Technology · Work
Open-source contribution. Not a Lilly Protocol customer engagement. No commercial relationship is claimed.
Accepted engineering on a live multi-repo stack.
TheCriners contributed focused, merged pull requests across Lilly Protocol’s public repositories. This is accepted open-source work — tests, validation, hardening, configuration, documentation, and CI — not a claim that we designed or operate Lilly Protocol.
Overview
Lilly Protocol is an independent Stellar / Soroban project for agent wallets and settlement. Maintainers merged TheCriners pull requests in the TypeScript SDK, backend API, agent runtime, Soroban contract repo, and frontend. The product remains theirs. The merged patches are ours.
Where the work sat
Layers below are Lilly’s public stack. Labels mark repositories where TheCriners has merged contributions. We do not claim we operate the protocol or its live network.
- Frontend lily-frontend · viewport defaults, production header hardening
- Agent runtime agentlily-runtime · TaskRunner error and memory-append tests
- Backend API lily-backend · auth, idempotency, capability allowlist, quote math
- TypeScript SDK lily-sdk · payment-input validation, HTTP client, config defaults, docs
- Soroban contracts / CI lily-contracts · regression tests and reproducible Rust/Stellar builds
- Stellar / Soroban their network. Not a TheCriners deployment.
Technologies involved in the merged work: Agent runtime, Backend API, Frontend, Soroban contracts / CI, TypeScript SDK. TypeScript, Node.js, Rust, Cargo, and GitHub CI appear in those repositories. Wallet product surfaces and network rollout remain Lilly’s, not something this case study claims we shipped.
Representative merged contributions
Each row is a public GitHub pull request merged by Lilly Protocol maintainers. Descriptions are the verified contribution text from the internal evidence ledger.
| Layer | Pull request | What landed |
|---|---|---|
| TypeScript SDK | lily-sdk#188 | Added preflight validation for memo length/format, decimal amount precision/sign, and asset-code format, with validation tests. |
| Backend API | lily-backend#337 | Changed idempotency middleware so failed HTTP responses are not cached and replayed, with regression tests. |
| Backend API | lily-backend#381 | Mounted apiKeyAuth on mutating agent and payment routes when configured and expanded API-key tests. |
| Agent runtime | agentlily-runtime#322 | Updated TaskRunner error propagation and memory-append failure handling with corresponding runtime tests. |
| TypeScript SDK | lily-sdk#552 | Added shared default timeout and retry constants, exported them, wired configuration resolution/client use, and added configuration tests. |
| TypeScript SDK | lily-sdk#180 | Added SECURITY.md reporting policy, supported-version and response guidance, README link, and a policy test. |
| Backend API | lily-backend#366 | Corrected quote-fee and destination-amount math in applyStubFee and expanded payment tests. |
| Soroban contracts / CI | lily-contracts#137 | Added rust-toolchain.toml to pin stable tooling and the wasm32v1-none component set. |
| Soroban contracts / CI | lily-contracts#138 | Added --locked to Cargo Makefile/CI commands and documented stale-lockfile behavior. |
| Soroban contracts / CI | lily-contracts#139 | Made strict tooling checks fail when required Rust/Stellar prerequisites are missing while preserving non-strict behavior. |
| TypeScript SDK | lily-sdk#186 | Tested and documented preservation of path-prefixed baseUrl handling. |
| Frontend | lily-frontend#140 | Disabled the production X-Powered-By response header and added a configuration test. |
Full evidence ledger is internal. Unmerged or superseded PRs are not shown.
What this demonstrates
- We can sit in someone else’s stack. SDK, API, runtime, contract tests, frontend, and CI — one organization, five repositories.
- We ship the unglamorous boundary work. Validation, auth, idempotency, fee math, toolchain pins. The kind of change a maintainer can merge.
- Evidence is a merged PR, not a slide. Anyone can open the GitHub links and read the diff.
- We do not over-claim. Lilly Protocol is not a TheCriners product, not a commercial client here, and not a live network we operate.
For shops
The same discipline on a website.
Look at the public facts. Make the next call obvious. Don’t invent the rest.