaptive SAT
· adaptive-sat
· by saravanan@scrumclaw.ai
3d ago
10-24 03:00
10-24 03:00
todo
low
Background poll: mirror GitHub issues as tracker items
Deferred until items #4 and #5 (the close-on-merge webhook and the PR badges) prove valuable. When ready: a background goroutine in the Go server polls `GET /repos/:owner/:repo/issues` every N minutes and upserts each issue as a tracker item (linking via parent_item_id or a new `external_id` column). Two-way write-back on completion. Per-project repo config in claude_projects (probably a new repo_url is already there).
api-go/main.go
claude-project-tracker
· claude-project-tracker
· by saravanan@scrumclaw.ai
from the conversationclaude: Issue mirror (larger): Background job that polls GET /repos/:owner/:repo/issues and upserts. Defer until 1–3 prove valuable.
saravanan: [agreed, defer]
137d ago
06-11 11:26
06-11 11:26
todo
low
[Phase TBD] Add iPad support for iOS app (deferred — not required for initial launch)
Per decision on 2026-06-13, iPad support is not required for the initial App Store submission (iPhone-only). Revisit in a future phase: iPad layout/adaptivity pass + iPad screenshots in App Store Connect. No target date.
docs/BRD5_PHASE_5A_5B_NOTES.md
Adaptive SAT
· adaptive-sat
· by saravanan@scrumclaw.ai
135d ago
06-13 11:19
06-13 11:19
todo
low
Remove deprecated Razorpay 'payment_capture: 1' from order create
Razorpay deprecated the payment_capture parameter for the Orders API — capture behavior is now controlled at the account/merchant level. Not a functional bug today, but noise, and Razorpay may eventually reject unknown fields in future API versions.
Drop the key from the payload in createRazorpayOrder.
internal/handlers/wallet_handler.go:340
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
88d ago
07-31 02:51
07-31 02:51
todo
low
Remove deprecated Razorpay code from core-service (marked in PR #70)
Delete razorpay_webhook.go, razorpay_webhook_test.go and the /webhooks/razorpay route; also the dead /users and /payments handlers. Zero traffic in 30 days of Cloud Run logs. Deprecation comments merged 2026-10-16 (c3ef045).
↗ HopewellPartners/crypto538-core-service#70crypto538-core-service/razorpay_webhook.gocrypto538-core-service/main.go:490
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: Razorpay we dont use it - just add comments above the code blocks and do not delete. we will do it later.
claude: Deprecation notes merged in PR #70; removal tracked as a later cleanup.
10d ago
10-16 19:10
10-16 19:10
todo
low
Clean up CryptoTrack_Prod junk and legacy objects
Duplicate public.getcryptodata variants, public.gainers_json, public.market_metal_data, dbo.table_1, dbo.table_2, dbo.debugtable, dbo.jsondatatowork; legacy dbo.usertable / dbo.paymentdetails / manageuserandpayments() (users now live in CryptoUserBilling_Prod). Check row counts and archive before dropping.
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: The database carries MSSQL heritage: duplicate functions in public, junk tables, legacy usertable/paymentdetails.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:10
10-16 19:10
todo
low
Restore engineering basics: tests in Cloud Build, a working stage env, READMEs
Test step commented out in core-service cloudbuild.yaml; stage LB and purge job commented out in terraform; webapp/web-service/terraform sit on a stage branch diverged from master; READMEs empty; log retention 30 days. Also split the 3.9k-line core main.go into packages.
crypto538-core-service/cloudbuild.yamlcrypto538-terraform/environments/stage/main.tf
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: what are the issues you identified in cointrends?
claude: Testing and environments are thin: tests disabled in Cloud Build, stage infra commented out, READMEs empty.
saravanan: create cointrends in tracker and push these items there
10d ago
10-16 19:10
10-16 19:10
todo
low
Final cleanup: remove/confirm everything Claude added to GCP during the review
Footprint so far (none of it changes how prod runs): (1) IAM: Cloud SQL service account p475046183936-kjdopc@gcp-sa-cloud-sql granted objectAdmin on gs://crypto538-prj-crypto538-prod-260529-bucket (needed for schema/query exports) — rollback: gsutil iam ch -d. (2) gs://crypto538-prj-crypto538-prod-260529-bucket/claude-schema-exports/ (2 schema-only .sql files; query CSVs are deleted after each read). (3) Cloud Build 7d835ecf may have pushed ml-training:test-cpu / :test-gpu to Artifact Registry crypto538-container-images — delete if unused. (4) No Cloud Run jobs, no DB writes, no scheduler changes. Local only: ml-training/, ship.sh, commit_razorpay_deprecation.sh, 'Tracker project_id' line in cointrends/CLAUDE.md. Merged code change: PR #70 (comments only).
gs://crypto538-prj-crypto538-prod-260529-bucket/claude-schema-exports/Cloud Build 7d835ecf-2e1a-430a-bc11-040a85bd4ee6↗ HopewellPartners/crypto538-core-service#70
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
from the conversationsaravanan: we need a clean up step by step with proper validation and rollback at the end of all our work
claude: Listing everything I've added to GCP so the final cleanup can remove or keep it deliberately.
7d ago
10-19 14:19
10-19 14:19
todo
low
Zero-build revenue: exchange affiliate links on coin pages + revive newsletter with weekly auto-digest
Affiliate CTAs on /en/coins/:id; weekly digest from scorecard + Market Insights via Azure email on existing /products/newsletter; sponsorship slot. Gap-fill #8.
CoinTrends.ai
· cointrends
· by saravanan@scrumclaw.ai
5d ago
10-22 02:44
10-22 02:44
todo
low
Retire /dashboard once Home has been live long enough to trust
UX review items 7+8 moved students from the widget Dashboard to the Home focus view. The old page is kept at /dashboard for one release and linked from Home, deliberately: its stat cards are the only place some numbers appear, and deleting them in the same change that moves everyone's landing page would make any regression hard to attribute.
Either fold the stats worth keeping into Progress, or delete the page and its dashboard/ components. A route nobody links to is debt; Home currently links it as "All stats" so it isn't orphaned in the meantime.
frontend/src/app/pages/Dashboard.tsxfrontend/src/app/pages/Home.tsxfrontend/src/app/routes.tsx
Adaptive SAT
· adaptive-sat
· by saravanan@scrumclaw.ai
2d ago
10-24 17:59
10-24 17:59