Roadmap | Coinbase — BizFirstAI

Both variants are fully implemented today — this isn't a "not built yet" list like a typical roadmap. It's the set of design-time assumptions that were deliberately documented as unconfirmed against Coinbase's live APIs, so operators know exactly which behaviors to double-check first in their own environment.

Advanced Trade: Open Questions

Area	What's unconfirmed
`converts/createQuote`	Whether Coinbase's Convert Quote endpoint accepts bare currency tickers for `from_account`/`to_account`, or requires resolved account UUIDs. See Converts.
Error taxonomy	Coinbase's numeric/string error-body shape beyond the HTTP status code was not independently re-verified against a live call — the mapper deliberately doesn't try to refine ambiguous 400s further than the broad `COINBASE_ORDER_REJECTED` bucket.

Server Wallet: Open Questions

Area	What's unconfirmed
REST paths	The exact CDP REST paths used by this integration were not independently re-verified line-by-line against `docs.cdp.coinbase.com/api-reference/v2/` in the design pass.
`X-Wallet-Auth` JWT	The wallet-auth JWT claim shape is a best-effort implementation, distinct from the confirmed bearer-JWT signer.
Wallet Secret on 5 operations	`account/requestFaucet`, `solanaAccount/requestFaucet`, `policy/create`, `policy/update`, `policy/delete` are treated as requiring the Wallet Secret under a fail-closed security policy, pending confirmation against live CDP docs.
`swap/execute` idempotency	No confirmed idempotency mechanism exists for this endpoint — a best-effort key is sent, but ambiguous failures are deliberately surfaced as `AMBIGUOUS_OUTCOME_NO_RETRY` rather than silently retried.

How to Help Confirm These

Each item above traces back to the authoritative design spec for this node (00_INDEX.md and INFRASTRUCTURE_CustodialWalletAuthorization.md under the node-engineer documentation tree). If you confirm a behavior against a live CDP/Advanced Trade call, the corresponding error mapper, credential-resolution code, or this guide's callouts should be updated together — the design spec is the source of truth for intent, and code plus docs should track it.