import type { Metadata } from 'next';

export const metadata: Metadata = {
  title: 'Security & Audit Status — Vaultfire',
  description:
    'Honest security posture of the Vaultfire Protocol. What is audited, what is not, known limitations, and the path to further hardening.',
};

export const dynamic = 'force-static';

function Badge({
  tone,
  label,
}: {
  tone: 'green' | 'yellow' | 'red' | 'blue';
  label: string;
}) {
  const colors: Record<typeof tone, { bg: string; border: string; text: string }> = {
    green: { bg: '#10B9811A', border: '#10B98166', text: '#34D399' },
    yellow: { bg: '#F59E0B1A', border: '#F59E0B66', text: '#FBBF24' },
    red: { bg: '#EF44441A', border: '#EF444466', text: '#F87171' },
    blue: { bg: '#00D9FF1A', border: '#00D9FF66', text: '#67E8F9' },
  };
  const c = colors[tone];
  return (
    <span
      className="inline-block text-xs font-semibold uppercase tracking-wider px-2.5 py-1 rounded-md border"
      style={{ backgroundColor: c.bg, borderColor: c.border, color: c.text }}
    >
      {label}
    </span>
  );
}

export default function SecurityPage() {
  return (
    <main className="min-h-screen bg-[var(--color-ember-bg)] text-[var(--color-ember-text)] px-6 py-12">
      <div className="max-w-4xl mx-auto">
        <a
          href="/"
          className="text-sm text-[var(--color-ember-text-muted)] hover:text-white transition-colors"
        >
          ← theloopbreaker.com
        </a>

        <h1 className="mt-6 text-4xl md:text-5xl font-bold">
          Security & Audit Status
        </h1>
        <p className="mt-4 text-lg text-[var(--color-ember-text-muted)] max-w-3xl">
          Every claim on this page is verifiable. Every limitation is disclosed. We
          would rather lose a partnership over honest disclosure than win one on
          marketing.
        </p>

        {/* Plain-English audit posture — said up front, not buried */}
        <div className="mt-6 rounded-xl border border-[#F59E0B]/40 bg-[#F59E0B]/5 p-5 max-w-3xl">
          <p className="text-sm text-[#FBBF24] font-semibold mb-2">
            Read this first.
          </p>
          <p className="text-sm text-[var(--color-ember-text-muted)] leading-relaxed">
            Vaultfire has had{' '}
            <span className="text-white font-semibold">zero third-party security audits</span>.
            All review to date is local + AI-assisted. The contracts are
            open-source and deployed on-chain — anyone is welcome to read,
            fork, or break them. A paid audit from a Tier-1 firm currently
            costs more than this project earns. We&apos;d rather tell you that
            than fake it.
          </p>
        </div>

        {/* ── Snapshot ───────────────────────────────────────────────── */}
        <div className="mt-8 rounded-xl border border-white/10 p-6 bg-white/[0.02]">
          <h2 className="text-xl font-semibold mb-4">Snapshot</h2>
          <div className="grid grid-cols-1 md:grid-cols-2 gap-4 text-sm">
            <div>
              <div className="text-xs uppercase tracking-wider text-[var(--color-ember-text-muted)] mb-1">
                AI-assisted internal review
              </div>
              <div className="flex items-center gap-2">
                <Badge tone="yellow" label="Done" />
                <span>9.8/10 self-rating, not a third-party audit</span>
              </div>
            </div>
            <div>
              <div className="text-xs uppercase tracking-wider text-[var(--color-ember-text-muted)] mb-1">
                Third-party firm audit
              </div>
              <div className="flex items-center gap-2">
                <Badge tone="red" label="None" />
                <span>Aspirational, contingent on funding</span>
              </div>
            </div>
            <div>
              <div className="text-xs uppercase tracking-wider text-[var(--color-ember-text-muted)] mb-1">
                Governance
              </div>
              <div className="flex items-center gap-2">
                <Badge tone="yellow" label="1-of-1 multisig" />
                <span>Moving to multi-signer</span>
              </div>
            </div>
            <div>
              <div className="text-xs uppercase tracking-wider text-[var(--color-ember-text-muted)] mb-1">
                ZK verification
              </div>
              <div className="flex items-center gap-2">
                <Badge tone="yellow" label="Bootstrap" />
                <span>Contract deployed, Router not yet wired</span>
              </div>
            </div>
            <div>
              <div className="text-xs uppercase tracking-wider text-[var(--color-ember-text-muted)] mb-1">
                Critical vulnerabilities
              </div>
              <div className="flex items-center gap-2">
                <Badge tone="green" label="Zero" />
                <span>Known at time of deployment</span>
              </div>
            </div>
            <div>
              <div className="text-xs uppercase tracking-wider text-[var(--color-ember-text-muted)] mb-1">
                Bug bounty
              </div>
              <div className="flex items-center gap-2">
                <Badge tone="blue" label="Open" />
                <span>Report to ghostkey316@proton.me</span>
              </div>
            </div>
          </div>
        </div>

        {/* ── Internal audit details ─────────────────────────────────── */}
        <section className="mt-10">
          <h2 className="text-2xl font-bold mb-3">Internal audit</h2>
          <p className="text-sm text-[var(--color-ember-text-muted)] mb-4">
            Performed January 27, 2026 by Claude Sonnet 4.5 as an AI-assisted
            infrastructure-grade review. This is not a substitute for a
            third-party firm audit. It is a rigorous self-disclosure.
          </p>

          <div className="rounded-xl border border-white/10 p-6">
            <h3 className="font-semibold mb-3">What was reviewed</h3>
            <ul className="text-sm space-y-2 text-[var(--color-ember-text-muted)]">
              <li>• All core contracts (Identity, Bonds, Oracles, Governance, Privacy)</li>
              <li>• Inheritance hierarchy and access-control patterns</li>
              <li>• Value transfer logic, reentrancy guards, timelocks</li>
              <li>• Economic model (bond math, yield pool, flourishing-weighted distribution)</li>
              <li>• Privacy architecture (anti-surveillance, ZK framework)</li>
              <li>• Test coverage (225+ Python + 2,656 lines JS)</li>
            </ul>

            <h3 className="font-semibold mt-6 mb-3">Key findings</h3>
            <ul className="text-sm space-y-2">
              <li>
                <span className="text-[#34D399] font-semibold">✓ Strong:</span>{' '}
                ReentrancyGuard on all value transfers, 7-day distribution
                timelocks, explicit balance checks, safe ETH transfer patterns.
              </li>
              <li>
                <span className="text-[#34D399] font-semibold">✓ Strong:</span>{' '}
                AI profit caps (30% / 50%) enforced at the contract level.
                Domination penalty (100% to human) enforced at the contract level.
              </li>
              <li>
                <span className="text-[#34D399] font-semibold">✓ Strong:</span>{' '}
                Privacy guarantees module is immutable. Nine categories of
                surveillance data are explicitly banned on-chain.
              </li>
              <li>
                <span className="text-[#FBBF24] font-semibold">⚠ Noted:</span>{' '}
                The Production Belief Attestation Verifier contract is deployed
                on Base and Avalanche with a real 48-hour timelock. It is
                currently in bootstrap mode — the verifier Router address and
                imageId are sentinel values, not yet pointed at the official
                RISC Zero Router or a compiled guest program. Verified
                on-chain.
              </li>
              <li>
                <span className="text-[#FBBF24] font-semibold">⚠ Noted:</span>{' '}
                Multisig governance is currently 1-of-1. See owner powers below.
              </li>
            </ul>
          </div>
        </section>

        {/* ── Owner powers ───────────────────────────────────────────── */}
        <section className="mt-10">
          <h2 className="text-2xl font-bold mb-3">Owner powers (full disclosure)</h2>
          <p className="text-sm text-[var(--color-ember-text-muted)] mb-4">
            The protocol&apos;s <code className="text-xs bg-white/10 px-1.5 py-0.5 rounded">MultisigGovernance</code>{' '}
            contract is currently a 1-of-1 multisig held by the deployer wallet.
            This means the deployer has the following powers. We disclose them
            publicly because partners deserve to know.
          </p>

          <div className="rounded-xl border border-[#F59E0B]/40 bg-[#F59E0B]/5 p-6">
            <ul className="text-sm space-y-3">
              <li>
                <span className="font-semibold">Yield pool management.</span>{' '}
                The owner can withdraw ETH from the shared yield pool and adjust
                the minimum balance. Setting the minimum to zero would allow the
                pool to be drained.
              </li>
              <li>
                <span className="font-semibold">Oracle management.</span>{' '}
                The owner can add or remove oracles in the Flourishing Metrics
                Oracle, which can influence reported metrics.
              </li>
              <li>
                <span className="font-semibold">Protocol pause.</span>{' '}
                Bond contracts can be paused by the owner, halting new bond
                creation and distributions.
              </li>
              <li>
                <span className="font-semibold">ZK image changes.</span>{' '}
                The Production Belief Attestation Verifier image ID can be
                changed by the owner, subject to a 48-hour timelock.
              </li>
              <li>
                <span className="font-semibold">Bridge relayers.</span>{' '}
                The owner can add or remove authorized relayers on the cross-chain
                Teleporter Bridge and can pause the bridge.
              </li>
            </ul>
          </div>

          <p className="mt-4 text-sm text-[var(--color-ember-text-muted)]">
            Source:{' '}
            <a
              href="https://github.com/ghostkey316/theloopbreaker-site/blob/main/SECURITY.md"
              target="_blank"
              rel="noreferrer"
              className="text-[var(--color-ember-accent)] hover:underline"
            >
              SECURITY.md
            </a>
            . This document is maintained alongside the contracts and is the
            canonical source of ownership and upgrade authority.
          </p>
        </section>

        {/* ── Decentralization roadmap ───────────────────────────────── */}
        <section className="mt-10">
          <h2 className="text-2xl font-bold mb-3">Decentralization roadmap</h2>
          <div className="rounded-xl border border-white/10 overflow-hidden">
            <table className="w-full text-sm">
              <thead className="bg-white/5 text-left">
                <tr>
                  <th className="px-4 py-3 font-semibold">Stage</th>
                  <th className="px-4 py-3 font-semibold">Target</th>
                  <th className="px-4 py-3 font-semibold">Status</th>
                </tr>
              </thead>
              <tbody>
                <tr className="border-t border-white/5">
                  <td className="px-4 py-3">1-of-1 multisig</td>
                  <td className="px-4 py-3 text-[var(--color-ember-text-muted)]">
                    Initial deployment
                  </td>
                  <td className="px-4 py-3">
                    <Badge tone="green" label="Current" />
                  </td>
                </tr>
                <tr className="border-t border-white/5">
                  <td className="px-4 py-3">3-of-5 multisig with independent signers</td>
                  <td className="px-4 py-3 text-[var(--color-ember-text-muted)]">
                    Post-first-partner
                  </td>
                  <td className="px-4 py-3">
                    <Badge tone="yellow" label="Planned" />
                  </td>
                </tr>
                <tr className="border-t border-white/5">
                  <td className="px-4 py-3">Timelock on all owner actions</td>
                  <td className="px-4 py-3 text-[var(--color-ember-text-muted)]">
                    With multisig expansion
                  </td>
                  <td className="px-4 py-3">
                    <Badge tone="yellow" label="Planned" />
                  </td>
                </tr>
                <tr className="border-t border-white/5">
                  <td className="px-4 py-3">Tier-1 third-party audit</td>
                  <td className="px-4 py-3 text-[var(--color-ember-text-muted)]">
                    OpenZeppelin / Trail of Bits / Consensys Diligence —
                    contingent on funding
                  </td>
                  <td className="px-4 py-3">
                    <Badge tone="red" label="Unfunded" />
                  </td>
                </tr>
                <tr className="border-t border-white/5">
                  <td className="px-4 py-3">Wire production RISC Zero Router</td>
                  <td className="px-4 py-3 text-[var(--color-ember-text-muted)]">
                    0x0b144e07a0826182b6b59788c34b32bfa86fb711 on Base +
                    compile guest program
                  </td>
                  <td className="px-4 py-3">
                    <Badge tone="yellow" label="Bootstrap" />
                  </td>
                </tr>
                <tr className="border-t border-white/5">
                  <td className="px-4 py-3">Token-weighted governance</td>
                  <td className="px-4 py-3 text-[var(--color-ember-text-muted)]">
                    After stable ecosystem
                  </td>
                  <td className="px-4 py-3">
                    <Badge tone="blue" label="Future" />
                  </td>
                </tr>
              </tbody>
            </table>
          </div>
        </section>

        {/* ── What to trust / what not to trust yet ──────────────────── */}
        <section className="mt-10">
          <h2 className="text-2xl font-bold mb-3">What to trust today</h2>
          <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
            <div className="rounded-xl border border-[#10B981]/40 bg-[#10B981]/5 p-5">
              <div className="font-semibold text-[#34D399] mb-3">Safe to build on</div>
              <ul className="text-sm space-y-2">
                <li>• ERC-8004 identity registration</li>
                <li>• Partnership Bond creation + distribution</li>
                <li>• Accountability Bond creation + flourishing-weighted distribution</li>
                <li>• Flourishing Metrics submission + verification</li>
                <li>• x402 paid endpoints (contracts, stats, agent status)</li>
                <li>• VNS name resolution</li>
                <li>• Cross-chain reads (all 4 chains)</li>
              </ul>
            </div>
            <div className="rounded-xl border border-[#F59E0B]/40 bg-[#F59E0B]/5 p-5">
              <div className="font-semibold text-[#FBBF24] mb-3">Use with caution</div>
              <ul className="text-sm space-y-2">
                <li>• Zero-knowledge belief attestations (verifier in bootstrap mode — not yet verifying real proofs)</li>
                <li>• Teleporter Bridge for large-value cross-chain moves</li>
                <li>• Staking large amounts given 1-of-1 multisig</li>
                <li>• Any assumption that a Tier-1 firm has reviewed code</li>
              </ul>
            </div>
          </div>
        </section>

        {/* ── Bug bounty ─────────────────────────────────────────────── */}
        <section className="mt-10">
          <h2 className="text-2xl font-bold mb-3">Bug bounty</h2>
          <div className="rounded-xl border border-white/10 p-6">
            <p className="text-sm mb-3">
              Finding a security issue? Send an encrypted email to{' '}
              <a
                href="mailto:ghostkey316@proton.me"
                className="text-[var(--color-ember-accent)] hover:underline"
              >
                ghostkey316@proton.me
              </a>
              . Please do not open a public GitHub issue for security matters.
            </p>
            <p className="text-sm text-[var(--color-ember-text-muted)]">
              Rewards are paid in ETH on Base, sized to severity and impact. We
              will publish a hall-of-fame list once the first payouts are made.
            </p>
          </div>
        </section>

        {/* ── Verify for yourself ────────────────────────────────────── */}
        <section className="mt-10">
          <h2 className="text-2xl font-bold mb-3">Verify this page</h2>
          <div className="flex flex-wrap gap-3 text-sm">
            <a
              href="/contracts"
              className="rounded-lg border border-white/20 px-4 py-2 hover:border-white/40"
            >
              All 134 contracts
            </a>
            <a
              href="/architecture"
              className="rounded-lg border border-white/20 px-4 py-2 hover:border-white/40"
            >
              Architecture
            </a>
            <a
              href="https://github.com/ghostkey316/theloopbreaker-site"
              target="_blank"
              rel="noreferrer"
              className="rounded-lg border border-white/20 px-4 py-2 hover:border-white/40"
            >
              GitHub source
            </a>
            <a
              href="https://github.com/ghostkey316/theloopbreaker-site/blob/main/SECURITY.md"
              target="_blank"
              rel="noreferrer"
              className="rounded-lg border border-white/20 px-4 py-2 hover:border-white/40"
            >
              SECURITY.md
            </a>
          </div>
        </section>
      </div>
    </main>
  );
}
