# Base V3 Read-Only Bootstrap Profile

## Purpose and boundary

This profile describes a **read-only Base bootstrap candidate** for the V3
contract source cryptographically identified by the finalized deployment
manifest and reviewer bundle. It is not a partner pilot, a production release,
an x402 release, deployment
authorization, or permission to accept value. It makes no network call and
does not generate keys or wallets.

The only bootstrap deployments are:

1. `MultisigGovernanceV3`, 3-of-5 with a 24-hour immutable timelock floor
2. `BasePilotAccessControllerV3`, initially closed
3. `ThresholdConsensusV3` at threshold 3, with **zero** authorized attesters
4. `SafeBondFactoryV3`, with `deployAllowed=false`

No child bonds, task escrow, validation registry, vault, mutual-aid pool,
x402 route, Bazaar listing, payee, or public operational module is deployed or
configured by this bootstrap package. This is intentional: those components
can create public write or value-entry surfaces and remain outside the
read-only bootstrap.

## Required real inputs before package generation

`base_v3_read_only_bootstrap_profile.json` is a deliberately incomplete typed
template. A copy can become `deployable-read-only` only after an authorized
reviewer enters all of the following real public addresses:

- exactly five **distinct** governance signer addresses;
- one guardian address, distinct from every signer;
- one treasury address, distinct from the guardian and every signer; and
- exactly one truthful custody disclosure per signer.

The validator allows a signer disclosure of
`founder-controlled-non-independent` only when it explicitly says
`nonIndependent=true` and `rotationRequired=true`. Founder-controlled signer
wallets are therefore not represented as independent partners. They must be
rotated through the 3-of-5 timelocked signer-change process as qualified
partners join. The profile does not generate, infer, or invent any role,
wallet, key, attester, adjudicator, design partner, module, payee, or approval.

Run the template validation:

```bash
python3 pr8/pilot/bootstrap_profile.py
```

Run deployable validation only against a completed, access-controlled copy:

```bash
python3 pr8/pilot/bootstrap_profile.py --profile /secure/base-bootstrap.json --deployable
```

## Unsigned non-broadcast package and code evidence

After a local reproducible Foundry build, run `forge build --build-info` so the
artifacts retain immutable declaration metadata, then generate the package with
the existing public deployer address and its observed starting nonce:

```bash
cd v3-src && forge build --force --build-info
cd ..
python3 pr8/pilot/generate_bootstrap_package.py \
  --profile /secure/base-bootstrap.json \
  --artifacts-dir v3-src/out \
  --deployer 0xYOUR_EXISTING_PUBLIC_DEPLOYER \
  --starting-nonce YOUR_OBSERVED_NONCE \
  --out /secure/base-bootstrap-unsigned.json
```

The generator is offline. It produces no signature and no broadcast. Every
transaction has `valueWei: "0"` and includes its deterministic CREATE address,
init-code Keccak-256, and expected runtime-code Keccak-256. Runtime evidence
is derived by binding and patching every Solidity immutable reference to the
reviewed constructor value; the generator refuses an artifact whose constructor
ABI or immutable declarations drift from that binding. The read-only bootstrap
also derives the future specialized-factory and child immutable-patched runtime
hashes and passes them to the fresh coordinator constructor. It does not deploy
or configure either specialized bond factory; both
`SafeBondFactoryV3` factory getters must remain the zero address. It fails closed if
the profile has any operational role, allowlist entry, enabled flag, payment
route, value flow, missing signer, duplicated signer, unresolved custody
disclosure, wrong chain, unapproved status, or missing/multiple required
Foundry artifact.

`EIP712BaseV3` now calculates the same EIP-712 domain separator from the
current chain ID and `address(this)` at use time. It does not cache that
address-containing separator as an immutable, so a reviewed child runtime hash
is valid for every fresh child deployed with the same fixed constructor
bindings. `DOMAIN_SEPARATOR()` retains its ABI and semantic output. The
coordinator ABI adds four expected-runtime-hash constructor arguments and
`configureFactories(address,address)`; its factory references use fresh
deployment storage slots for the one-time verified binding. This package is
not a proxy upgrade or storage-migration procedure, and V2 is unchanged.

The predicted addresses are conditional on the stated deployer and contiguous
starting nonce. Re-observe the nonce immediately before any separate,
human-approved signing workflow; if it differs, discard and regenerate the
package. This repository never signs or broadcasts it.

## Post-deployment read-only verification checklist

Perform these **read-only** checks against Base chain ID 8453, record the RPC
endpoint/block number and raw output, then compare each deployed runtime hash
to the package evidence:

- [ ] The transaction sender, nonces, `to=null`, calldata hash, and `value=0`
  exactly match the unsigned package after independent re-encoding.
- [ ] Runtime code exists at exactly the 4 predicted top-level addresses and each
  `keccak256(code)` equals the recorded `expectedRuntimeCodeKeccak256`.
- [ ] `SafeBondFactoryV3.partnershipFactory()` and
  `SafeBondFactoryV3.accountabilityFactory()` both return the zero address.
  No specialized factory or child bond is part of this read-only bootstrap.
- [ ] `MultisigGovernanceV3.threshold() == 3`, `signers.length == 5`,
  `timelockSeconds() == 86400`, `minimumTimelockSeconds() == 86400`, and
  `guardian()` is the separately disclosed guardian.
- [ ] `BasePilotAccessControllerV3.governance()` equals governance;
  `deployEnabled()==false`, `writeEnabled()==false`, `globalCap()==0`,
  `perPositionCap()==0`, and `totalAllocated()==0`. Verify the immutable
  `maxGlobalCap()==400000000000000000` and
  `maxPerPositionCap()==200000000000000000`, which bound every later
  `setCaps` call.
- [ ] Probe only disclosed/known addresses: every `isDesignPartner(address)`
  and `isModule(address)` is false. There are no registered positions.
- [ ] `ThresholdConsensusV3.owner()` equals governance,
  `threshold()==3`, and `attesterCount()==0`. No `setAttester` call appears in
  the bootstrap transactions or event history.
- [ ] `SafeBondFactoryV3.owner()` equals governance,
  `deployAllowed()==false`, and its controller/consensus/dispute bindings
  equal the predicted bootstrap addresses. Record the four immutable expected
  runtime hashes and retain them for the later factory-binding review; a
  different hash requires a fresh deployment package, not a proxy upgrade.
- [ ] The only bootstrap transactions are the 4 top-level deployments. There are no
  post-deployment calls, fund transfers, x402 routes, Bazaar listings, payees,
  child-bond deployments, or controller configuration events.
- [ ] The profile, package, and live state all retain `pilotReady=false`.
  A successful code deployment is **not** pilot readiness.

Do not treat code verification as deployment authorization, operating approval,
or evidence that a pilot can start.

`MultisigGovernanceV3` rejects ordinary empty-calldata native transfers. That
does not make it a value custodian or make its balance a readiness signal:
Ether can still be forced into any EVM account. Any unexpected balance requires
separate incident handling and can only be moved through a confirmed,
timelocked governance proposal; it does not enable a controller position,
factory deployment, payment route, or pilot operation.
