Frisky Developments // Fenrir Protocol

COMMUNITY
SECURITY.
VERIFIED.

Fenrir Protocol is the verification and security layer for the MyFenrir community — not an aesthetic onboarding flow. 4 gates between the public and the pack. Serious. Precise. Protective.

The four gates Go-live status

Gates to pass

Bot surfaces

Build phases

fenrir-gatekeeper // status

$fenrirstatus --all

──────────────────────────────

community_bot@Fenrir_Community_BOT

✓ LIVEfriskyclaw · systemd

gatekeeper_bot@Myfenrir_bot

⚡ SPEC READYpending build

──────────────────────────────

gates

Aturnstileok

Bsupabase·ssoclient live

Crulesrules.md needed

Dvibe·haikunorms needed

──────────────────────────────

invite

member_limit=1

expire_secs=600

nonce_reuse=NEVER

──────────────────────────────

01 // The Concept

A door. A hearth.
The same wolf.

Most communities bolt a captcha onto the door and call it done. Fenrir Protocol treats the threshold as an actual security operation — and keeps the same wolf as concierge once you're inside.

In Build — Spec v1.0

The Gate

FenrirGatekeeper_bot

A new member lands in a public waiting room, muted. The wolf posts a welcome and opens a Telegram Mini App at gate.myfenrir.com — four gates run in sequence. All four pass → one short-lived invite link. Nonce burned immediately.

CF Worker gate.myfenrir.com Telegram Mini App webhook · no polling

Live in the pack

The Hearth

Fenrir_Community_BOT

Once inside, the wolf is the in-group assistant. Self-hosted on the friskyclaw box with local models. No cloud dependency for replies, no polling conflict, supervised via systemd for stable uptime. Replies stay private infrastructure.

OpenClaw gateway local models friskyclaw · Netcup systemd supervised

02 // The Threshold

Four gates.
All must pass.

Not a flow. Not a wizard. A security state machine. Each gate must pass independently. If any fails — no invite. Nonce single-use. Anti-replay enforced.

Gate A // Bot or Human

Cloudflare Turnstile

Managed-mode widget, verified server-side. Asserts action=gate_verify and hostname=gate.myfenrir.com. Secret key never in the SPA. error-codes → hard reject.

CF Turnstile ✓ Ready to wire

Gate B // Real Identity

Supabase Auth

Same AuthKit client as myfenrir.com. Google / Microsoft / Apple. tg_user_id bound to one verified Supabase identity in the durable audit table. One human, one account.

Supabase · Frisky AUTH ✓ Client live

Gate C // The Pact

Rules acceptance

Community rules displayed in full. Explicit checkbox required — Continue locked until accepted. rules_version tracked — if rules change, the pact is re-confirmed at next join. Logged to Supabase with timestamp.

Supabase audit → rules.md needed

Gate D // Vibe Check

Claude Haiku classifier

Hard gates (18+, intent selector) then free-text "why join?" classified by Claude Haiku against the community norms. pass → proceed. reject → decline. review → mod channel hold, invite only on manual approve.

claude-haiku-4-5 → norms needed

04 // Data Model

Two stores.
Two lifetimes.

Ephemeral sessions burn on use. Durable audit log preserves every consent and verdict. Service-role write only — no anon access.

// Cloudflare KV // GATE_SESSIONS

Session (ephemeral)

nonceuuidKEY KEY

tg_user_idintfrom initData — never client

tg_usernamestring

tg_chat_idintwaiting room group

turnstilebool

supabaseobj|null{email, user_id}

rulesbool

vibestr|nullpass|review|reject

created_atunix

TTL ~900s · single-use · burned after invite issuance

// Supabase FriskyDEV // gate_admissions

Admission (durable)

iduuidPK

tg_user_idbigint

supabase_user_idtext

emailtext

rules_versiontext

rules_accepted_attimestamptz

vibe_verdicttextpass|review|reject

vibe_modeltextclaude-haiku-4-5-20251001

statusenumpending|admitted|rejected|review

RLS: service_role write only · anon = no access

05 // Full Site Audit

myfenrir.com — Full Audit Report

Comprehensive audit conducted 2026-07-16 across SEO, Security, Performance, UX/UI, Accessibility, and Infrastructure.

// 1. Executive Summary

myfenrir.com is a Telegram Mini App titled "Fenrir Bridge by Frisky" — a React SPA built with Vite. It serves as a bridge/connectivity tool within the Telegram ecosystem, authenticated via Telegram Web App SDK and backed by Supabase on Cloudflare infrastructure.

✅

Security

2 minor

⚠️

Performance

3 medium

❌

SEO

8 critical

⚠️

UX/UI

3 medium

⚠️

Accessibility

2 medium

✅

Infrastructure

1 minor

Total Issues: 19 (8 Critical, 5 Medium, 6 Minor/Low)

// 2. Site Overview

Domain myfenrir.com → 301 → www.myfenrir.com

Site Title Fenrir Bridge by Frisky

Type Telegram Mini App (SPA)

Framework React (Vite build)

JS Bundle /assets/index-BaHQU_J-.js (~593 KB)

Infrastructure Cloudflare DNS + CDN, Supabase

SSL TLSv1.3 · AES-256-GCM · Google Trust

Auth Telegram Web App SDK · Supabase Auth

// 3. SEO Audit — CRITICAL (8 issues)

TagStatusValue

<title> ✅Fenrir Bridge by Frisky

og:title / og:description❌No Open Graph tags — no social previews

twitter:card❌No Twitter Card tags

canonical URL❌Missing — duplicate content risk

robots.txt❌Returns HTML shell instead of directives

sitemap.xml❌Returns HTML instead of XML

JSON-LD❌No structured data (WebSite, WebApplication)

⚠ SPA with no SSR/prerendering — Page is empty

until JS executes. Content discovery unreliable.

// 4. Security — GOOD (2 minor issues)

✓

HTTPS Enforced

HTTP→301→HTTPS via Cloudflare

✓

TLS v1.3

AES-256-GCM · strongest available

✓

HSTS Preloaded

Strict-Transport-Security active

✓

CSP Present

Content-Security-Policy strict

✓

X-Frame-Options: DENY

Clickjacking protection

✓

DDoS + WAF

Cloudflare edge protection

⚠

Missing Permissions-Policy header

Cannot restrict access to device APIs (camera, mic, geolocation)

⚠

Missing Referrer-Policy header

Cannot control referrer info leakage to external links

// 5. Performance — FAIR (3 medium issues)

593 KB

JS bundle (uncompressed)

726 B

HTML shell

~600 KB+

Total initial payload

🔴

Monolithic 593 KB JS bundle

No code splitting — entire app downloaded before any content renders

🟡

No loading state in HTML

Blank white screen until JS loads and React hydrates

🟡

No resource hints

No preload, preconnect, or dns-prefetch for critical path

// 6. Recommendations

🔴 Critical — Fix Immediately

1. Add meta description tag

2. Add Open Graph tags (og:title, og:description, og:image, og:url)

3. Add Twitter Card tags

4. Fix robots.txt — serve proper crawling directives

5. Fix sitemap.xml — serve valid XML sitemap

6. Add canonical URLs

7. Implement SSR or prerendering

8. Add structured data (JSON-LD)

🟡 Medium — Fix Soon

9. Code splitting — split 593 KB bundle by route

10. Add loading states (CSS spinner/skeleton in HTML)

11. Add Permissions-Policy header

12. Add Referrer-Policy header

13. Add resource hints (preconnect, preload)

🟢 Low — Nice to Have

14. PWA enhancements — service worker for offline support

15. Add ARIA landmarks — improve screen reader navigation

16. Verify CSP allows Telegram SDK

17. Audit Supabase RLS policies

// 7. Scorecard Summary

Security B+

Performance C

SEO F

UX/UI C

Accessibility D

Infrastructure B+

Overall 5.3/10 — C

Audit generated 2026-07-16 via automated orchestrated workflow using curl, openssl, DNS analysis, and HTTP header inspection.

05 // Security

Seven invariants.
Non-negotiable.

✓

Webhook secret token verifiedEvery /tg POST checks X-Telegram-Bot-Api-Secret-Token header. Unauthenticated → 403 immediately.

✓

initData HMAC + auth_date freshnessHMAC_SHA256(bot_token,"WebAppData"). tg_user_id from initData.user — never client-sent. auth_date must be <10 min old.

✓

Turnstile server-side onlyToken verified via siteverify with secret key (never in SPA). Asserts action + hostname before Gate A passes.

✓

Supabase state cookie host-pinned to gate.myfenrir.comAvoids state_invalid (the same bug that hit fenrir-bridge). All auth stays on one host.

✓

One-time invite · member_limit=1 · short expirycreateChatInviteLink(member_limit=1, expire=now+10m). Nonce invalidated immediately. Never reused.

→

Rate limiting per tg_user_id + IPSpec written, not deployed. CF Worker rate limiting prevents invite farming / brute-force session abuse.

→

Secrets via CF Secrets + 1Password pipelineBOT_TOKEN, TURNSTILE_SECRET, SUPABASE_API_KEY, SUPABASE_SERVICE_KEY, ANTHROPIC_API_KEY — wrangler secret put. No secrets in repo.

06 // Brand

Serious. Precise.
Protective.

Fenrir Protocol's brand is NOT cute. NOT aesthetic onboarding. The Mini App uses the MyFenrir Community Bridge tokens (midnight/violet-cyan) — the product tone is security-first. The parent brand is Frisky Developments.

// Frisky Dev · parent mark

Frisky Dev

PARENT ENTITY · #34d399 → #ffffff on #050508

Lime#34d399

Electric#c084fc

Near-black#050508

// MyFenrir Mini App · gate surface

Midnight#080B16

Violet#8B7CFF

Cyan#4FD7E0

gate.myfenrir.com Mini App inherits
Community Bridge tokens (midnight/aurora).
// Aurora = violet + cyan ONLY. No magenta.

// Pack language

"Entra a la manada."// hero greeting

"The pack is waiting."// success state

"El lobo ha hablado."// reject

07 // Build Phases

Nine phases.
Ship in order.

Phase 01

Scaffold + Webhook Echo

Worker receives /tg, verifies secret token. wrangler.jsonc, KV binding, env vars scaffolded.

✓ Spec ready

Phase 02

Waiting-Room Mechanics

chat_member → restrict (mute) user → post pinned welcome card with web_app button → gate.myfenrir.com.

✓ Spec ready

Phase 03

Mini App Shell

SPA opens, reads initData, POST /api/gate/open → nonce. Gate wizard skeleton, Community Bridge styling.

✓ Spec ready

Phase 04

Gate A · Turnstile

Managed widget, server-side siteverify. Pass → session updated, proceed to B.

→ Build next

Phase 05

Gate B · Supabase Identity

Add redirect URI to Frisky AUTH. Popup AuthKit in Mini App, bind tg_user_id ↔ Supabase identity in audit.

→ Build next

Phase 06

Gate C · Rules + Audit

Rules displayed, checkbox required, POST /api/gate/rules records {rules_version, accepted_at} to Supabase.

Planned

Phase 07

Gate D · Vibe + Claude

Hard gates then free-text. Claude Haiku classifies against norms. review → mod channel hold.

Planned

Phase 08

Invite Issuance

/api/gate/complete: all gates pass → createChatInviteLink(limit=1, expire+10m) → audit admitted → DM link.

Planned

Phase 09

Hardening + Rate Limits

Rate limits per tg_user_id+IP, secrets via 1Password→CF, mod channel, RULES.md final, prod stress test.

Planned

08 // Status

Pack online.
Gate: build ready.

Bot surfaces

Gates

Sec checks

Build phases

🐺

Fenrir Community BOT

@Fenrir_Community_BOT live on friskyclaw. Local models, systemd supervised.

● LIVE · friskyclaw

🔐

Supabase Auth

Frisky AUTH app live — Google/Microsoft/Apple. client_01KSSSJENYSQC0YXDYM8ZACYS9.

● LIVE · myfenrir.com

📋

Gate Spec v1.0

Architecture, data model, security checklist, design spec, all 9 build phases complete.

● SPEC COMPLETE

🤖

@Myfenrir_bot

BotFather: username, /setdomain → gate.myfenrir.com, /newapp short name "verify".

→ NEEDS BOTFATHER

🌐

gate.myfenrir.com DNS

DNS → CF Pages. Needs CF token with Zone:DNS:Edit (on-machine wrangler lacks dns write).

→ NEEDS DNS TOKEN

↗

Supabase Redirect URI

Add gate.myfenrir.com/auth/callback to Frisky AUTH application (dashboard-only, no API).

→ NEEDS DASHBOARD

COMMUNITY SECURITY. VERIFIED.

A door. A hearth.The same wolf.

The Gate

The Hearth

Four gates.All must pass.

Cloudflare Turnstile

Supabase Auth

Rules acceptance

Claude Haiku classifier

Cloudflare edge.No always-on box.

Two stores.Two lifetimes.

myfenrir.com — Full Audit Report

Seven invariants.Non-negotiable.

Serious. Precise.Protective.

Nine phases.Ship in order.

Scaffold + Webhook Echo

Waiting-Room Mechanics

Mini App Shell

Gate A · Turnstile

Gate B · Supabase Identity

Gate C · Rules + Audit

Gate D · Vibe + Claude

Invite Issuance

Hardening + Rate Limits

Pack online.Gate: build ready.

Fenrir Community BOT

Supabase Auth

Gate Spec v1.0

@Myfenrir_bot

gate.myfenrir.com DNS

Supabase Redirect URI

COMMUNITY
SECURITY.
VERIFIED.

A door. A hearth.
The same wolf.

Four gates.
All must pass.

Cloudflare edge.
No always-on box.

Two stores.
Two lifetimes.

Seven invariants.
Non-negotiable.

Serious. Precise.
Protective.

Nine phases.
Ship in order.

Pack online.
Gate: build ready.