Opening - #495
Conversation
…erences, Add the PR template checklist.
CODE_OF_CONDUCT.md
|
@0xNinx Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
|
Warning Review limit reached
Next review available in: 53 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. 📝 WalkthroughWalkthroughThis PR adds contributor governance documents, a standardized pull request template, corrected README capability descriptions, known-gap documentation, and a comprehensive reference for both Lodestar Soroban contracts. ChangesDocumentation and contribution guidance
Estimated code review effort: 2 (Simple) | ~15 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/contracts.md`:
- Around line 578-589: The public API entries for get_agent, get_policy,
get_score, is_registered, admin_deactivate_agent, and list_agents are
incomplete. Add parameter documentation for every listed argument, document
list_agents.limit behavior, and add explicit Returns: () sections to the
unit-returning functions, preserving the existing API reference style and
covering all listed entries.
- Around line 41-43: Update the Units section and the related references to
distinguish payment and policy amounts, which use i128 stroops, from
ServiceEntry.price_usdc and register_service.price_usdc, which remain
informational human-readable decimal String values. Remove the blanket claim
that all USDC amounts use stroops while preserving the 1 USDC = 10,000,000
stroops conversion.
- Around line 486-517: Update the documented init flow and its implementation
contract to prevent arbitrary callers from setting registry_contract: require
deployment-controlled authorization before binding the trust anchor, or move the
registry argument into __constructor and remove the one-time public setter
behavior. Revise the init section and the related documentation around the
constructor/deployment flow to describe the chosen initialization path,
authorization, and preserved already-initialized behavior.
- Around line 521-556: Update the register_agent contract documentation to
define a trusted ownership mechanism: require authentication or an explicit
ownership-claim flow tying agent_address to owner before registration succeeds.
If that guarantee is enforced by an upstream backend or registry instead,
document that requirement and trust model clearly alongside the authorization
and owner parameter details.
- Around line 161-175: Update the register_service example’s --provider argument
to use a valid full Stellar testnet address or configured identity name that
matches the signable identity represented by --source my-key; leave the
remaining example arguments unchanged.
In `@README.md`:
- Line 8: Update the “Autonomous agent demo” bullet in README.md to avoid
claiming it discovers the “best” service; describe the reputation-based
weighted-random selection among top candidates consistently with the behavior
documented on Lines 70-71.
- Line 7: Update the Agent Credit Scoring description in README.md to remove the
claim that contract-level spending limits cannot be bypassed, while preserving
the remaining statements about scoring, provider requirements, and payment
outcomes.
- Around line 11-13: Insert a blank line between the Docs/Code of Conduct link
block and the following `---` horizontal rule in the README content. Keep the
existing links and rule unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: e1059e94-74f9-497d-9824-f3dc1071d2ea
📒 Files selected for processing (5)
.github/PULL_REQUEST_TEMPLATE.mdCODE_OF_CONDUCT.mdCONTRIBUTING.mdREADME.mddocs/contracts.md
| ### Units | ||
|
|
||
| All USDC amounts in the contract are expressed in **stroops** (`i128`), where `1 USDC = 10 000 000 stroops`. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Correct the conflicting USDC unit description.
The document says all USDC amounts use i128 stroops, but ServiceEntry.price_usdc and register_service.price_usdc are explicitly human-readable String values. Clarify that only payment/policy amounts use stroops; registry prices remain informational decimal strings.
Also applies to: 65-66, 133-147
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/contracts.md` around lines 41 - 43, Update the Units section and the
related references to distinguish payment and policy amounts, which use i128
stroops, from ServiceEntry.price_usdc and register_service.price_usdc, which
remain informational human-readable decimal String values. Remove the blanket
claim that all USDC amounts use stroops while preserving the 1 USDC = 10,000,000
stroops conversion.
| **Example** | ||
| ```sh | ||
| stellar contract invoke \ | ||
| --id $REGISTRY \ | ||
| --source my-key \ | ||
| --network testnet \ | ||
| -- register_service \ | ||
| --provider GABCD...1234 \ | ||
| --name '"Weather API"' \ | ||
| --description '"Real-time weather data"' \ | ||
| --endpoint '"https://api.example.com/weather"' \ | ||
| --price_usdc '"0.001"' \ | ||
| --pay_to GABCD...1234 \ | ||
| --category '"weather"' | ||
| ``` |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## docs/contracts.md around example lines"
sed -n '140,190p' docs/contracts.md
echo
echo "## Search placeholder-looking Stellar addresses in docs/contracts.md"
python3 - <<'PY'
import re
from pathlib import Path
text = Path("docs/contracts.md").read_text()
for i,line in enumerate(text.splitlines(),1):
if re.search(r'\bG[A-Z0-9]+\.\.\.[A-Z0-9]+\b', line):
print(f"{i}: {line}")
PY
echo
echo "## Search related verified/example headings"
rg -n "verified|example|register_service|pay_to|caller|provider|G[A-Z0-9]+" docs/contracts.md || true
echo
echo "## Stellar-like address pattern references in docs/contracts.md"
python3 - <<'PY'
import re
text = open("docs/contracts.md").read()
pat = re.compile(r'(?:G[A-Z0-9]{55}|G[A-Z0-9]{0,20}(?:\.\.\.)?[A-Z0-9]*)')
for m in pat.finditer(text):
s=m.group()
if len(s)>4 and ("..." in s or len(s)>50 or re.match(r'G[A-Z0-9]{55}$', s)):
idx=len(text[:m.start()].splitlines())+1
print(f"{idx}: {s}")
PYRepository: Stellar-Ecosystem/lodestar
Length of output: 9904
🌐 Web query:
Stellar CLI contract invoke strkey local identity name argument formats
💡 Result:
When using the Stellar CLI to invoke a contract, you can pass a locally known identity name (e.g., alice) as an argument value whenever the contract's type specification expects an Address [1][2]. The Stellar CLI automatically resolves these identity aliases into their corresponding public key (strkey) format [1][3]. This resolution works for: 1. Top-level arguments: Directly passing the identity as an argument value [1][2]. 2. Nested arguments: Identity aliases are also resolved when they appear within complex, JSON-encoded custom types such as structs, vectors, maps, or tuples [3]. To invoke a contract function, use the following syntax, where arguments are placed after the double-dash (--) delimiter [4][5][6]: stellar contract invoke --id <CONTRACT_ID> -- <FUNCTION_NAME> --<ARG_NAME> <IDENTITY_NAME> Example: If you have an identity named alice and a contract function called set_owner that accepts an address argument named owner, you would run [1][2]: stellar contract invoke --id mycontract -- set_owner --owner alice In this example, the CLI will resolve alice to its underlying G... address before submitting the transaction [1][2]. You may also provide a raw Stellar strkey (G... or C...) directly if you prefer not to use an identity alias [1][2].
Citations:
- 1: https://developers.stellar.org/docs/tools/cli/cookbook/contract-invoke-arguments
- 2: stellar/stellar-cli@94b11b7
- 3: Resolve identity aliases inside nested invoke arguments. stellar/stellar-cli#2552
- 4: https://github.com/stellar/stellar-cli/blob/main/FULL_HELP_DOCS.md
- 5: https://developers.stellar.org/docs/build/smart-contracts/getting-started/deploy-to-testnet
- 6: https://developers.stellar.org/docs/tools/cli/stellar-cli
Replace the provider placeholder in the register_service example.
--provider GABCD...1234 is not a valid Stellar testnet address, while --source (my-key) must be able to sign the provider address in this example. Use the example’s full testnet strkey or a configured identity name for that address.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/contracts.md` around lines 161 - 175, Update the register_service
example’s --provider argument to use a valid full Stellar testnet address or
configured identity name that matches the signable identity represented by
--source my-key; leave the remaining example arguments unchanged.
| ### `init` | ||
|
|
||
| > One-time post-deploy setup. Stores the address of the LodestarRegistry contract. May only be called once — panics if called again. | ||
|
|
||
| **Signature** | ||
| ```rust | ||
| pub fn init(env: Env, registry_contract: Address) | ||
| ``` | ||
|
|
||
| **Parameters** | ||
|
|
||
| | Name | Type | Description | | ||
| |---|---|---| | ||
| | `registry_contract` | `Address` | Address of the deployed LodestarRegistry. Used by `record_payment` to verify that the caller is the service's registered provider. | | ||
|
|
||
| **Authorization:** 🔓 (no auth check; idempotency guard prevents re-initialization) | ||
|
|
||
| **Errors** | ||
|
|
||
| | Panic message | Cause | | ||
| |---|---| | ||
| | `"already initialized"` | `init` was called more than once. | | ||
|
|
||
| **Example** | ||
| ```sh | ||
| stellar contract invoke \ | ||
| --id $AGENTS \ | ||
| --source deployer-key \ | ||
| --network testnet \ | ||
| -- init \ | ||
| --registry_contract $REGISTRY | ||
| ``` |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Repository files matching docs/contracts.md and likely source files:"
git ls-files | rg '(^|/)(contracts\.md|.*\.rs|.*\.toml)$' | sed -n '1,200p'
echo
echo "Context around docs/contracts.md lines 486-517:"
sed -n '460,530p' docs/contracts.md
echo
echo "Search for init definitions/usages in docs and Rust sources:"
rg -n "fn init|pub fn init|registry_contract|record_payment|require_auth|LodestarRegistry|LodestarAgents" -S .Repository: Stellar-Ecosystem/lodestar
Length of output: 16586
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "contract/agents/src/lib.rs data keys and init/record_payment implementation:"
sed -n '70,150p' contract/agents/src/lib.rs
sed -n '315,365p' contract/agents/src/lib.rs
echo
echo "docs/contracts.md LodestarAgents record_payment section:"
sed -n '740,815p' docs/contracts.mdRepository: Stellar-Ecosystem/lodestar
Length of output: 7611
Gate init before binding the registry trust anchor.
init stores registry_contract with no authorization, so any caller can make record_payment call an arbitrary registry and provider-check code. Gate this to a deployment-controlled signer or pass the registry during __constructor; update the docs accordingly at lines 486-517 and 750-785.
🧰 Tools
🪛 LanguageTool
[style] ~488-~488: To form a complete sentence, be sure to include a subject.
Context: ...dress of the LodestarRegistry contract. May only be called once — panics if called ...
(MISSING_IT_THERE)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/contracts.md` around lines 486 - 517, Update the documented init flow
and its implementation contract to prevent arbitrary callers from setting
registry_contract: require deployment-controlled authorization before binding
the trust anchor, or move the registry argument into __constructor and remove
the one-time public setter behavior. Revise the init section and the related
documentation around the constructor/deployment flow to describe the chosen
initialization path, authorization, and preserved already-initialized behavior.
| ### `register_agent` | ||
|
|
||
| > Register a new agent identity. The agent starts with score 100 and a permissive default spending policy. No authorization is required — the backend server calls this on behalf of any wallet address. | ||
|
|
||
| **Signature** | ||
| ```rust | ||
| pub fn register_agent( | ||
| env: Env, | ||
| agent_address: Address, | ||
| name: String, | ||
| description: String, | ||
| owner: Address, | ||
| ) -> u64 | ||
| ``` | ||
|
|
||
| **Parameters** | ||
|
|
||
| | Name | Type | Description | | ||
| |---|---|---| | ||
| | `agent_address` | `Address` | The agent's Stellar address. | | ||
| | `name` | `String` | Display name. | | ||
| | `description` | `String` | Description. | | ||
| | `owner` | `Address` | Address that may call owner-restricted functions (`deactivate_agent`, `update_policy`). Typically equals `agent_address`. | | ||
|
|
||
| **Returns:** `u64` — total agent count after registration. | ||
|
|
||
| **Default spending policy created at registration** | ||
|
|
||
| | Field | Default value | | ||
| |---|---| | ||
| | `max_per_tx_stroops` | `10 000 000 000` (1 000 USDC) | | ||
| | `max_per_day_stroops` | `100 000 000 000` (10 000 USDC) | | ||
| | `allowed_categories` | `[]` (all categories permitted) | | ||
| | `min_score_to_earn` | `0` (all agents may earn score) | | ||
|
|
||
| **Authorization:** 🔓 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | rg '(^|/)(contracts\.md|.*\.rs)$' | sed -n '1,120p'
echo "== docs excerpt =="
sed -n '500,570p' docs/contracts.md || true
echo "== search register_agent/usages =="
rg -n "register_agent|agent_address|update_policy|deactivate_agent|SpendingPolicy|policy" -S . --glob '!target/**' --glob '!node_modules/**' | sed -n '1,240p'Repository: Stellar-Ecosystem/lodestar
Length of output: 23777
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== git diff stat/name =="
git diff --stat HEAD~1..HEAD 2>/dev/null || git diff --stat || true
git diff --name-only HEAD~1..HEAD 2>/dev/null || git diff --name-only || true
echo "== rust files containing register_agent =="
rg -n "fn register_agent|pub fn register_agent" -S --glob '*.rs' . || trueRepository: Stellar-Ecosystem/lodestar
Length of output: 517
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== register_agent implementation =="
sed -n '140,235p' contract/agents/src/lib.rs
echo "== owner-restricted functions =="
sed -n '420,618p' contract/agents/src/lib.rs
echo "== tests for register duplicate/conflict (if any) =="
rg -n "register_agent|agent already registered|already registered|duplicate|claim" contract/agents/src/lib.rs -C 8 | sed -n '1,220p'Repository: Stellar-Ecosystem/lodestar
Length of output: 11863
Prevent permissionless agent-address squatting.
register_agent has no authentication and stores the caller-supplied owner immediately; after registration, only the stored owner can deactivate the agent or update its policy. Since duplicate registration is blocked, anyone can register a different wallet’s agent address and control its on-chain identity/metadata. Add auth/claim ownership for agent_address/owner, or document an upstream guarantee that the backend/registry enforces a trusted trust model.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/contracts.md` around lines 521 - 556, Update the register_agent contract
documentation to define a trusted ownership mechanism: require authentication or
an explicit ownership-claim flow tying agent_address to owner before
registration succeeds. If that guarantee is enforced by an upstream backend or
registry instead, document that requirement and trust model clearly alongside
the authorization and owner parameter details.
| ### `get_agent` | ||
|
|
||
| > Retrieve a full agent entry. | ||
|
|
||
| **Signature** | ||
| ```rust | ||
| pub fn get_agent(env: Env, agent_address: Address) -> Option<AgentEntry> | ||
| ``` | ||
|
|
||
| **Returns:** `Option<AgentEntry>` — `None` if the address is not registered. | ||
|
|
||
| **Authorization:** 🔓 |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Complete the public API entries.
get_agent, get_policy, get_score, is_registered, admin_deactivate_agent, and list_agents omit parameter documentation; several unit-returning functions also omit an explicit Returns: () section. Add these details, including list_agents.limit behavior, to satisfy the stated “every public function” reference requirement.
Also applies to: 602-613, 626-637, 650-661, 948-976, 1047-1059
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/contracts.md` around lines 578 - 589, The public API entries for
get_agent, get_policy, get_score, is_registered, admin_deactivate_agent, and
list_agents are incomplete. Add parameter documentation for every listed
argument, document list_agents.limit behavior, and add explicit Returns: ()
sections to the unit-returning functions, preserving the existing API reference
style and covering all listed entries.
|
|
||
| --- | ||
| - **Service Registry** — A permanent, permissionless Soroban contract. Providers register an x402 endpoint once; agents query it by category and get back a live, reputation-ranked list. No hardcoded URLs, no gatekeepers. | ||
| - **Agent Credit Scoring** — A second Soroban contract that gives each agent a verifiable on-chain score (0–1000). Scores rise with successful payments and fall with failures. Providers can require a minimum score; spending limits are enforced at contract level and cannot be bypassed. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Remove the claim that spending limits cannot be bypassed.
This contradicts record_payment and the Known Gaps section: backend callers are checked before x402, but direct contract callers can bypass write-time limit enforcement.
Suggested wording
-- spending limits are enforced at contract level and cannot be bypassed.
+- spending limits are checked by the backend before x402; direct
+ `record_payment` calls currently bypass write-time limit enforcement.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - **Agent Credit Scoring** — A second Soroban contract that gives each agent a verifiable on-chain score (0–1000). Scores rise with successful payments and fall with failures. Providers can require a minimum score; spending limits are enforced at contract level and cannot be bypassed. | |
| - **Agent Credit Scoring** — A second Soroban contract that gives each agent a verifiable on-chain score (0–1000). Scores rise with successful payments and fall with failures. Providers can require a minimum score; spending limits are checked by the backend before x402; direct | |
| `record_payment` calls currently bypass write-time limit enforcement. |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` at line 7, Update the Agent Credit Scoring description in
README.md to remove the claim that contract-level spending limits cannot be
bypassed, while preserving the remaining statements about scoring, provider
requirements, and payment outcomes.
| --- | ||
| - **Service Registry** — A permanent, permissionless Soroban contract. Providers register an x402 endpoint once; agents query it by category and get back a live, reputation-ranked list. No hardcoded URLs, no gatekeepers. | ||
| - **Agent Credit Scoring** — A second Soroban contract that gives each agent a verifiable on-chain score (0–1000). Scores rise with successful payments and fall with failures. Providers can require a minimum score; spending limits are enforced at contract level and cannot be bypassed. | ||
| - **Autonomous agent demo** — A standalone script that starts with zero hardcoded URLs, discovers the best service by reputation, pays via USDC on Stellar testnet, and updates its own score on-chain — the full loop in one run. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Avoid describing weighted-random selection as choosing the “best” service.
The agent flow selects among top candidates probabilistically, so this wording overstates the guarantee. Align the opening bullet with the behavior documented on Lines 70-71.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` at line 8, Update the “Autonomous agent demo” bullet in README.md
to avoid claiming it discovers the “best” service; describe the reputation-based
weighted-random selection among top candidates consistently with the behavior
documented on Lines 70-71.
| **Docs:** [Contract reference](docs/contracts.md) · [Deployment guide](contract/DEPLOY.md) · [Contributing](CONTRIBUTING.md) | ||
| **Code of Conduct:** [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) | ||
| --- |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Separate the link block from the horizontal rule.
The --- immediately following the Docs/Code of Conduct lines can be parsed as a setext heading underline, triggering MD003 and potentially rendering the link block as a heading. Add a blank line before the horizontal rule.
Suggested fix
**Code of Conduct:** [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)
+
---📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| **Docs:** [Contract reference](docs/contracts.md) · [Deployment guide](contract/DEPLOY.md) · [Contributing](CONTRIBUTING.md) | |
| **Code of Conduct:** [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) | |
| --- | |
| **Docs:** [Contract reference](docs/contracts.md) · [Deployment guide](contract/DEPLOY.md) · [Contributing](CONTRIBUTING.md) | |
| **Code of Conduct:** [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) | |
| --- |
🧰 Tools
🪛 markdownlint-cli2 (0.23.1)
[warning] 11-11: Heading style
Expected: atx; Actual: setext
(MD003, heading-style)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` around lines 11 - 13, Insert a blank line between the Docs/Code of
Conduct link block and the following `---` horizontal rule in the README
content. Keep the existing links and rule unchanged.
Source: Linters/SAST tools
|
Hi @0xNinx, This PR could not be merged because it has merge conflicts with the target branch. Please resolve the merge conflicts, push the updated changes, and the PR can be reviewed and merged. Thank you! |
|
@ritik4ever I have resolved the conflict. Please review |
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
README.md (2)
104-112: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winRemove or label the second agent flow.
Lines 104-106 introduce a paginated flow. Lines 107-112 restart numbering and describe another flow with
list_services. Readers cannot tell whether these are alternatives. Keep one canonical sequence, or label the variants and renumber their steps.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` around lines 104 - 112, Clarify the README agent-flow section by either removing the duplicate list_services flow or explicitly labeling it as an alternative to the paginated list_services_page flow. If retaining both, give each flow a clear heading and restart numbering only within the labeled variant so readers can distinguish the canonical sequence.
371-371: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick winUpdate the deployment manifest claim.
contract/deployments.jsoncontains the live contract addresses, but thewasmHashentries are placeholders. Change the README wording to describe deploy artifacts plusWASM hash placeholdersuntil the hashes are populated.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` at line 371, Update the README Deployments entry to state that contract/deployments.json contains deployment artifacts and live contract addresses, while explicitly identifying the WASM hash values as placeholders until populated; remove the claim that it is the canonical source of truth for all live contract addresses and WASM hashes.
🧹 Nitpick comments (1)
README.md (1)
39-39: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winStandardize README repository links to the current owner.
The current repository is
Stellar-Ecosystem/lodestar. Update the setup URL atREADME.md:141fromritik4ever/lodestartoStellar-Ecosystem/lodestar; the0xNinx/lodestarusage atREADME.md:300/310can remain if those issue trackers are intentional.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` at line 39, Update the setup URL in the README’s setup instructions to use the current repository owner, changing the `ritik4ever/lodestar` reference to `Stellar-Ecosystem/lodestar`. Leave the intentional `0xNinx/lodestar` issue-tracker links unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Line 11: Replace the long opening paragraph in the README with a concise
summary of Lodestar that avoids repeating the feature bullets from Lines 6-9.
Remove the “production-grade” claim and ensure the wording accurately presents
Lodestar as an early-stage prototype, consistent with the maturity section.
---
Outside diff comments:
In `@README.md`:
- Around line 104-112: Clarify the README agent-flow section by either removing
the duplicate list_services flow or explicitly labeling it as an alternative to
the paginated list_services_page flow. If retaining both, give each flow a clear
heading and restart numbering only within the labeled variant so readers can
distinguish the canonical sequence.
- Line 371: Update the README Deployments entry to state that
contract/deployments.json contains deployment artifacts and live contract
addresses, while explicitly identifying the WASM hash values as placeholders
until populated; remove the claim that it is the canonical source of truth for
all live contract addresses and WASM hashes.
---
Nitpick comments:
In `@README.md`:
- Line 39: Update the setup URL in the README’s setup instructions to use the
current repository owner, changing the `ritik4ever/lodestar` reference to
`Stellar-Ecosystem/lodestar`. Leave the intentional `0xNinx/lodestar`
issue-tracker links unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: b954e6c7-4862-4000-ab7c-19126a67856a
📒 Files selected for processing (2)
CONTRIBUTING.mdREADME.md
🚧 Files skipped from review as they are similar to previous changes (1)
- CONTRIBUTING.md
| - **Autonomous agent demo** — A standalone script that starts with zero hardcoded URLs, discovers the best service by reputation, pays via USDC on Stellar testnet, and updates its own score on-chain — the full loop in one run. | ||
| - **Full stack** — Express backend with x402-protected demo endpoints, Next.js frontend for registration and score inspection, and both contracts deployed on Stellar testnet with live transactions. | ||
|
|
||
| Lodestar solves the missing discovery layer in the x402 agentic payments ecosystem on Stellar — today AI agents can pay for services but cannot find them autonomously because every service URL is hardcoded by a human, so Lodestar ships two Soroban smart contracts: the first is a permanent neutral on-chain registry where any service provider registers their x402 endpoint once with a price and category and it becomes discoverable forever, and the second tracks every AI agent's on-chain identity giving each agent a credit score from 0 to 1000 that rises with successful payments and falls with failures, enforces programmable per-transaction and daily spending limits at the contract level, and allows service providers to gate access to premium services by minimum score — all of this is exposed through an Express backend with real x402-protected demo endpoints for weather and search, a Next.js frontend where providers can register services and agents can view their scores, and a standalone autonomous agent script that starts with zero hardcoded URLs, queries the registry, discovers the best service by reputation, pays via USDC on Stellar testnet through the x402 protocol, receives real data back, and updates its own credit score on-chain — making Lodestar the complete infrastructure layer for the agentic economy covering discovery, payment, and trust in a single production-grade open source project that directly addresses all three requirements the Stellar Hacks judges explicitly called out in the hackathon brief. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Rewrite the long opening paragraph.
Line 11 repeats the bullets on Lines 6-9 as one very long sentence. It also calls Lodestar “production-grade”, while Line 19 says the project is an early-stage prototype and not production-grade. Replace this paragraph with a short summary that matches the maturity section.
🧰 Tools
🪛 LanguageTool
[uncategorized] ~11-~11: If this is a compound adjective that modifies the following noun, use a hyphen.
Context: ... and trust in a single production-grade open source project that directly addresses all thr...
(EN_COMPOUND_ADJECTIVE_INTERNAL)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` at line 11, Replace the long opening paragraph in the README with
a concise summary of Lodestar that avoids repeating the feature bullets from
Lines 6-9. Remove the “production-grade” claim and ensure the wording accurately
presents Lodestar as an early-stage prototype, consistent with the maturity
section.
2 participants
Closes #428
Closes #421
Here's a summary of everything delivered:
Closes #424
These changes satisfy the acceptance criteria:
The project now includes a
CODE_OF_CONDUCT.md
.
An enforcement contact is provided.
Both README and CONTRIBUTING reference the new Code of Conduct.
Closes #422
What was created
docs/contracts.mdEach entry includes:
stellar contract invokeexample — built from the real function signatures and testnet addressesClosing items:
Summary by CodeRabbit
Documentation
Chores
Community