LearnNext steps and changelog
Limits and next steps
What is built and measured today, and the next step for each open item, with owners and dates where they are known.
Every row below follows the committed evidence. Where this page and docs/GATES.md differ, the gate record wins. The submission deadline is Thu 12 Nov 2026, 12:00 PST (Fri 13 Nov 01:30 IST).
Built and measured
| What | Where it stands |
|---|---|
| G0 PASS G1 PASS G2 PASS G4 PASS | Four sandbox gates passed on the real PayPal sandbox: app and buyers, partial capture with final_capture, wallet and guest card AUTHORIZE, and six real webhooks verified. See gates. |
| Real server kill | A real server process was killed once on a CI runner after the capture request and before the response, and settled with one capture, two losers voided, a journal equal to PayPal and a verifying ledger of 19 entries (run 42558021614). |
| Live speech socket | Both providers answered 24 of 24 synthetic clips through the /audio socket, with no spoken bid accepted without a confirm (run 42575018866). |
| Hosted API | Webhook route p95 112.03 ms against a 300 ms target (n=50) and warmup after 16 minutes idle at most 0.66 s (n=2). See latency. |
| Hammer to settled | Measured at p95 6.93 s against a 6 s target (run 42563147792, n=49 settlements of 6 holds, INCOMPLETE); an earlier n=20 run measured 5.59 s. Owner decision open: keep the targets, raise them with a reason, or reduce latency. See latency. |
| One lot on the real sandbox | One lot of three holds settled and one in-process crash recovered, by the nightly specs R7, R8 and R10 (runs 42200708552 and 42317068784). |
| G5 PARTIAL | Voice measured on 24 synthetic clips in two sets (tuned on those clips): wrong accept 0.000, exact plus recoverable 1.000. On a synthetic held-out noisy set measured once (120 clips), wrong accept was 0.058 (Groq) and 0.092 (Deepgram) against 0.05. Every spoken bid goes through a confirm prompt. |
| Security review | All eight P0 items PASS as of 2026-11-07. See security review. |
| Hosted | Web app on Cloudflare and API on Render, in sandbox mode, with key-less judge rooms. See demo guide. |
Payments and gates
| Area | Today | Next | Owner and date |
|---|---|---|---|
| G3 IN PROGRESS honor period and reauthorize | Timed sandbox probe running. Started 7 Nov 03:06 UTC. Day 0 is recorded: an immediate reauthorize was refused with REAUTHORIZATION_TOO_SOON, and three authorizations were approved to be read at day 3.5, 4 and 5. The 30-day run is a simulation on a fake clock. | Final reading about 12 Nov 06:17 UTC. It sets the validity window and shows whether reauthorize extends it; auctions are sized to it. See gate G3. | harshbhx, 12 Nov |
| G3 early reading | Older G2 wallet authorization probed 8 Nov 17:36 UTC at age 3.24 days: a partial capture of 1.00 was accepted (HTTP 201) and the reauthorize call answered 422 UNPROCESSABLE_ENTITY with the issue PAYER_CANNOT_PAY. An early reading on a used authorization, not the G3 result. Run 42505780514. | The older G2 guest card authorization was probed on 9 Nov 00:09 UTC at age 3.5075 days (run 42538613566): still CREATED, a partial capture of 1.00 accepted (HTTP 201), reauthorize 422 PAYER_CANNOT_PAY. The day 3.5, 4 and 5 readings give the clean answer. | harshbhx, 8 Nov and 12 Nov |
| Remainder release (G1) | After the final capture the authorization reads CAPTURED and a later void answers 422 PREVIOUSLY_CAPTURED, so the remainder is treated as released. | Read a buyer balance to confirm the release directly, and capture a guest card order. | Date not set |
| Webhooks (G4) | Six real deliveries verified. Rejecting a tampered event is covered against the fake PayPal. | Record a tampered event and a PayPal retry delivery on the sandbox. | Date not set |
| Card and guest in a live room | G2 shows the SDK authorize flow for a wallet buyer and a guest card. | Record a card checkout inside a live judge room. | Date not set |
| Whole auction, hosted | The settlement saga is covered against the fake PayPal, and on the sandbox by the nightly specs and the 20-settlement measurement (one script, no server in the loop). See crash recovery. | Settle a whole auction through the hosted Render server. A real process kill ran on a CI runner (run 42558021614, one kill point); the kill on the deployed host is the next step. | Date not set |
Speed
| Target | Today | Next | Owner and date |
|---|---|---|---|
| Hammer to settled, 6 s | Measured at p95 6.93 s (n=49, run 42563147792, INCOMPLETE); earlier n=20 run 5.59 s. | Owner decision: keep, raise with a reason, or reduce latency. | Date not set |
| Hammer to captured, 2.5 s | p95 3.77 s (p50 2.78 s, n=49, run 42563147792); earlier n=20 run 3.01 s. The capture call alone is p95 2.72 s (3 calls failed). | Tune toward 2.5 s, or set the target from the sandbox figure. This is an owner decision. | harshbhx, date not set |
Voice
| Area | Today | Next | Owner and date |
|---|---|---|---|
| G5 PARTIAL speech accuracy | Measured on synthetic audio: 24 eSpeak and 24 human-like clips, Deepgram nova-3 and Groq whisper-large-v3-turbo. Fixes were chosen on those same clips. A synthetic held-out noisy set of 120 clips, measured once, read wrong accept 0.058 (Groq) and 0.092 (Deepgram) against 0.05 (run 42567832671). See voice and confirm. | Confirm in a live room with a person and a real noisy room. Until then no code path auto-accepts a spoken bid. | Date not set |
| Live speech | Cached transcripts by default; live speech runs only with VOICE_STT set. | One live run through the /audio socket is recorded (run 42575018866: 24 synthetic clips, both providers, fake PayPal in the server, no spoken bid accepted without a confirm). Still open: an audio sender in the web console, and a human voice in a real room. | Date not set |
Hosting and demo
| Area | Today | Next | Owner and date |
|---|---|---|---|
| Hosted app | Web at gavel.dualmindlab.tech and API at api.gavel.dualmindlab.tech, both in sandbox mode. Judge rooms open a real sandbox room. | Record a walk of the five-minute path on the hosted app. | Date not set |
| Storage | The Render service is set up with a 1 GB persistent disk and one instance (render.yaml). | Keep one instance: the file stores are owned by a single process. | Standing |
| Replay | The player and bundle format exist; the scripted demo plays a recorded room in the browser. | Host recorded live auctions for replay. | Date not set |
| Rejected bids | Kept in the room log. The hash-chained ledger holds accepted bids. See engine and ledger. | Decide whether rejected bids also go into the ledger. | Date not set |
Reviews and data
| Area | Today | Next | Owner and date |
|---|---|---|---|
| Security review | 13 of the 24 items are PASS (all eight P0), SEC-11 is ACCEPTED, and SEC-09, SEC-10, SEC-14 and SEC-15 (log scan) are PARTIAL; for SEC-15, one S01 server log and data folder scanned with 9 canaries, 0 findings (run 42566851766). SEC-19 and SEC-20, added for judge rooms and receipt links, are OPEN and awaiting review; SEC-21 to SEC-24 are PARTIAL and agent-only. | Independent review of SEC-19 and SEC-20, and a review of SEC-15 (Render logs and other routes are not scanned). | Date not set |
| Accessibility | Automated axe sweeps run in CI over the scripted bid, console and screen states. See accessibility. | A manual pass with a screen reader and 200 percent zoom. | Date not set |
| Open datasets | Five small datasets are published on Hugging Face. The speech, simulation and audit-trace sets use synthetic audio, a fake clock and scripted auctions by design. See open data. | Keep them in step with new evidence (for example when G3 finishes). | Date not set |
Why synthetic data
The speech, simulation and audit-trace datasets use synthetic speech, a simulated clock and scripted auctions on purpose. That is privacy by design: no real person's voice, name or payment detail is collected, stored or published. The sandbox accounts are test accounts with pretend funds.
See the changelog for what changed and when.
Edit on GitHub
Last updated on