v0.4.1 — Bug Audit: 16 fixes

v0.4.1 — 2026-07-05 · 16-bug audit

🔴 Critical (6 fixes)

• CI: ruff lint now fails on error (removed continue-on-error)
• CI: script tests fail the pipeline (removed || true)
• CI: SHA-pinned all actions (checkout@de0fac, setup-python@ece7)
• CI: isolated build (removed --no-isolation)
• Removed stale CLI/MCP copies (scripts/arc_builder_cli.py, mcp_server.py)
• ArcDocsClient: httpx → stdlib (removed undeclared dependency)
• tests/test_core.py: rewritten for current API

🟡 Medium (5 fixes)

• mcp_server.py docstring: 9 → 11 tools
• README.md + docs/builder-tooling.md: version pins updated
• doctor.py: import os at module top
• x402_client.py: removed unused imports

🟢 Security

• Arc chain-id check before eth_call in get_usdc_balance()
• Payment Intent Demo: CSP/SRI, 1 USDC limit, typed confirmation, one-shot send

🧪 Tests: 45/45 PASS | Ruff ✓ | Secret scan ✓ | twine check ✓

v0.4.0 — Circle Wallet Integration + arc doctor

v0.4.0 — 2026-07-05

🔌 Payment Intent Demo — Circle Wallet

• Real USDC balance, tx history, gas estimates via Circle CLI
• GET /api/wallet, /api/transactions, /api/estimate
• POST /api/approve with estimate-only mode (REAL_TRANSFER=1 for real sends)

🩺 arc-builder doctor — Circle checks

• --include-circle-wallet flag (opt-in)
• Checks: CLI installed ✓ session ✓ wallet ✓ balance ✓

⚡ x402 — RpcVerifier

• On-chain tx verification via eth_getTransactionReceipt
• --verifier-mode rpc flag

🤖 CI/CD

• Matrix test (3.10-3.12), script tests, ruff lint
• CHANGELOG.md

v0.2.2 — Agent Commerce Kit + CI

What's new

• Agent Commerce Kit — docs/agent-commerce-kit.md (ERC-8004 + ERC-8183)
• Interactive Web UI — examples/payment-intent-demo/server.py + enhanced index.html
• CI/CD — .github/workflows/ci.yml (test + build + Pages)
• Validate fixes — scripts/validate_repo.py: fixed false-positive detection
• README — updated with package structure, MCP tools, and quickstart
• Merge — origin/main merged (x402, wallet CLI, MCP server v2, templates)

Tests

22/22 passing | Validation OK

v0.2.1: PyPI Metadata Fix

v0.2.1

• Added project_urls (Homepage, Docs, Repo, Issues, Changelog)
• Upgraded to Development Status :: 4 - Beta
• Added classifiers: Build Tools, Financial
• Added keywords: usdc, circle
• Version-agnostic tests

v0.2.0: PyPI Package with Trusted Publishing

arc-builder-kit v0.2.0

Package

• Installable Python package: pip install arc-builder-kit
• CLI: arc-builder (doctor, validate, templates, scaffold, facts, manifest, mcp, release-packet)
• MCP server: arc-builder-mcp-server
• Wheel includes templates/, config/, examples/ - no git symlinks

PyPI Trusted Publishing

• OIDC-based publishing via GitHub Actions (publish-pypi.yml)
• No API token required - uses pending Trusted Publisher on PyPI
• Protected pypi environment

Security

• Fixed arbitrary directory deletion via release-packet --force
• Secret scanning in validation pipeline
• python_requires>=3.10 honestly declared

Verification

• python scripts/test_all.py -> 41/41 passed
• twine check dist/* -> PASSED
• Python 3.10 installed-wheel smoke -> PASSED
• Python 3.12 live RPC -> 5042002 / 0x4cef52, PASSED

Artifacts

• Wheel SHA-256: 6281ce6b5b9ffdac64a0fe51a539bd32b34c3b85a0315be468fcf37d7ef874e7
• sdist SHA-256: 5e1ea1e97d4f7711ed7603f4873bdd7f8bad5cd99af77219e0c1c0a8e81b4a72

Arc MCP Builder Assistant v0.1.0

Arc MCP Builder Assistant v0.1.0

Public-ready Arc builder kit with local-only payment prototypes, read-only Arc Testnet checks, and a separate disabled-by-default human-operated Arc Testnet browser-wallet send lab.

What's shipped

• 15 local-only interactive examples (payment intent, receipt viewer, receipt matcher, transaction status, job escrow, agent commerce, treasury lab, x402 challenge, wallet-send gate, agent identity)
• Arc Builder Doctor: one dependency-free readiness check command
• Release packet generator: local maintainer-facing packet
• Arc Testnet facts contract with offline consistency proof
• 33 canonical tests, all passing, no external dependencies
• CI: least-privilege permissions, pinned Actions, failure-path tests
• GitHub Pages: https://anstrays.github.io/arc-mcp-builder-assistant/

Safety boundaries

• No private-key handling in repo
• No custody
• No mainnet
• No autonomous spending
• No secrets committed
• Human approval required for every wallet action
• Local demos do not broadcast transactions

Release packet

Download arc-release-packet-v0.1.0.tar.gz for:

• arc-builder-doctor.md — readiness report
• arc-testnet-facts.md / .json — verified Arc Testnet constants
• readiness-checklist.md — maintainer checklist
• examples-index.md — all examples at a glance
• release-packet.json — machine-readable summary

Next

Circle agent wallet integration on Arc Testnet → live x402 payments → agent commerce.