Mainnet code-completable gap closure (T7-T9, invariant engine, ceremony PREPARE tooling)
Closes every code-completable item from the mainnet-readiness review and replaces the retired third-party-report gate with mandatory internal findings disposition, adversarial testing, two independent build reproductions, simulation and final invariants. The ceremony verdict remains NO_GO.
New- scripts/mainnet/verify-program-authorities.mjs (T7): independently derives each production program's ProgramData PDA and compares its live upgrade authority against an operator-supplied expected value.
- scripts/mainnet/verify-fresh-program-identity.mjs + docs/token/CGW_MAINNET_PROGRAM_ID_CEREMONY.md (T8): guards against reusing a devnet/localnet program keypair as a mainnet identity; self-tested.
- scripts/mainnet/manifest-transition.mjs + verify-manifest-consistency.mjs (T9): CANDIDATE -> DEPLOYED -> INDEPENDENTLY_VERIFIED -> CANONICAL state machine; the canonical manifest.ts file is never auto-edited at any state.
- scripts/mainnet/verify-mainnet-invariants.mjs: single-command final invariant engine covering genesis hash, both programs, Squads, mint, metadata, all six vaults, RewardsConfig/VestingConfig PDAs, and readiness-gate cross-check; JSON out, exit 0/1, no warnings-as-pass.
- scripts/mainnet/evidence-record.mjs: standard evidence-record schema and append-only writer for every irreversible ceremony step, with a secret-material field-name guard.
- scripts/mainnet/prepare-mint-metadata-mainnet.mjs, prepare-vaults-mainnet.mjs, prepare-squads-mainnet.mjs, prepare-rewards-vesting-mainnet.mjs: PREPARE + SIMULATE + VERIFY only, public-keys-only (no private key ever loaded), modeled directly on the proven devnet Genesis Rehearsal #2 / canonical Squads creation scripts. Deliberately no submission path, per this repository's existing no-one-click-deploy design.
- scripts/mainnet/signer-ceremony-state.mjs: IDENTIFIED -> OWNERSHIP_PROVEN -> APPOINTED -> INDEPENDENCE_VERIFIED -> RECOVERY_VERIFIED -> CEREMONY_READY state machine per signer, order-of-operations enforced and self-tested.
- scripts/mainnet/authority-transition-matrix.mjs: OBJECT/CURRENT/EXPECTED/STATUS for every governed mainnet authority, CURRENT always read live.
- scripts/mainnet/verify-transaction-safety.mjs: static safety audit over every prepare-*-mainnet.mjs script (fresh blockhash, no durable nonce, no broadcast, no private-key loading, simulation-gated, evidence outside repo).
- scripts/mainnet/mainnet-readiness-score.mjs: non-gating ENGINEERING/CUSTODY/LEGAL/OPERATIONS readiness summary, explicitly never overriding ceremony.mjs's verdict.
- scripts/mainnet/mainnet-rpc-lib.mjs: shared, dependency-free RPC/manifest/base58 primitives reused by every new script above.
- scripts/mainnet/package.json: isolates the new PREPARE/VERIFY scripts' @solana/web3.js, @solana/spl-token, @metaplex-foundation/mpl-token-metadata and @sqds/multisig dependencies, mirroring scripts/devnet's own isolation rationale.
- docs/token/CGW_DEVNET_MAINNET_GAP_MATRIX.md: the full devnet-to-mainnet operational checklist across all 30 ceremony capabilities.
Security- Removed retired readiness gate G5 and the corresponding private-control approval field. Current mandatory evidence is internal findings disposition, adversarial tests, reproducible SBF/IDL hashes from two independent verifiers, transaction simulation and final on-chain invariants.
- Five witnessed Solflare + Ledger Nano S Plus ownership proofs promote O4 to PASS; signer appointment, independence and recovery remain separate gates.
Developer- The Ledger ownership-proof page now mirrors the devnet tools with one Connect and one Sign action. Solflare + Ledger Nano S Plus produced all five exact v0 signatures; a subsequent witnessed pass supplied distinct screen-witness and second-channel confirmation records, and offline verification closed 5/5 hardware-clear-signed key-control proofs while live. Phantom rejected the same payload as transaction-shaped, so the page recommends the proven Solflare path. Appointment, independence, recovery and final custody approval remain separate gates.
- Every new script passes node --check; verify-fresh-program-identity.mjs, signer-ceremony-state.mjs and verify-transaction-safety.mjs each carry and pass a real self-test/regression run (not just syntax checks).
- verify-manifest-consistency.mjs was actually run against the live repository and correctly reports 11/11 structural checks passing while mainnet-beta remains NOT_DEPLOYED.
- mainnet-readiness-score.mjs was actually run and correctly reports 13/26 without altering the hard verdict.
- The complete pnpm lint, typecheck, build and package-test suite passed. Cargo and Anchor remain unavailable on this host. The isolated Solana dependencies install from a lockfile, but their inherited advisories still require disposition and the builders require a disposable devnet dry run.
Docs- packages/chain-config/src/manifest.ts's mainnet-beta block remains fully null/NOT_DEPLOYED.
- The obsolete third-party engagement package and gate were removed. Legal, tokenomics, signer appointment/recovery, build, network, monitoring and execution-authorization evidence remain open — 13 of 26 readiness gates remain incomplete.
- ceremony.mjs's verdict remains NO_GO; nothing in this release can sign or broadcast a mainnet-beta transaction.
Private ceremony control attachment
Lets the read-only localhost console follow a private controller record by absolute server-side path without exposing it to browser code or enabling transactions.
Improved- The loopback service accepts --control with an existing absolute private control.json path and renders the controller's evidence checks in the ceremony workspace.
- Overview reports attachment status and keeps preparation incomplete until the control schema and repository commit binding pass.
Security- The private path and record contents remain server-side; the browser still has no upload, signing, transaction construction, RPC write or broadcast capability.
Mainnet ceremony workspace
Adds a sequential five-wallet identification roster and a complete controller-derived ceremony map while every mainnet transaction action remains locked.
Improved- The local mainnet console now retains recognized Ledger candidate addresses across account switches and ceremony-page navigation for the browser session.
- Overview now provides a twelve-stage preparation map linking every launch phase to its evidence page and honest controller-derived status.
Security- Session identification remains separate from custody and authorization, and no message signing, transaction construction, RPC write or broadcast capability was added while mainnet is NO_GO.
Mainnet ceremony payer funding
Records and verifies the distinct Squads fee-payer candidate, bringing current ceremony funding to 7 SOL while mainnet execution remains locked behind the other launch gates.
Improved- The local mainnet console now derives and finalized-reads both ceremony payer candidates alongside the five Ledger signer candidates.
- Funding readiness now reports the observed 5 SOL deployer and 2 SOL Squads fee payer separately, with a 7 SOL combined preparation balance.
Security- Generated ceremony packs are bound to both reviewed payer candidates and reject payer substitution, overlap with each other or any signer, and balances below the current funding floors.
Mainnet deployer candidate controls
Records the operator-designated mainnet deployer candidate, verifies its funding read-only in the local console, and strengthens ceremony checks without enabling any mainnet write.
Improved- Private ceremony packs are now bound to the reviewed deployer candidate and reject a substituted payer, payer-role overlap, or combined funding below the current preparation budget.
- The local mainnet operator console now reads the candidate deployer account and balance alongside the five Ledger candidates while keeping every transaction action disabled.
Security- The candidate payer remains separate from canonical deployment addresses, signer custody, the future Squads fee payer and all on-chain authority claims; mainnet remains NOT_DEPLOYED.
Automatic mainnet operator console
Replaces browser evidence uploads with a self-loading, devnet-style mainnet operator console that automatically checks repository, manifest, network and signer state while all writes remain locked.
New- A loopback-only read service verifies mainnet identity and all five candidate accounts while keeping any approved RPC credential outside browser code.
- Phantom and Solflare can identify a connected public address against the candidate roster without exposing any signing or transaction method.
Improved- All 13 mainnet pages now open directly into automatic network, manifest, signer, prerequisite, blocker and log views with no browser file uploads or RPC setup form.
- The page structure now matches the successful devnet tools: hard-lock notice, signer panel, numbered action step, proposal status and one-click refresh.
Mainnet operator evidence pages
Adds a production-safe HTML counterpart for every devnet operator filename, plus mainnet-specific program, mint/vault and vesting evidence pages that remain fail-closed until reviewed ceremony evidence exists.
New- The Solana mainnet folder now includes 13 locally served operator pages covering programs, Squads, mint/metadata/vault genesis, protocol initialization, vesting, lockups and controlled rewards operations.
- Each page can review sanitized ceremony control, preflight and candidate-manifest files locally in the browser, with an optional redacted session-only RPC identity check.
Improved- Every devnet HTML filename has an explicit mainnet counterpart; GR2 and disposable-test pages say NOT APPLICABLE instead of inviting devnet code or addresses to be copied.
- A regression guard proves the pages contain no devnet address, wallet integration, signing library, transaction construction or broadcast capability, and browser validation covers desktop and phone widths.
Fail-closed mainnet ceremony controls
Adds an operator-ready private ceremony pack and a machine-checked NO-GO gate that cannot sign or broadcast, so mainnet preparation cannot be mistaken for launch authorization.
New- The Solana workspace now has one ordered mainnet ceremony guide, a private evidence-pack generator, and a controller that checks all 27 readiness gates plus witnessed roles, approvals, signer proofs, audited build hashes, independent RPC views, funding and explicit authorization.
Improved- Ledger ownership challenges must now be written to an absolute private directory outside Git, keeping signer and custody records out of the source tree.
- The ceremony controller is structurally read-only: it reports NO-GO while gates are open and contains no wallet, signing, deployment or broadcast code.
Production signer readiness and mainnet launch safeguards
Records the five funded production Ledger candidates without overstating custody, adds the missing signer gate to the public MiCA report, and strengthens the evidence required before any mainnet launch.
Improved- Treasury, Security, Roadmap and MiCA readiness now agree: five funded Ledger addresses are the operator-designated production candidates, while ownership, independence, recovery and formal appointment remain open gates.
- The mainnet cutover and ceremony evidence now distinguish signer wallets from the future Squads multisig and Vault 0, and require proof hashes, independence checks, recovery rehearsal and separate deployer funding evidence.
- Every public Token route is now browser-tested in CI at production build time, including complete internal-link crawling, responsive overflow, landmarks and runtime console/network failures.
Fixed- The public MiCA readiness table now includes the production-custody workstream referenced by its own launch stop line, and stale claims that no production key had been nominated were removed.
- The canonical-address leakage guard now covers future Squads Vault 0, member keys and the metadata PDA in addition to the mint, programs and vaults.
- Whitepaper references now resolve to real Token Portal routes, route-specific structured data no longer inherits the homepage identity, and optional Google linking fails safely when production credentials are absent.
- The same-origin wallet RPC boundary now applies a privacy-preserving per-visitor hourly limit before consuming dedicated Solana provider capacity.
Fixed CGW Explorer metadata, added a canonical identity module, and linked every Admin token address
Root-caused and fixed Solana Explorer showing the CGW devnet token as 'Unknown' by replacing the mint with one that carries real on-chain metadata from the moment it was created, added one canonical function every app now uses for token identity, and made every wallet/program address on Admin's token pages a working Explorer link.
New- @cgw/chain-config now exports getTokenIdentity(cluster) — one function that composes token name/symbol/network/decimals with each cluster's mint/program/metadata deployment state, so no app has to import both the token specification and the deployment manifest and combine their fields by hand.
Fixed- Solana Explorer no longer shows the CGW devnet token as 'Unknown Token' / 'No symbol' / 'Not verified'. Root cause: the original devnet mint had its mint authority revoked before any on-chain Metaplex metadata account existed for it, which makes attaching metadata permanently impossible — not an indexing delay or a missing registry entry.
- Replaced the canonical devnet mint (Genesis Rehearsal #2) with metadata attached in the same transaction as mint creation, before mint authority was ever touched. New mint, six vaults funded to exact token-spec allocations summing to the full 1B supply, mint authority revoked, and metadata update authority transferred to the Squads Vault0 multisig — all independently re-verified against live RPC reads afterward, never trusted from a script's own log.
- Every address on every Admin token page (mint, vaults, authorities, Squads multisig/Vault0/members, program ids/upgrade authorities, vesting/rewards config/vault/beneficiary/claimant addresses, holders' token-account/owner addresses — about 20 addresses across 7 pages) is now a real Explorer link instead of plain shortened text.
Developer- New identity.test.ts keeps the token icon URL constant in sync with the token portal's own real metadata JSON file, so the two can never silently drift apart again.
Safer subscriptions and honest plan limits
Makes Stripe checkout and webhook recovery idempotent, enforces photo limits, preserves work at plan limits, and shows only paid features that are actually available.
Improved- Plan-limit prompts keep the selected photo or flower form intact and link to Subscription without replacing the draft page.
- Per-flower photo limits are enforced atomically, and Garden Plus lists only features with working product behavior.
- The Colors sheet now waits for the menu to close fully and supports Escape, contained keyboard focus, and focus restoration.
Fixed- Stripe checkout now reuses one durable purchase intent and existing Stripe customer, preventing concurrent duplicate subscription sessions.
- Interrupted and out-of-order Stripe webhooks can recover safely without marking entitlement granted too early.
- Checkout return links no longer claim payment success until active Stripe-backed Garden Plus access is confirmed by the server.
- Monthly and Annual controls now have a clear selected state, and personalized Discover caches are removed on logout.
Admin payment history, a subscription-card fix, and Stripe webhook hardening
The Admin Subscription card now shows a user's full payment history, a bug that made it always report 'Unavailable' regardless of the real subscription state is fixed, and the Stripe payment webhook is now rate-limited against abuse.
New- Admin Center: a user's Subscription card now shows their full payment history — every order (status, payment method, amount, dates) with its related events, plus subscription-level events like renewals that aren't tied to a single order.
Improved- The Stripe payment webhook endpoint is now rate-limited per connecting address, closing out the security hardening planned for the subscriptions/billing system.
Fixed- Admin Center: a user's Subscription card previously always reported 'Unavailable', regardless of their real plan, status or usage — even though granting and revoking complimentary access worked correctly the whole time. It now shows accurate, live data.
Guest access, garden management, flower photo timeline, and translation reliability
Signed-out visitors can now see the badge catalog and local weather, your profile links straight to your gardens/flowers/badges, gardens can be safely deleted with or without their flowers, flowers now support a full photo timeline with captions, and the Admin Translations page's stuck-at-0% bug is fixed.
New- Signed-out visitors can see the full contribution badge catalog and their coarse local weather, with a themed sign-in prompt instead of a hard wall.
- A persistent "Install App" entry in the mobile sidebar, with themed iOS instructions where the platform has no native install prompt.
- Garden deletion now offers two explicit, clearly explained options: delete the garden only (flowers kept, reassigned to no garden) or delete the garden and every flower in it, with a stronger second confirmation for the destructive option.
- A new "Flowers without a garden" section with real pagination, plus a move-to-garden action.
- Flowers now support a full photo timeline: multiple photos per flower, ordered chronologically, each with an optional caption and a settable cover image, and safe per-image deletion.
Improved- The Profile page is reordered so Achievements, Gardens, Flowers and Badges are the first things you see, each a real link to its own page.
- The Admin AI review queue's false-positive "page may state a price or a sale" flag was verified and cleared.
- The Admin Overview, Token Transactions and Token Holders pages no longer claim "no CGW mint exists" when the real cause is a temporary RPC outage.
Fixed- The Admin Translations page no longer gets languages permanently stuck at 0% coverage. A translation that was mid-flight when its Worker instance recycled is now retried automatically instead of staying stuck forever, and the "Retry failures" button no longer makes a stuck translation worse.
- A missing translation API key is now a clear, actionable status instead of a silent, unexplained gap in coverage.
Weather-aware plant care, admin reliability, and Solana RPC hardening
GardenApp now warns when a real forecast puts one of your own flowers at frost or heat risk, weather refreshes hourly through a shared cache instead of every six hours, and several admin/reliability issues were fixed across the platform.
New- A flower's care recommendations now include a live weather-care alert (frost risk, heat stress, or a heavy-rain watering note) grounded in your own current forecast and that flower's own species — advisory only, never a toxicity or medical claim.
Improved- Weather now refreshes every hour instead of every six, sharing one provider call across every user in the same area instead of one call per user.
- The weather card's location title no longer repeats the city as its own region ("Plovdiv, Plovdiv") and now always shows the country.
- The Admin AI Runs page clearly labels a run that made no model call, and can be filtered by trigger.
- The Admin Health page explains a degraded status caused by unreachable Solana RPC instead of showing five green checkmarks with no explanation.
Fixed- The Admin Badges page no longer 404s.
- The public Token Portal's rewards and vesting pages now use the same dedicated Solana RPC configuration as the rest of the platform, instead of silently falling back to a different endpoint.
- A Places autocomplete outage is now reported as an error instead of looking like "no results found".
- Two internal misconfiguration failures (a missing internal API token, a missing native sign-in configuration) are now recorded as exceptions instead of failing silently.
- The Token Portal now has an error boundary, so a page crash there is visible to operators instead of showing a bare default error screen.
Multilingual support, Places and Pollen
GardenApp now translates into Bulgarian, Spanish, German and French on demand, lets a garden's owner search for its real location with Google Places, and shows pollen levels for that location.
New- GardenApp interface can be shown in Bulgarian, Spanish, German or French, translated on demand and cached, with an instant English fallback while a translation is in flight.
- A garden's location can now be searched and selected via Google Places autocomplete, instead of only hand-typed text.
- A garden with a selected place shows nearby pollen levels (grass/tree/weed) on its detail page.
- Admin Center: a new Translations page reports per-language cache coverage and lets an operator invalidate a language's cache or retry failed translations.
Improved- Admin Center reports whether each of the three optional Google integrations (Translation, Places, Pollen) is configured, without ever exposing the key.
Weather provider recovery
Local weather preserves the user's coarse area during a forecast outage and can recover through an independent fallback provider.
Improved- Scheduled weather failures now report privacy-safe categories so operators can distinguish timeout, network, provider response and persistence failures without logging user or location data.
- Admin now separates the location update time from the last successful forecast refresh time.
Fixed- GardenApp no longer hides an already-saved coarse location when a first forecast refresh fails.
- Weather refresh falls back to MET Norway when Open-Meteo is unavailable and gives the mobile proxy enough time to complete both bounded attempts.
Weather reliability update
Local weather now keeps an otherwise usable forecast when the provider omits an optional metric, and the app captures its privacy-preserving Cloudflare location context earlier in each refresh.
Improved- Weather failures now leave a bounded privacy-safe server diagnostic and a detected/unavailable response signal, without exposing an IP address, coordinates or private location data.
Fixed- GardenApp no longer throws away an entire local forecast because one optional weather metric is null or missing.
- Weather refresh captures Cloudflare's coarse request-location context before authentication work, reducing the chance of losing the edge context across an async boundary.
Public flower sharing and community follows
Flower links now open for everyone, with native sharing, copy-link controls, creator profiles, featured badges and community follows. Weather also retries cleanly after a reload.
New- Copy or share a flower's public link with its name from flower profiles and Discover.
- Follow community growers and see follower counts plus their featured earned badges.
Fixed- QR codes now open the public community flower instead of an owner-only page.
- Unavailable weather is no longer cached across reloads, and each reload rechecks the current coarse IP location.
- The reminders shortcut now uses a recognizable bell icon.
Security- Public sharing and follows use public post identifiers; private flower, garden, care, reminder and account identifiers remain outside shared links.
Automatic deployment updates
Open CoinGarden browser apps now detect each newly deployed build and move safely onto it automatically, while waiting for active saves and wallet confirmations to finish.
Improved- Open browser tabs automatically refresh onto a stable newly deployed build.
- Updates wait for active forms, saves, wallet signatures and claims, with the existing manual update control retained as a fallback.
Fixed- Code deployments are detected by immutable commit identity even when the human-facing version number does not change.
- A one-shot per-build guard and service-worker activation prevent repeated reloads or stale PWA shells.
Flower identification never shows a placeholder result again
Flower identification no longer ever falls back to a placeholder result if AI is briefly unavailable. If a real identification can't be produced right now, you'll see a clear "couldn't identify this plant" message with a Try again button instead — never a guessed answer standing in for a real one. This applies on the web app, the mobile app, and the native iOS/Android app, for both signed-in and guest identification.
Improved- Native app: the Identify screen now shows the plant's name, scientific name, confidence, and alternative matches in a readable layout, instead of a raw technical result.
Fixed- Flower identification (signed-in, guest, and native app) no longer ever returns a placeholder result when the AI service is unavailable. It now shows a clear, friendly message and a working Try again button instead.
- A guest's daily free identification is no longer spent when identification is unavailable — the attempt is refunded automatically.
Developer- Removed the last production code path that could serve a fabricated identification result; the mock provider used during development now exists only in the test suite.
- Added automated tests that scan the mobile and native app source for the old placeholder-result copy, so it can't silently come back.
- Rewrote the AI/identification documentation to match this behavior.
Fixed: the Whitepaper page failing to load
Fixed a bug where the Token Portal's Whitepaper page could fail to load with a server error. The page's content is now built directly into the app instead of being fetched from disk when someone visits the page, which is more reliable and loads faster.
Fixed- Token Portal: the Whitepaper page (/whitepaper) no longer intermittently fails to load with a server error. Its content is now compiled into the app at build time instead of being read from a file at request time, which also makes the page load slightly faster.
Fixed: flower identification failing with a connection error
Fixed a bug where identifying a flower could fail with "We couldn't connect to CoinGarden right now," even though the identification itself was actually succeeding — the app was giving up and showing an error before a normal, slightly-slower AI response had a chance to come back.
Fixed- Identifying a flower (both signed-in and guest) no longer fails with a connection error for a normal-speed AI response. The app's own internal request timeout was shorter than the time a real identification can legitimately take, so a genuinely successful result was sometimes thrown away and shown to the user as a failure.
Solana program compile fixes, and a vault-tracking bug fix
Fixed three real compile bugs in the on-chain vesting and rewards programs caused by an untracked dependency version, and fixed a bug that would have let two of CGW's six vaults silently share one tracked address.
Fixed- The on-chain cgw-vesting and cgw-rewards programs failed to compile against the anchor-lang library version that was actually being resolved (1.1.2, not the intended 1.0.2 — no lockfile had ever been committed for this workspace). Fixed the three resulting API breaks and committed a lockfile so this cannot silently happen again.
- CGW's deployment tracking previously had only one address slot for two distinct vaults (the Liquidity Vault and the Community Vault, each a separate 5% allocation per the token specification). Each now has its own tracked slot, so a real deployment can never have one vault's balance read as if it were the other's.
Developer- Verified the on-chain programs compile and lint cleanly (cargo check, cargo clippy with warnings-as-errors) in this environment; full on-chain build/deploy remains blocked by this sandbox's available disk space, tracked separately.
Google account linking on the Token Portal, and a wallet connection fix
The Token Portal's profile page can now actually link a Google account to your wallet as an optional backup identity, and a bug that made the wallet-connect flow fail with "No wallet connected." right after a real wallet had connected is fixed.
New- Token Portal: the profile page's Google section now works — sign in with Google, then link it to your wallet profile as an optional backup identity, or unlink it later. Wallet sign-in remains fully independent and never requires Google.
Fixed- Token Portal: connecting a wallet in the "Connect a wallet" modal no longer incorrectly shows "No wallet connected." immediately after the wallet extension has genuinely connected.
Cleaner UI, a smarter AI model picker, and the groundwork for native apps
A round of UI and copy fixes across the Admin Center and Token Portal, a rebuilt mobile About page that actually describes the current app, a searchable model picker for choosing which AI model powers each assistant, and the first working scaffold of native iOS/Android apps — not yet available to install, but the sign-in and core screens now run end to end against CoinGarden's real servers.
New- Admin Center: choosing which AI model powers an assistant is now a searchable list grouped by whether a model is compatible and verified, needs verification, or isn't compatible — instead of one long dropdown with no explanation
- Mobile app: the About page was rewritten to describe what the app actually does today (plant care, identification, badges, the Token Portal) instead of outdated feature descriptions
- The first working version of CoinGarden's native iOS/Android apps exists as an internal engineering build: sign in with Google, see your gardens and flowers, identify a plant with the camera. It is not yet published to the App Store or Play Store.
Improved- Mobile app: your profile page now shows your real garden, flower, and badge counts instead of a leftover placeholder panel
- Admin Center and Token Portal: several layout and copy fixes, including a Token Portal diagram that could overlap on narrower screens
Security- Closed a gap where pinning an AI model to an assistant did not check that the model actually supported what that assistant needs (for example, image understanding for plant identification) the same way the main configuration screen already did
Developer- CoinGarden's servers now support a real, revocable sign-in session for native apps, separate from the website's sign-in system, since a phone app has no server of its own to hold a shared secret the way the website does
Live Solana Operations in the Admin Center
The Admin Center's Token pages now read CGW's real status directly from Solana instead of a static placeholder, and refresh themselves automatically while you have them open — showing the truth as it stands today: CGW is approved for implementation but not yet deployed on any cluster.
New- Admin Center Token pages (Overview, Holders, Treasury, Security, Transactions) now read CGW's live deployment state, mint details, supply, vault balances and mint/freeze authorities directly from Solana over a read-only, server-side RPC connection — never from the browser
- Every Token page now auto-refreshes while open (5s on token pages, 10-15s on the global shell), pausing while the tab is hidden, catching up immediately on focus, and backing off automatically after repeated failed reads — labelled honestly as polling, never as a live socket connection it isn't
- A clear five-state deployment reading (not deployed, configured but unreachable, configured but the account is missing, deployed and healthy, or deployed with a mismatch against the approved specification) replaces the old always-false placeholder
Improved- Holder and transaction figures are now always labelled by what was actually read — "Top token accounts" rather than an implied full holder list, and an honest "unavailable from configured RPC" rather than a fabricated zero — and never guess a value the read-only RPC connection cannot actually confirm
- The Token Portal link is now derived from configuration instead of a hardcoded local address
- Token Overview language now consistently distinguishes an approved-but-not-yet-built decision from an actually deployed one, replacing several places that still read like an open design proposal
Security- Solana RPC connection details and provider credentials are confirmed, by an automated test, to never appear in the Admin Center's browser bundle, its API responses, or its logs
A friendlier connection error on Identify
If plant identification can't reach CoinGarden's servers, you'll now see a plain-language message with a Try again button — never a raw error code — and the app never blocks the photo form while it quietly checks your free daily count in the background.
Improved- A failed connection to CoinGarden's servers is now recorded with a short reference code you can quote to support, and shows up in the operations team's error monitoring — previously it was invisible outside that failure
Fixed- The Identify page could show a raw internal error code ("upstream_unavailable") if a photo identification briefly couldn't reach CoinGarden's servers — replaced with plain-language copy and a Try again button that resubmits the same photo
- That background connection is now retried once automatically before giving up, for the read-only checks (like your free daily count) where a retry can't cause any duplicate action
A navigation bar that responds to scrolling
The mobile app's top and bottom navigation now morph as you scroll — a compact floating bar at the top of a page, smoothly widening into a full sticky bar as you read further, and shrinking back the moment you return to the top.
Improved- Mobile app: the top header and bottom navigation now animate between a compact floating card (top of page) and a wide, edge-attached bar (once you've scrolled), instead of staying floating everywhere — matching the app's original navigation feel
- The transition only ever triggers on a real, deliberate scroll — a small buffer zone around the switch point stops it flickering between the two states
- Every animated element still respects a system-level request for reduced motion, switching states instantly instead of animating
Contribution Badges
A new Achievements page recognizes real activity — membership milestones, plant contributions, care streaks, identifications, and community participation — with clear progress toward what's next. Feature a few badges on your profile, and see one next to a creator's name on their shared flowers.
New- Achievements page (/badges): every badge you've earned and every badge still open, grouped by Membership, Plant Contributions, Plant Care, Identification, Community and Special, each showing real progress toward the next milestone — never a fabricated percentage
- Membership badges award automatically by account age, from joining through six-plus years
- Plant Contribution badges award at real save milestones (1 through 2,000 flowers saved), not raw AI identification attempts
- Plant Care badges reward logged care events and genuine 30- and 100-day care streaks
- Identification badges reward confirmed identifications, not every AI call
- Community badges reward your first shared flower and real appreciation received from others
- Special badges (System Guardian, Harmony Keeper, Community Beacon, Blossom Benefactor, Rare Plant Curator) are hand-awarded by CoinGarden and can't be earned automatically
- A badge detail page explains exactly what's required and how close you are
- Feature up to five earned badges on your profile — you choose which ones are visible, and unfeatured badges stay private
- A featured badge now appears next to a creator's name on their public flower posts
- A polished, reduced-motion-aware “Achievement unlocked” notification appears once per badge, whether you earned it yourself or someone else's like earned it for you
- Admin Center gained Ecosystem → Badges: view every badge and how many people hold it, enable or disable a badge, assign or revoke a Special badge with a required reason, and run a one-time reconciliation that awards every existing account every badge it already qualifies for — not just the newest one
Security- Only an administrator can assign or revoke a Special badge, and every assignment, revocation, enable/disable toggle and reconciliation run is written to the audit log with a reason
- Automatic badges have no admin override path that bypasses the real evaluation — an administrator can only enable/disable the badge itself, never hand-grant or hand-revoke an automatically-earned one
Developer- Badge catalog is fully data-driven (metric + threshold read from the database), so a new badge never requires a code change
- Badge progress is always computed live from the same source tables the rest of the product trusts (flowers, care_events, identifications, flower_posts, flower_post_likes) — no separate progress table to drift out of sync
- Unlock notifications are delivered by polling an unseen/acked flag rather than a push channel, so a badge earned by your own action, someone else's action (a like), or an admin reconciliation run all surface the same way
Fixed the mobile app's share preview image being blocked from crawlers
The mobile app's new share preview image (0.7.5) was itself unreachable by Facebook, X and other link-unfurling crawlers — they were redirected to the login page instead of seeing the image, because those crawlers never sign in. Fixed.
Fixed- Mobile app: the opengraph-image and twitter-image routes were not on the public-route allowlist, so the sign-in-required default for personal pages redirected every crawler request to the login page instead of serving the image — confirmed live (HTTP 307) and fixed by adding both routes to the same allowlist that already covers robots.txt and sitemap.xml
Fixed a deployment failure in the 0.7.4 share-image release
The previous release's share-preview images built and worked locally, but failed to deploy on the website, mobile app and token portal because of a Cloudflare-specific incompatibility. Fixed, and the images are now live.
Fixed- The website, mobile app and token portal failed to deploy after 0.7.4 shipped — the preview-image pages declared a runtime setting the Cloudflare build step rejects outright. Removed the setting (each app already runs in that runtime regardless of the declaration), confirmed against the real deployment build rather than only the local one this time
Real share previews for the website, mobile app and token portal
Sharing a CoinGarden link on Facebook, X or anywhere else previously showed no image and a Facebook warning about a missing og:image. Every public app now generates a branded preview image, and the mobile app gained the social title/description it never had.
New- Branded Open Graph and Twitter/X preview images for the marketing site, mobile app and token portal — each in that app's own colors, generated on the fly rather than a static file to keep in sync
Fixed- The mobile app had no social preview metadata at all (no og:title, og:description, or og:image) — a shared Discover or flower-post link showed a bare, generic preview. It now carries the app's name, description and the new preview image
- The marketing site's Twitter Card type was set to a small "summary" layout, which doesn't display a large image even when one is provided — corrected to "summary_large_image" now that a real image exists
Fixed the Discover feed for signed-in users
Signed-in users saw "We couldn't load community flowers" on every visit to Discover — a broken link between the app and the personalized-picks feature, not a real outage. Fixed, so signed-in users now see their picks, or the community's popular flowers if there aren't any yet.
Fixed- Discover feed: signed-in users no longer see a permanent "couldn't load" error — the personalized feed now loads correctly, falling back to the community's popular flowers when there isn't a personalized pick yet
Fixed the user-edit crash for real this time
The previous fix for the user-edit page crash didn't work — saving still crashed the page. This one does: the redirect after saving now matches the exact pattern already proven to work everywhere else in the Admin Center.
Fixed- Admin Center: changing a user's role, status, or display name no longer crashes the page after saving — this time confirmed by re-testing the exact failing action live, not just by a clean build
Fixed a crash when saving a user edit in the Admin Center
Saving a role, status, or display name change on a user's account page could crash the page instead of showing the result. The save itself was never the problem — the page just didn't reload correctly afterward. Fixed.
Fixed- Admin Center: changing a user's role, status, or display name no longer crashes the page after saving — the confirmation now shows correctly
Admin user administration, and two real bugs fixed
Administrators can now edit a display name, change a role, and enable or disable an account directly from the Admin Center, with every change written to the audit log. The audit log itself is fixed — it was never actually loading — and the Health page's version-mismatch warning is fixed to stop false-alarming while a deployment is still rolling out.
New- Admin Center: a user's account page now supports editing their public display name, changing their role (User / Moderator / Admin) and enabling or disabling the account — enforced server-side, with the same last-admin protection and self-disable confirmation the product has always had
- Health page now shows a Service / Expected version / Deployed version / Commit / Status table, so a genuine deployment gap is visible at a glance instead of buried in a version list
Fixed- The Admin Center's audit log page always failed with “response this console did not recognise” — the API route never actually returned the paginated shape the page required. It now does, and the page loads real entries
- The Health page's “version mismatch” warning fired constantly and incorrectly, because the API's own self-check reported a version literal that was never updated as releases shipped. It now reads the same shared version every other check does, and the warning only fires once a mismatch has genuinely outlasted a normal deployment, not while one is still rolling out
- A stray, unreachable status endpoint on the API still described the pre-migration blockchain; corrected while in the same file for the version fix
Security- Every user-administration change (display name, role, status) is written to the audit log with an outcome and a correlation id, so it can be traced back to the exact request that made it
Developer- The audit log gained real server-side pagination and outcome tracking (`result`, `correlation_id`) instead of an unbounded, unpaginated list
- Health checks now record a build commit when a service's health payload reports one, laying the groundwork for the new version table
A smarter Discover feed, and fewer dead ends
The Discover feed now gets a daily AI-curated pick alongside its popular flowers, with a short description on every card. Identifying a plant is clearer end to end, and a handful of small but real bugs — a clipped “Remind me” button, a confusing feed error — are fixed.
New- The Discover feed's homepage gets a daily “Today’s Garden Pick,” curated once a day by CoinGarden AI from the community's popular flowers — with a plain, honest fallback to the popular-flowers order whenever AI curation isn't available
- Every shared flower card now shows a short description drawn from the plant catalog
- Identifying a plant now offers separate “Take Photo” and “Choose from Gallery” actions instead of one ambiguous button
- A plant CoinGarden doesn't recognize yet no longer dead-ends — tapping it now searches the catalog for a match, or opens manual search pre-filled with what was suggested
Improved- Identification results show a clearer selected state — the whole card is tappable, with a check mark
- Uploaded photos are now verified as real image files rather than trusted by file extension; an unsupported format like HEIC now says so plainly instead of failing silently
Fixed- The “Remind me” button on a flower's care recommendations no longer gets squeezed into an unreadable sliver on narrow phone screens
- The Discover feed no longer shows “couldn’t load” and “nobody has posted yet” at the same time — a failed connection and an empty community are different situations, and the feed now says which one is actually happening, with a working “Try again”
Developer- Search-engine metadata corrected across every CoinGarden application — canonical links, sitemaps and robots.txt now point at the real deployed CoinGarden addresses rather than unrelated domains that happened to already be live
- The Admin Center's private pages were confirmed fully excluded from search indexing in production
A real plant catalog
Searching for a plant by common name now works the way it should — including “rose.” The catalog grew from about twenty houseplants to hundreds of real species, genera and families, with old scientific names and common-name variants all finding the right result.
New- The plant catalog grew from ~20 hand-picked houseplants to a real taxonomy of roughly 440 species, genera and families, covering houseplants, garden flowers, roses, orchids, succulents and cacti, common trees and shrubs, herbs, vegetables and fruit
- Searching an old or alternate scientific name now finds the right, currently-accepted species
- Searching a genus name (e.g. “Rosa”, “Hibiscus”, “Monstera”) surfaces every species CoinGarden knows in that genus
- Typo-tolerant search for common plant names
- The Admin Center gained a Plant Catalog page: coverage statistics, where each entry's data came from, and which searches are turning up nothing — so gaps in the catalog are visible instead of silent
Improved- AI plant identification is more honest when it's only confident about the genus, not the exact species — it now says so instead of guessing a specific species
- The “Search the plant catalog” screen explains what to type before you start, and suggests trying a broader term instead of just saying nothing matched
Fixed- Searching “Rose” (and many other common names) in the plant catalog no longer returns “No matching species found” — the catalog was missing the data in production, not just missing the search logic
Discover flowers together
CoinGarden opens up: browse the community's flowers and identify up to five plants a day without an account, share your own flowers when you choose to, and get an AI-personalized discovery feed when signed in.
New- A public Flower Discovery Feed on the Dashboard — the community's most-liked shared flowers, no account needed
- Identify up to five plants a day as a guest; your free limit resets automatically every day
- Share a flower to the community when you choose to — a clear confirmation shows exactly what becomes public, and you can unpublish at any time
- Like flowers you love (sign-in required) and see what the community loves
- Signed-in users get a personalized feed with short AI Garden Notes, grounded in the plant catalog
- A public display name for sharing — until you pick one you appear as “CoinGardener”, never your Google name or email
- My Gardens: your personal plant-care home — flowers, gardens, care due and reminders — moved from the Dashboard with a new summary
Improved- Bottom navigation now adapts to you: Discover, Identify, My Gardens and Profile when signed in; Discover, Identify, Home and Sign in as a guest
- The sign-in page explains what an account actually adds — browsing and daily identifications stay free without one
Security- Your private flowers, gardens, notes, care history and reminders never appear publicly — sharing copies only the fields you approve, as a snapshot
- The guest identification limit is enforced on the server against an anonymous, hashed visitor id — never an IP address or email
- Like counts are computed on the server with a one-like-per-person guarantee in the database itself
Every AI agent, working
All twelve CoinGarden AI agents now have real implementations, choose their own model on cost and capability, and run on a schedule.
New- All twelve AI agents are implemented and running: chat, CGW monitoring, daily system review, mobile insights, security triage, plant data quality, product insights, cost optimisation, release quality and CGW document validation
- Agents choose their own model automatically — the cheapest one whose capabilities are verified and which passes that agent's acceptance test
- Scheduled agents now actually run, on a fifteen-minute dispatcher with at-most-once delivery
- A review queue for results that warrant a person's attention
- A daily AI digest on the Admin Center homepage, built from real runs
- Run any analytical agent on demand, with its estimated cost shown before you press the button
Improved- Every agent computes its figures in SQL and asks a model only to interpret them, which is both cheaper and harder to get wrong
- Reports are scored against the evidence they were given, so a figure the model invented is flagged rather than published
- Model capability checks no longer report a text-only model as unable to produce structured output
- Model pricing is now known for OpenAI models, so cost comparisons are real rather than blank
Security- The chat assistant can only ever read the data of the person it is talking to, enforced in code rather than by instruction
- CGW monitoring is read-only by construction: no signing key exists and no write path is provided
AI Control Center and platform releases
Adds centralized AI provider management, improves flower recognition, and introduces in-app release notes with update notifications.
New- AI Control Center for managing OpenAI and Anthropic connections in one place
- Flower recognition now runs through a configurable AI agent, with provenance showing which model produced each suggestion
- Release notes at /changelog on every CoinGarden application
- In-app notification when a newer version has been deployed
- Install CoinGarden to your home screen from the mobile app
Improved- Recognition results now carry a validation score and can be corrected by you at any time
- Administrators can compare models by accuracy, latency and cost before switching
- Every application footer now shows the version you are running
Fixed- The Admin Center overview no longer fails to load when recent errors are present
- Admin AI pages now lay out correctly on narrow screens
Security- AI provider keys are stored encrypted and can never be read back out of the system
Developer- Database migrations now apply automatically on deployment
- Continuous integration runs the full test suite
Admin & Operations Center
Introduces the private operations console with service health, incidents, error monitoring and product analytics.
New- Admin & Operations Center with live service health and incident history
- Centralized error monitoring with grouped exceptions
- User and product analytics
Improved- Plant care, gardens and reminders now persist to the CoinGarden API rather than your browser
Foundation
The first CoinGarden.World release: gardens, flowers, plant care and the CGW token portal.
New- Create gardens and add flowers with photo identification
- Plant care reminders and care history
- CGW Token Portal with the project's published tokenomics
- Sign in with Google across every CoinGarden application
