Milestone Report

1 · At a glance

2 · Demo video

Product walkthrough on mainnet — source connection, transform pipeline, SEAL encryption, on-chain registration, and access control.

Direct link: youtu.be/xDJbNH4JmRU — also serves as the public launch asset in §8, so it is listed rather than unlisted. Nothing in the video exposes contract internals, admin capabilities or the audit findings in §4.6.

3 · Testing evidence

3.1 Smart contract tests

3.2 Application test suites

Six executable suites in waldrop_app/scripts/. Each exists because a specific defect was found; the tests are the regression guard, not coverage theatre.

3.3 Manual QA / beta testing guide

221 documented cases across 12 sections, published to beta testers at testing.waldrop.xyz. Prioritised P0/P1/P2, with a bug-report template that requires /api/health output — so a dependency outage is never filed as a product defect.

3.4 Load & stress testing

Five k6 scripts, one per tier of the stack, so a run identifies which layer degraded rather than only that something did: publisher, aggregator, engine, backend API, frontend.

Measured baselines

Single-client sequential measurements — a latency floor, not a capacity figure. Taken from outside AWS across a cross-Pacific hop to the ap-northeast-1 publisher, so these are an upper bound on what a co-located client would see.

The 2.2–2.7 s maxima against a sub-second median are the finding here: variance rather than latency. Both are consistent with the publisher sitting in ap-northeast-1 while application traffic originates in us-east-1 — a planned relocation, tracked in §7.

4 · Defects found and fixed

Ten defects were found during review and remediated. Each is listed with how it would have presented to a user, because severity is easier to judge from the symptom than from the cause.

4.3 Dependency security scan

4.4 Contract security posture

4.5 Known areas of residual risk

4.6 External security audits

Two independent assessments were carried out by The Blockchain Team, both dated 14 August 2026. Full reports:

5 · Production deployment

Self-hosted Walrus publisher and aggregator on AWS behind nginx + TLS, with JWT-authenticated writes. Sui Object Display registered for all five user-facing types, so wallets and explorers render Waldrop objects with names and images rather than raw type strings.

6 · Observability

7 · Open items

Stated with cause, not just status. Nothing here is unknown work.

8 · Go-to-market

Five launch deliverables, all complete. The demo video is published; the blog post and ecosystem announcement are written and held for the launch window; and the remaining two are operating plans — reproduced below in full, because for those the plan is the deliverable.

8.1 Launch blog post — outline

A technical deep-dive, not an announcement. The argument is that a safe migration is now cheaper than an unsafe one, and the post earns that by showing the mechanism rather than asserting the benefit.

1. The problem nobody schedules. Object storage nobody can fully account for, and why the safe version of moving it never got budget.
2. Reading data without reading data. The profiler, and the boundary: column names, statistics and masked value shapes cross to the model; no raw cell ever does. Names the enforcement point and the canary test that guards it.
3. Policy you approve, not policy you accept. Deterministic detection separated from model judgement, proposals as editable rows, and the before/after diff on a real sample.
4. Encryption whose access rule is a contract. SEAL per-file and per-folder, revocation as a transaction rather than a support ticket.
5. What the chain remembers. Blob on Walrus, registry entry and content hash on Sui, and how a third party verifies a file without asking us.
6. What we got wrong. The publisher OOM and its real cause (§7), the two invalidated load runs (§3.4). Credibility comes from the defects section, not the feature list.

8.2 Community engagement plan

8.3 Launch-day support strategy

The operating assumption is that the first real failure will be capacity or wallet-related, because both have already happened once.

Coverage. Weekday hours for the launch window, with alerting routed to a phone outside them. Single-operator today — a real constraint, disclosed rather than papered over, and the reason the alert thresholds above are deliberately noisy.

Rollback. Infrastructure changes stay reversible for 48 hours: DNS TTL dropped to 60 s ahead of any cutover, the previous hosts left powered but disabled, and volume snapshots taken before any instance is terminated. Contract state is the exception and has no rollback — which is why the P0 items in §7 gate the launch rather than follow it.

9 · How to verify this report

Every number above is reproducible:

# Contract tests
cd waldrop-contracts && sui move test

# Application test suites
cd waldrop_app
for t in safe-redirect preview-diff rate-limit walrus-endpoint capped-stream bcs-schema; do
  bun run scripts/$t-test.ts
done

# Dependency scan
bun audit

# Live service health, per component
curl -s https://app.waldrop.xyz/api/health | python3 -m json.tool

# On-chain object verification
sui client object 0x2f548bb4bb1e5f7622c527417d3c0221840d0412ec23d70306f1bd4b79c20b45