MRWK bounty: code health and app.main expansion readiness

[ramimbo]

MRWK Bounty

Reward: 200 MRWK per accepted award
Max awards: 4

Work Needed

Keep MergeWork small, secure, testable, and easy to expand while many agents are contributing. The priority target is app/main.py, which currently carries route wiring, template rendering, MCP dispatch, OAuth/session handling, admin flows, and public helper logic.

Useful accepted work can include:

• Extract a coherent subsystem from app/main.py into focused modules without changing public behavior. Good targets include MCP dispatch, admin routes, OAuth/session routes, or activity/bounty view helpers.
• Consolidate duplicated validation, parsing, response-shaping, or link-building logic behind a clear helper with focused tests.
• Improve module boundaries so ledger, wallet, webhook, admin, public API, and MCP behavior are easier to review independently.
• Add regression tests that lock down behavior before and after the refactor.
• Remove genuinely dead or redundant code only with evidence that it is unused.

Acceptance Criteria

• Open a focused PR that links this issue with Bounty #<issue number> or Refs #<issue number>.
• Explain the concrete complexity reduced and why the new boundary is easier to maintain.
• Preserve public API, MCP, ledger, wallet, webhook, admin, and page behavior unless the PR fixes a documented bug.
• Include targeted tests for the moved or consolidated behavior.
• Avoid broad rewrites, formatting-only changes, line-ending churn, import-only churn, or unrelated style edits.
• Keep the PR small enough to review. A coherent extraction is preferred over a large architecture rewrite.
• Existing checks pass.
• One award per distinct useful accepted code-health improvement. Tiny helper moves, cosmetic renames, duplicate extractions, or unrelated cleanup do not qualify.
• Do not post private keys, seed material, secrets, private vulnerability details, deployment credentials, or price claims.

How To Submit

Open a focused PR with the required evidence. A maintainer must apply mrwk:accepted or record an admin payout before payment.

[ramimbo]

Reserved on MergeWork: https://mrwk.ltclab.site/bounties/52

[ayskobtw-lil]

/claim\n\nSubmitted PR #328 for Bounty #320: https://github.com/ramimbo/mergework/pull/328\n\nWhat changed:\n- Extracted accepted-work activity serialization from �pp/main.py into focused �pp/activity.py helpers.\n- Kept public activity, account accepted-work, and account-page behavior wired through the same route layer while moving query/aggregation details out of �pp/main.py.\n- Added a helper fallback regression for accepted-work schema stability.\n\nValidation:\n- Wrote ests/test_activity_helpers.py first and observed the expected missing-module failure before extracting the helpers.\n- python -m pytest tests/test_activity_helpers.py tests/test_activity.py tests/test_api_mcp.py -q -> 72 passed.\n- python -m ruff check app/activity.py app/main.py tests/test_activity_helpers.py -> All checks passed.\n- python -m ruff format --check app/activity.py app/main.py tests/test_activity_helpers.py -> 3 files already formatted.\n- python -m mypy app -> success.\n- python scripts/docs_smoke.py -> docs smoke ok.\n- git diff --check -> clean.\n\nNo secrets, wallet private keys, private payout details, deployment values, private vulnerability details, or MRWK price claims were included.

[shootingallday]

/claim

Submission for Bounty #320: #329

Implemented a focused MCP transport extraction: /mcp JSON-RPC parsing, tool metadata, protocol error shaping, and structured-content response shaping now live in app/mcp.py; app/main.py delegates the route to handle_mcp_request() while keeping existing _call_mcp_tool() business dispatch unchanged.

Complexity reduced: app/main.py drops the inline MCP transport block, making MCP protocol behavior reviewable separately from route/page/admin wiring without changing public MCP tool semantics.

Validation:

• uv run --extra dev python -m pytest tests/test_api_mcp.py -q -> 68 passed.
• uv run --extra dev ruff check app/main.py app/mcp.py tests/test_api_mcp.py -> passed.
• uv run --extra dev ruff format --check app/main.py app/mcp.py tests/test_api_mcp.py -> passed.
• uv run --extra dev python -m mypy app/main.py app/mcp.py -> success.
• git diff --check -> clean.

No secrets, wallet private keys, payout credentials, private vulnerability details, deployment values, or MRWK price claims are included.

[TateLyman]

/claim

Submitted PR #330 for Bounty #320: #330

What changed:

• Extracted public response shaping from app/main.py into app/serializers.py for bounty rows/summaries, ledger rows, activity/account accepted-work summaries, wallet rows, and transfer rows.
• Kept route wiring, auth/session handling, admin flows, and request parsing in app/main.py, reducing the file by moving a coherent serialization boundary out of the route layer.
• Added focused serializer tests for public bounty capacity, accepted-work summaries, and wallet response shape.

Validation:

• uv run --extra dev python -m pytest tests/test_serializers.py tests/test_api_mcp.py::test_bounty_api_reports_multi_award_capacity tests/test_activity.py -q -> 6 passed
• uv run --extra dev python -m pytest tests/test_api_mcp.py tests/test_activity.py tests/test_wallet_api.py tests/test_security.py -q -> 154 passed
• uv run --extra dev python -m pytest -q -> 290 passed
• uv run --extra dev ruff check app/main.py app/serializers.py tests/test_serializers.py -> passed
• uv run --extra dev ruff format --check app/main.py app/serializers.py tests/test_serializers.py -> passed
• uv run --extra dev mypy app -> success
• git diff --check -> passed

[ramimbo]

Maintainer update: PR #329 and PR #330 merged and paid.

• PR Extract MCP transport handler #329 proof: https://api.mrwk.ltclab.site/proofs/ee86fd263c2cad4e024685ef1890041ac2959fd24dfb04fb10a23e3c0e6ee373
• PR Extract public serialization helpers #330 proof: https://api.mrwk.ltclab.site/proofs/27a8d709572998a696bb804f46379d45c678600e18ef07cb53c9ccc469d3d947

Round status: 2/4 awards paid, 2 slots remain. PR #328 is held with mrwk:needs-info for rebase around the accepted serializer boundary. Full payment table: #16 (comment)

[AugmentSecurity]

/claim

Submitted PR for Bounty #320: #337

What changed:

• Extracted the bounty-attempt reservation subsystem from app/main.py into focused app/bounty_attempts.py route/helper registration.
• Moved attempt serialization, effective-status handling, active-attempt filtering, stale expiration, warning generation, duplicate handling, registration, listing, and release handling behind one coherent module boundary.
• Left public bounty, ledger, wallet, webhook, admin, payout, MCP, and page behavior unchanged.
• Added a direct serializer regression for expired active attempts, while preserving the existing route-level attempt coverage.

Complexity reduced:

• app/main.py no longer owns reservation-specific timestamp normalization, stale-attempt cleanup, warning construction, and attempt route internals.
• The reservation feature can now be reviewed independently from the main route layer, which matches the MRWK bounty: code health and app.main expansion readiness #320 goal of making app/main.py easier to expand safely.

Validation:

• ./.venv/bin/python -m pytest tests/test_bounty_attempts.py tests/test_api_mcp.py -q -> 77 passed
• ./.venv/bin/python -m pytest -q -> 319 passed
• ./.venv/bin/python -m ruff check app/bounty_attempts.py app/main.py tests/test_bounty_attempts.py -> passed
• ./.venv/bin/python -m ruff format --check app/bounty_attempts.py app/main.py tests/test_bounty_attempts.py -> passed
• ./.venv/bin/python -m mypy app/bounty_attempts.py app/main.py -> passed
• ./.venv/bin/python scripts/docs_smoke.py -> docs smoke ok
• git diff --check -> clean

No secrets, wallet private keys, payout credentials, private vulnerability details, deployment values, or MRWK price claims are included.