Refine Trebuchet and extract Core/CLI boundaries

[atimics]

Overview

This PR makes Trebuchet one product with two deliberately different interfaces:

• a focused desktop experience for people launching a coin for the first time; and
• a headless, deterministic foundation for automation and future stable CLI execution.

The desktop opens into a practice-first Guided Mode. The complete on-chain launch is organized into the six actions a user actually takes: Launch wallet → Token & pools → Fund wallet → Create token → Create liquidity → Finish launch. Compatibility and release-audit machinery no longer defines the primary interface.

Launch configuration now begins with intent instead of raw pool topology. The operator sets a target liquidity budget, chooses Minimum/0, 1, 10, or 100 SOL, and Trebuchet derives a deliberately minimal strategy: one clear core market for minimum/lean launches or three purposeful core/reach/support bands for balanced/deep launches. Network fees and rent remain separately estimated before funding.

Discovery is personal rather than globally empty. Token Discovery and Wallet Tracking are separate tabs, the artificial 25-wallet cap is gone, and the scanner processes every enabled wallet through a four-worker bounded-concurrency queue with visible progress and batched wallet rendering.

Why this changed

The earlier interface exposed implementation language and Classic-era parity controls directly. That made a simple launch feel like configuring an execution engine, obscured the transition from configuration to funding, and mixed token results with wallet management. Discovery also enforced a product-level cap even though the underlying work can be queued safely.

This refactor keeps the full launch engine underneath while giving first-time users a small number of meaningful decisions and a clear next action in every phase.

Reviewable refactor layers

1. Guided launch UX and Trebuchet branding

   • Removes “v2” from product-facing branding.
   • Keeps the focused practice tutorial as the default first-user path.
   • Replaces Configure/Fund/Execute/Verify/Recover and “Classic parity controls” with six real launch phases.
   • Keeps the Guided/Full mode selector available throughout the launch flow.
   • Adds plain-language phase guidance, permanent-action warnings, readiness checks, back/next actions, and a visible plan-review transition.

2. Budget-derived liquidity strategy

   • Replaces the raw “SOL to spend” control with a target liquidity budget.
   • Adds Minimum/0, 1, 10, and 100 SOL presets plus a custom numeric budget.
   • Derives a lean one-band strategy for minimal launches and three purposeful bands for balanced/deep launches.
   • Shows core liquidity, support allocation, structure, and strategy posture before the plan is staged.
   • Reuses the same strategy abstraction in Guided Mode and the full six-phase launch.
   • Keeps advanced topology and distribution controls available underneath for operators who need them.

3. Explicit Local API lifecycle

   • Splits application construction from server startup and shutdown.
   • Removes import-time port binding and process-wide logging side effects.
   • Keeps the desktop server loopback-only and makes lifecycle behavior independently testable.
   • Redacts credentials in logged RPC URLs.

4. Trebuchet Core package

   • Extracts planning, validation, constants, integrity, estimates, and proof verification into @trebuchet/core.
   • Adds versioned plan/estimate contracts, SHA-256 integrity, compatibility exports, and a committed Guided SOL golden fixture.
   • Keeps Electron, Express, custody, RPC adapters, and renderer code outside Core.

5. Experimental Trebuchet CLI

   • Adds doctor, plan build, plan verify, estimate, and proof verify commands.
   • Provides a versioned JSON envelope and stable exit-code contract.
   • Is intentionally read-only: it cannot create wallets or send transactions.
   • Adds CLI contract and binary smoke coverage to CI.

6. Guided end-to-end coverage

   • Exercises the actual visible tutorial path instead of clicking controls hidden by Guided Mode.
   • Covers advanced wallet creation and secure import, then returns to Guided Mode for the complete practice launch.
   • Covers all six full-launch workspaces on desktop and mobile.

7. Personal wallet-seeded Discovery

   • Separates Token Discovery from Wallet Tracking.
   • Removes the product-level watch-only wallet cap and preserves thousands of local rows.
   • Keeps Trebuchet-managed wallets automatic and separate from the operator’s watched-wallet list.
   • Scans every enabled wallet with four concurrent lookups, visible completed/total progress, and retry guidance.
   • Renders large wallet collections in 100-row batches so the UI remains responsive.
   • Stores only public addresses, labels, and the latest graph snapshot in the local profile; no secret material enters Discovery.
   • Reads classic SPL and Token-2022 balances, filters NFT-like receipts and program-controlled owners, follows at most three known-token seeds one hop through qualifying holders, and ranks at most ten adjacent tokens.
   • Keeps the personal network score separate from token safety/evidence inspection.

Compatibility and safety

“Trebuchet” is the product name. Existing internal /v2/, /api/v2/, trebuchet-v2- and proof identifiers remain temporarily as compatibility contracts; this PR does not rename persisted schemas or break existing artifacts.

The CLI remains labeled experimental until custody, journaling, idempotent execution, resume/sweep recovery, and non-interactive confirmation contracts are extracted and proven independently.

Personal Discovery is read-only and has no product-level wallet cap; resource use is controlled by bounded concurrency and progressive rendering. Its network score describes overlap in the operator’s personal holder graph, not safety or endorsement.

Validation

• Pre-push build, syntax, and full test gate passed on 2c03f41.
• Full suite: 580 tests; 572 passed, 8 intentionally skipped, 0 failed.
• Syntax check: 162 files.
• Packaging closure: 39 runtime JS files / 42 required runtime files.
• Dependency audit policy passed: 0 critical, 0 moderate; documented upstream Solana advisories remain accepted.
• Trebuchet API-backed Guided E2E passed.
• Desktop and mobile viewport smoke passed and the proof hashes were refreshed.
• Live local UI review covered the budget recommender, Guided/Full launch modes, Token Discovery, and Wallet Tracking.
• Thousand-wallet persistence and 1,200-wallet full-queue selection are covered by tests.
• Electron default route and Classic fallback smoke passed.
• CLI contract and binary smoke remain covered by the full suite.

Still required before a stable execution CLI or mainnet-ready claim

• Extract custody, journal, execution, resume, final sweep, and recovery boundaries from the desktop/API layer.
• Add non-interactive approval inputs and idempotency keys to every state-changing CLI command.
• Pass funded devnet success, interruption, resume, partial-failure, and sweep-recovery runs using CI-held secrets.
• Archive reviewed live evidence for authority removal, liquidity creation/locking, Fee Key delivery, report publication, and terminal sweep verification.
• Complete signed/notarized release evidence for the supported desktop artifacts.

Those items are explicitly out of scope for the current read-only CLI; this PR does not claim that unattended mainnet execution is ready.