Reported issues for suwappu

Pod holds 13 of 13 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to suwappu.

Most discussed

/goal: developer platform parity — evidence-complete, no exceptions

/goal — Suwappu developer platform parity

Bring Suwappu's developer platform to evidence-backed parity with top infrastructure APIs, not just similar documentation or feature count.

Benchmark set: Stripe, Cloudflare, Supabase, Alchemy, Plaid, Circle, Fireblocks, Twilio, Turnkey, Privy, 0x, LI.FI, Vercel, and Temporal.

This issue is the completion contract. **Do not close it, call the platform “parity,” or increase the final parity score to 100% until every gate below is green and a fres

Read the thread · 2026-08-21 · open · 2 comments

[P5-1] A2A task store persistence

Description

Replace in-memory A2A task store in routes/a2a.ts with PostgreSQL persistence.

Blocked by

None — can start immediately

Branch

phase/5/p5-1-a2a-persistence → PR to dev

Definition of Done

Agent loops until ALL conditions pass. Do not close until verified.

api-ts/src/db/schema/a2aTasks.ts exists
Tasks survive server restarts
Expired tasks cleaned up automatically

Required Tests (`api-ts/test/a2a-persistence.test.ts`)

Must be committed wi

Read the thread · 2026-03-07 · closed · 2 comments

Third-party integration surface is drifting: SDK releases never publish, mcp-server is 5 months stale, README advertises versions that don't exist

Audit of what an external developer actually gets when they try to build on Suwappu. Every number below was checked against the live npm registry and the repo, not inferred.

The release pipeline has never run

.github/workflows/publish-sdk.yml triggers only on push: tags: ['v*']. The GitHub Actions API reports 0 runs, ever, and the repo has exactly one tag (v0.4.0). So SDK work merges to main and stops there.

Three-way version drift

| Package | README claims | npm serves |

Read the thread · 2026-08-01 · open · 1 comment

[MONEY-PATH] admin_import_wallet: private-key-over-Telegram flow needs a security design, not an ad-hoc wire-up

Found during a dead-button sweep: the admin_import_wallet button (bot/handlers/admin_custodial.py:84) had no handler at all — tapping it did nothing.

The backing service does exist — hot_wallet_service.import_hot_wallet() accepts a raw private key string — so it would have been easy to wire a chat flow that prompts an admin to paste a key. That was deliberately not done: a private key typed into a Telegram chat hits Telegram's servers and persists in message history, and there is

Read the thread · 2026-08-01 · open · 1 comment

[Security][ROTATE] Plaintext private key in memory during predict signing (R6)

Severity: High · Type: key-in-memory (rotation if host compromise suspected) Location: bot/handlers/predict.py:752-770

Issue: A plaintext private key is held in process memory during predict signing, exposed to memory dumps/debuggers/core files. Best-effort zeroization was added elsewhere (H2) but this path needs review.

Required action:

Rotate keys only if a memory dump / host compromise is suspected (otherwise operational).
Minimize key lifetime in memory (zeroize

Read the thread · 2026-06-07 · open · 1 comment

[Security][ROTATE] Backup-key decryption has no 2FA/authorization gate (R4)

Severity: Critical · Type: key-handling (rotation if exploited) Location: bot/services/wallet.py:495-514

Issue: get_backup_private_key() decrypts backup keys with no 2FA/authorization gate. Defense-in-depth (access guard + anomaly logging) was added in the hardening pass (H3), but if this path was already exercised by an attacker, the underlying keys are compromised.

Required action:

If exposure is suspected, rotate affected wallet keys + migrate funds.
Add a real

Read the thread · 2026-06-07 · open · 1 comment

[P2-2] api-ts Telegram auth route tests

Description

Test /webapp/validate and /webapp/telegram/auth with mocked TelegramAuthService.

Blocked by

#199 ([P2-1] — test infrastructure must exist first)

Branch

phase/2/p2-2-auth-tests → PR to dev

Definition of Done

Agent loops until ALL conditions pass. Do not close until verified.

api-ts/test/webapp-auth.test.ts exists and passes

Required Tests

Must be committed with the implementation. No merge without passing tests.

`POST /webapp/validate ret

Read the thread · 2026-03-07 · open · 1 comment

Set ADMIN_API_KEY in AWS Secrets Manager

Problem

ADMIN_API_KEY is empty in suwappu/app-secrets, preventing API-based health checks and admin operations.

Requirements

Generate a secure API key
Add to suwappu/app-secrets in AWS Secrets Manager
Update API-TS to use it for admin endpoints

Command

# Generate key
ADMIN_KEY=$(openssl rand -hex 32)

# Update secret (merge with existing)
aws secretsmanager update-secret --secret-id suwappu/app-secrets \
  --secret-string "$(aws secretsmanager get-secret-value -

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/91) · 2026-01-31 · closed · 1 comment

## Most recent

### G10: zero-to-first-success developer onboarding parity

Parent /goal: #872

Closes **G10 — Developer onboarding parity**.

## Benchmark property
Stripe/Supabase/Vercel/0x-class onboarding makes the recommended path obvious, gets a new integrator to a safe first success quickly, and makes authority/environment/retry semantics explicit before money moves.

## Work
- Define one canonical zero-to-first-success journey for REST/SDK and one for agent/MCP consumers.
- Start with environment discovery + read-only capability/quote success.
- Make the first tr

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/886) · 2026-08-21 · open · 0 comments

### P1: generate endpoint-level auth scope and permission manifest

Parent: #872

## Benchmark property
Supabase and Cloudflare make required scopes/roles discoverable at endpoint level. Cloudflare's current 403 responses link directly to the denied endpoint documentation and permission requirements.

## Verified Suwappu foundation
- Organization API keys have named scopes and `requireScope()` enforcement.
- Wildcard `*` exists.
- Agent bearer tokens have a separate capability model.
- This parity branch makes org-scope failures return `INSUFFICIENT_SCOPE`, `req

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/882) · 2026-08-21 · open · 0 comments

### P1: define webhook delivery contract and delivery explorer

Parent: #872

## Benchmark property
Alchemy publicly documents webhook HMAC verification, testing, automatic retry/backoff, retry windows and ordering behavior. Mature webhook platforms make duplicate/replay semantics explicit and provide delivery evidence/redrive tooling.

## Verified Suwappu foundation
- Agent callback/webhook concepts exist.
- Signed swap-state webhooks are documented on public agent material.
- `/webhooks/test` and webhook event/history surfaces exist in the Agent API.

## M

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/878) · 2026-08-21 · open · 0 comments

### P0: publish and enforce SDK/API compatibility lifecycle

Parent: #872

## Benchmark property
Cloudflare publishes an SDK support lifecycle, semver expectations, migration guidance and active-support rules. Mature infrastructure separates SDK package versions from API compatibility versions.

## Verified Suwappu state
- `@suwappu/sdk` source is 0.6.x and published releases can lag source.
- `@suwappu/mcp-server` has its own source/registry version boundary.
- Python SDK is source-only in the current Product Status contract.
- Agent REST has `/v1`; Open

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/876) · 2026-08-21 · open · 0 comments

### Telegram initData Validation Endpoint

## Summary
Add FastAPI endpoint to validate Telegram WebApp initData for secure authentication.

## Dependencies
- **Blocks**: #10 (API client needs validation endpoint)
- **Parallel**: #6, #7, #8, #9 (frontend work can proceed simultaneously)

## Implementation
Add endpoint to validate Telegram WebApp data:
- POST /webapp/validate
- Verify HMAC signature using bot token
- Return user info if valid
- 401 if invalid

## Files to Create/Modify
- `api/webapp.py` - New router for webapp endpoints
- 

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/11) · 2026-01-17 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/0xSoftBoi/suwappubot/issues).

Reported issues for suwappu

Most discussed

/goal: developer platform parity — evidence-complete, no exceptions

/goal — Suwappu developer platform parity

[P5-1] A2A task store persistence

Description

Blocked by

Branch

Definition of Done

Required Tests (api-ts/test/a2a-persistence.test.ts)

Third-party integration surface is drifting: SDK releases never publish, mcp-server is 5 months stale, README advertises versions that don't exist

The release pipeline has never run

Three-way version drift

[MONEY-PATH] admin_import_wallet: private-key-over-Telegram flow needs a security design, not an ad-hoc wire-up

[Security][ROTATE] Plaintext private key in memory during predict signing (R6)

[Security][ROTATE] Backup-key decryption has no 2FA/authorization gate (R4)

[P2-2] api-ts Telegram auth route tests

Description

Blocked by

Branch

Definition of Done

Required Tests

Set ADMIN_API_KEY in AWS Secrets Manager

Problem

Requirements

Command

Required Tests (`api-ts/test/a2a-persistence.test.ts`)