# Project artwork and identity / v0.44.0

## Shipped in this release

Custom Studio worlds require a project logo and plaza cover before Go live. Private drafts and unlisted tests can be incomplete. Existing live listings remain available; their next live publication must satisfy the requirement. Curated official partner cards retain their separately managed artwork.

Studio accepts PNG/JPEG/WebP up to 10 MB, normalizes a contained 256×256 logo and cropped 768×432 cover, and provides Capture current plaza view. The editor previews the directory card. Logo/cover limits are 30,000/60,000 data-URL characters; scene size limits still apply. Draft artwork survives saves, import/export and replacing a layout. Images are public marketing material even for gated worlds.

Published metadata stores a bounded listing map separately from scene delivery. Firestore rules require both raster fields for live writes, reject remote/SVG URLs and untrusted verification fields, and retain owner authentication. The directory additionally validates WebP structure/dimensions, excludes malformed artwork and never returns private scenes, emails or whitelist contents. Legacy cards without artwork use the existing emblem. All custom directory cards explicitly say Project not verified. An uploaded logo or pasted X handle grants no identity badge.

QA: actual browser upload normalization and screenshot capture, missing-artwork publication denial, directory card rendering, model/store lifecycle tests, 37 Studio ownership/publication rules cases, and 37 gated scene/policy read rules. Browser identity/cloud writes are controlled doubles; no production user projects were created or modified for testing.

## Recommended next phase — not implemented or enabled

No system can guarantee that every project is authentic. Use independent evidence and a reversible review process, not a single blue check.

### Three explicit identity states

- **Community-created / project not verified:** Google identifies the creator account; a name, token ticker, logo and pasted social links are self-declared.
- **X account linked:** GrowBlocks has checked control of the specific X account. Display the exact handle and proof date. This is not an official-project badge.
- **Project verified:** a GrowBlocks reviewer has matched the account to the project's established official website and, if applicable, its chain-specific token/NFT contract. Show the evidence and review date. Identity review does not certify investment safety, token code, returns or endorsements.

### X connection architecture

Use X OAuth 2.0 authorization code with PKCE S256. A short-lived, one-use state binds the request to the signed-in Google owner, project ID and current ownership revision. Exchange codes on the backend using an exact registered callback; never accept client-submitted X IDs as proof. Fetch the authenticated account and store its stable numeric ID, current handle, verified-at timestamp and evidence status. Do not key identity by display name or handle alone.

Request only the read scopes required for identity lookup; no posting, follows, DMs or wallet permissions. Avoid offline access unless ongoing refresh is deliberately required. Keep client secrets server-only and never expose access tokens in scene JSON, public metadata or browser storage. Set expiry and revalidation policy before release. Maintain a uniqueness claim for the official project ↔ X ID association, while allowing multiple plazas under that one project.

Configuration needed before activation: an X developer application, OAuth client credentials securely added to Vercel, the exact callback URL registered in X, and confirmation of access/pricing for the required identity endpoint. Do not ask owners to paste credentials into chat.

Official references:
- https://docs.x.com/fundamentals/authentication/oauth-2-0/authorization-code
- https://www.rfc-editor.org/rfc/rfc9700.html

### Establish that the account is the real project

Check a backlink from the established official domain to the GrowBlocks project page (or a DNS verification challenge), and cross-check the domain/account against the project's known public channels. New domains and lookalike X accounts require manual review; proving control of a newly created lookalike domain alone is insufficient.

Bind assets by `(chain ID, contract address)`, never ticker/name/logo. Review the official site's published contract details. Where appropriate, require a narrowly scoped, expiring message from the documented project treasury/multisig; a holder wallet or deployer alone is not automatically the project's authority. No approvals or transfer signatures for identity checks. Keep Robinhood testnet and future mainnet attestations separate.

### Registry and moderation

Use a server-only project registry containing owner UID/version, X numeric ID, domain, chain/contract bindings, evidence, reviewer, reviewedAt/expiresAt and status. Separate public evidence from private owner data. Client rules deny all verification writes. Build authenticated moderator approve/reject/revoke actions with audit records. Server-generated public metadata controls every badge in Studio, directory, plaza entrance and trading interfaces.

Reserve curated partner identifiers and official slugs. Flag confusable names, copied logos and duplicate contract/social claims for review; similarity is a signal, not proof. Add Report impersonation with evidence submission, rate limits and a moderator queue. Confirmed impersonation should remove the listing and official actions, with a documented appeal path.

Ownership transfers, changed official account/domain/contracts, expired evidence and compromise reports suspend official status pending revalidation. Old owners must lose edit and verification privileges. Never let a client restore a revoked badge.

Recommended policy: allow unfinished/private testing; distinguish unverified community worlds clearly; require review before official-project promotion and before any future launch/trading entitlement tied to project identity. This release does not silently introduce an approval queue, enable X OAuth, grant any project a badge or activate trading.