docs: project status assessment (2026-06-03)

[dantaik]

Operator-facing status snapshot, added as docs/project-status-assessment-2026-06-03.md. Reconciles final_readiness_report.html, docs/launch-log.md, issue #21, and the round-2/round-4 mainnet smoke logs. No spec or code changes — assessment artifact only.

Key findings

• Code maturity: high (58% overall, NO-GO). All suites pass; v2.1 pull-pattern is implemented + tested. Blockers are operational/external (audit, drills, key custody, real-money smoke), not code.
• Deployed code ≠ current main. Live baseline is cf0d0eb/v2.1.9; HEAD is 76eb6f9. Eight commits since (peer channels feat: direct peer channels with the hub as a message relay #154, idle auto-close feat(hub): auto-close idle channels after no payment for 24h #153, Docker/CI fix(docker): install pnpm via npm instead of corepack #160–ci(gke-images): make Trivy scan report-only #162, Version Packages #151) were never validated on mainnet. The v2.1 pull-pattern contracts (feat(contracts): v2.1 pull-pattern disbursement — fixes U-01/U-02/U-03 (closes #129) #140) were never deployed/smoked — live contracts are still push-pattern, exposing USDC settlement to a hub-wallet blocklist freeze (U-01/U-02).
• No real USDC on mainnet. launch-log.md real-USDC smoke = PENDING; smokes used ETH + PTST only. 4 PTST from Round-2 may still be locked (needs finalize confirmation). Deployer EOA still owns the proxies.
• The "few thousand USDC" task ([high][test] Real-USDC mainnet smoke channel end-to-end #49/Real-USDC mainnet smoke (open → topUp → pay → close → unilateral close + finalize) not executed #148) can't be done directly: it depends on Phase A (deploy pull-pattern + transfer ownership) and Phase B (redeploy latest images + smoke). It also exceeds the current 1000 USDC design ceiling ([high][test] Real-USDC mainnet smoke channel end-to-end #49), so the amount needs a decision first.
• Issue ⭐⭐⭐⭐⭐Production readiness re-evaluation: new infra gaps discovered, still ~45% ready #21 is stale. 4 of its 6 "new gaps" are already fixed in current code (watchtower litestream sidecar, Fly retention 30d, e2e-fork in CI gate). Remaining: single CODEOWNER, verify __forFlush() annotation.
• Open PRs: build(deps): bump ws from 8.20.0 to 8.21.0 #167 (ws DoS patch — merge soon), fix(security): replace PGP placeholder with actionable guidance #152 (PGP placeholder fix, stale fork PR — review), build(deps): bump viem from 2.49.0 to 2.51.3 #168/build(deps-dev): bump the dev-deps group with 10 updates #166 dependabot.

The doc includes a dependency-ordered Phase 0→D action list tagging each item as operator-only vs. assistant-doable.

https://claude.ai/code/session_017eYK9Y8CA9NBjsu4bwAUgG

---

Generated by Claude Code