feat(markets): Bitcoin difficulty betting (hidden L2, Lightning fund only)

[adrienlacombe]

Summary

Implements Bitcoin Markets betting for first users who hold Bitcoin. The UI never surfaces Starknet / STRK / felts / class hashes / strkBTC / deploy / paymaster.

Fund vs Bet (strict split)

Screen	Path
Add bitcoin / Fund with Lightning	Atomiq FROM_BTCLN_AUTO → product-labeled BTC. Tauri fund_lightning only returns the address.
Place bet	Hidden Starknet only: prepareTrade-style prep → [feeTransfer, ...trade.calls] → BIP-340 OutsideExecution → AVNU sponsored. No Lightning / invoice / Atomiq on the bet path.

prepareTrade / lognormal

No SDK prepareLognormalTrade. Reuse prepareTrade({ targetMean }) with targetMean = ln(D). Both hints = cairo isqrt(2·σ·√π) (same limbs). Calls = [strkBTC.transfer(feeRecipient, feeAmount), ...trade.calls]. No executeTrade(). Do not bump approve / supplied_collateral for the fee.

INDEXER_URL

Required env (or product public host). No localhost default. Adrien does not want this run locally. Loopback (http://127.0.0.1:8787) was listing-proof only and is refused by client resolvers.

INDEXER_URL=https://markets.bitcoinmarkets.app

• GET {INDEXER_URL}/api/markets
• GET {INDEXER_URL}/health

v1 market: address 0x023b3a7bbe48a905ceadc17cd21b6b71fedaf90ee1218e462b106e01703b9cc8, title “Bitcoin difficulty after next retarget”, marketType lognormal, xAxisLabel Difficulty, collateral copy BTC.

Do not put ADMIN_API_KEY or AVNU_API_KEY in the repo, client, or PR. Listing/health need no admin key. Set AVNU_API_KEY only on buzz-avnu-proxy at runtime.

Tests

• Fee math, halt-at-height, agent-key gate
• INDEXER_URL uses product host and refuses loopback
• v1 listing row match

See docs/bitcoin-markets.md.

  

[adrienlacombe]

Blocking review — 7 red CI jobs, plus one compile error hiding behind them

Opened threads for the blockers.

Attribution: I diffed each failure against main before calling it a regression. Desktop Build (macOS) and Smoke E2E 1/2/4 pass on main, so those failures are introduced here. Desktop Core and Smoke E2E 3 are already red on main for unrelated reasons (the entity-link scheme literals, and the flaky video-attachment spec) — but Desktop Core is red here for a new reason on top, see thread 8.

Threads opened:

1. MarketsScreen.tsx — wrong relative import path, 5 × TS2307, breaks pnpm build
2. routes/markets.tsx — invalid ViewLoadingFallbackKind
3. lognormalHints.ts — InstanceType<typeof SQ128x128> isn't newable
4. desktop/package.json — the new deps break tsc in two files this PR doesn't touch
5. commands/mod.rs — pub(crate) dropped from mod media; won't compile
6. placeBet.ts — the user's BTC amount is validated, then discarded
7. indexer.ts — silent fallback to an arbitrary market
8. buzz-core/src/lib.rs — rustfmt, plus the biome roundup

Worth knowing before fixing: pnpm build fails before the Tauri build runs, and the desktop crate sits outside the root workspace (AGENTS.md gotcha #5), so no job in this run has compiled desktop/src-tauri/src/commands/markets.rs. Thread 5 is one error found by reading it. Expect more once the frontend builds and that file actually reaches the compiler — worth running cargo check --manifest-path desktop/src-tauri/Cargo.toml locally before the next push.

---

Not opened as threads — these are from the full review and aren't CI failures, but a couple are more serious than anything above. Flagging so they don't get lost; say the word and I'll open threads for them too:

• buzz-avnu-proxy is an unauthenticated open relay for a paid API key. Binds 0.0.0.0:8788, CorsLayer with allow_origin(Any)/allow_methods(Any)/allow_headers(Any), no auth, no method allowlist — it forwards any JSON-RPC body upstream with x-paymaster-api-key injected. Anyone who can reach it spends the sponsor's quota. Compare infra/aws/paymaster.tf, which gives the paymaster an egress-only SG with no ingress rule at all.
• place_bet signs whatever the frontend hands it. It takes Vec<PreparedCall> and validates only that entrypoint names don't contain lightning/atomiq/invoice. Nothing checks the calls target DIFFICULTY_MARKET / COLLATERAL_TOKEN / FEE_RECIPIENT, so a compromised renderer gets a BIP-340 signature over arbitrary Starknet calls — gas-sponsored. This inverts the rule AGENTS.md sets for the paymaster ("the account address is derived from the event author, never from the payload").
• The wallet fee isn't enforced. place_bet computes fee_amount and returns it but never checks the fee transfer is actually in calls. A modified client omits it; PlaceBetResult.feeAmount is cosmetic.
• The agent-key gate is a tautology. human_keys() calls assert_human_keyring_name(HUMAN_IDENTITY_KEYRING_NAME) — the constant is "identity", exactly the value that returns Ok. It cannot fail, and every test around it exercises a function never called with a real input.
• markets.test.mjs re-implements the functions it tests (walletFeeAmount, haltHeight, resolveIndexerUrl, findDifficultyMarket, …) instead of importing them, so it passes regardless of what ships. Worth fixing for fee math specifically.
• The proxy never deploys. infra/aws/markets.tf.md is a .md, and avnu_proxy_url() defaults to http://127.0.0.1:8788 — so in a shipped build the bet path points at a local proxy that doesn't exist. The PR is emphatic that INDEXER_URL has no localhost default; the same standard isn't applied to the variable that actually spends money.
• env.INDEXER_URL doesn't reach the client. indexer.ts reads it off import.meta.env, which Vite only populates for VITE_-prefixed vars. .env.example and the docs tell operators to set INDEXER_URL; client-side that silently does nothing and falls through to the hardcoded host.
• No Signed-off-by on any of the 6 commits. AGENTS.md requires git commit -s; the DCO check doesn't appear to be enabled on this fork, so nothing caught it.
• AGENTS.md's fork-local table got a row update for Dockerfile but not for the new divergences — buzz-core/src/markets.rs + its lib.rs mod line, crates/buzz-avnu-proxy/, and the desktop sidebar/AppShell/routeTree.gen.ts edits. Those last ones will conflict on every upstream sync.

[adrienlacombe]

Replied on each review thread.

Resolved (code matches):

• ../lib imports
• ViewLoadingFallbackKind (kind="projects")
• SQ128x128 (no InstanceType)
• pub(crate) mod media restored; Felt/selectors re-exported from buzz-core (no starknet_core in Tauri)
• user collateralBtc is passed through and spent
• no markets[0] substitute
• rustfmt (also after rebase onto main / PR 32)

Left open:

• desktop/package.json — alphabetize + exact pins for @the-situation/*
• biome: noExplicitAny / noNonNullAssertion / noLabelWithoutControl

Not opened as threads (still unfixed, from the review body): unauthenticated AVNU proxy, place_bet signs arbitrary frontend calls, fee transfer not enforced in calls, agent-key gate tautology, tests re-implement helpers, proxy localhost default, INDEXER_URL vs VITE_INDEXER_URL, DCO/Signed-off-by, AGENTS.md table. Say the word and those get threads + fixes.

[adrienlacombe]

Hold-list on a6585948 (no dedicated review threads for these; recording here):

3–4. place_bet rebuilds the batch via build_validated_bet_batch (fee transfer first, then only approve + execute_trade against product contracts). Fee-first is also asserted on AVNU's typed_data Calls before BIP-340.
5. Agent-key gate tests real agent:<pubkey> slots (agent_keyring_slot_used_by_secret_store_is_rejected), not a HUMAN_IDENTITY_KEYRING_NAME tautology.
6. markets.test.mjs imports walletFeeAmount / halt helpers / indexer helpers — does not reimplement them.
7. AVNU_PROXY_URL is required (no localhost client default). Proxy bind defaults to loopback; non-loopback requires PROXY_AUTH_TOKEN.
8. INDEXER_URL reaches the client (VITE_INDEXER_URL + Tauri markets_indexer_url). Loopback refused.
9. buzz-avnu-proxy is not an unauthenticated open relay (loopback default, no CORS Any, auth off-loopback, JSON-RPC parse before forward).

Review threads on package.json and biome are resolved. DCO / AGENTS.md still deferred.