# Base V3 Role Collection and Verification Checklist

**Current status: blocked and unfinalized.** No production role address is
approved. `base_v3_deployment_manifest.json` remains `review-only`, its
production addresses remain `null`, and `mainnetDeploymentApproved` remains
`false`.

Use `base_v3_role_collection_template.json` to collect decisions. Do not edit
the production deployment manifest from incomplete notes or verbal
assumptions.

## Collection rules

- [ ] Collect exactly five distinct Base governance signer addresses.
- [ ] Collect one guardian address that is not any governance signer.
- [ ] Collect a treasury address controlled independently from the deployer.
- [ ] Collect at least one threshold attester address.
- [ ] Collect at least one dispute adjudicator address.
- [ ] Collect each design-partner address only after written partner consent.
- [ ] Collect only the actual pilot-module addresses that governance intends to
      allow.
- [ ] Record the controller and recovery contact for every address without
      recording seed phrases, private keys, API tokens, or signing secrets.

Zero addresses, sequential examples, generated placeholders, ENS-style names
without resolved-address evidence, and addresses copied from test fixtures are
not valid production inputs.

## Independence checks

- [ ] Confirm all five signers are distinct.
- [ ] Confirm the guardian is not a signer.
- [ ] Confirm the treasury is not automatically reused as the deployer or x402
      payee.
- [ ] Confirm threshold attesters cannot self-approve the bond party whose
      outcome they attest.
- [ ] Confirm dispute adjudicators are independent from the challenger,
      respondent, attesters, and design partner for the applicable dispute.
- [ ] Document any intentional role overlap and obtain independent review
      before accepting it.
- [ ] Confirm an optional Safe, if used, is only one of the five governance
      signers and is never represented as the owner of governed modules.

## Address verification

For every collected address:

- [ ] Validate EIP-55 checksum formatting and Base chain intent.
- [ ] Confirm whether the address is an EOA or contract and whether that type is
      allowed for the role.
- [ ] If it is a contract, verify deployed bytecode, source, owner, threshold,
      signers, modules, guards, and upgradeability.
- [ ] Have the controller sign a role-specific challenge message.
- [ ] Verify the signature independently and record its hash and timestamp.
- [ ] Confirm the controller can perform the expected operational action
      without sharing a key.
- [ ] Record a recovery and rotation procedure.
- [ ] Screen the address against the compromised-address and selector checks
      before any deployment package is generated.

## Governance acceptance

- [ ] All five signers accept the 3-of-5 threshold.
- [ ] All five signers accept the immutable 24-hour timelock floor.
- [ ] The guardian accepts pause-only authority and the 24-hour rotation delay.
- [ ] The signer set rehearses propose, confirm, wait, and execute on a local or
      forked environment.
- [ ] The signer set rehearses pause, failed early execution, signer rotation,
      guardian rotation, and rollback procedures.
- [ ] No direct EOA or Safe call to a governance-owned factory or module is
      included in the deployment or activation package.

## Audit boundary

The existing V2 audit does not cover the additive V3 contracts or this exact
hardened commit. Before production deployment:

- [ ] Freeze the exact V3 commit and reproducible artifact manifest.
- [ ] Obtain an independent V3 audit covering all production contracts,
      constructors, deployment ordering, governance transport, caps, x402
      integration, and V2 coexistence.
- [ ] Record the audit report SHA-256 and auditor identity.
- [ ] Resolve every Critical and High finding.
- [ ] Record the disposition and regression evidence for every other finding.
- [ ] Rerun the complete release suite on the final remediated commit.

## Public-write launch gate

The requested launch mode is public writes, but public writes remain disabled
until every prerequisite below is evidenced:

- [ ] All role and independence checks above pass.
- [ ] The independent V3 audit and remediation gate passes.
- [ ] The exact unsigned deployment package receives explicit owner review.
- [ ] A current Base-mainnet fork rehearsal passes with the finalized roles and
      constructor arguments.
- [ ] Deployment transactions are separately approved and broadcast.
- [ ] Every deployed address and runtime bytecode is independently verified.
- [ ] Monitoring, alerts, incident response, pause, rollback, and two-person
      on-call coverage are live and rehearsed.
- [ ] The x402 payee and routing configuration are verified against the
      approved treasury and deployed V3 addresses.
- [ ] A controlled, capped write-path canary succeeds.
- [ ] The 24-hour governance process approves public-write activation.
- [ ] Website and discovery metadata are updated only after address and
      activation evidence is recorded.

Until all boxes are complete, do not deploy, broadcast, enable V3 writes, mark
`pilotReady` true, or describe V3 as mainnet-ready.
