# Vaultfire V3 migration completeness package

This directory is an isolated, read-only umbrella inventory and release gate.
It does not modify V2, deploy, commit, push, sign, use wallets/RPC, or broadcast.

## Canonical inputs

The generator imports repository authorities rather than hard-coding invented
asset lists:

- `baseline/deployments.json`: 134 deployed entries / 36 identities.
- `ci/manifests/v2-bytecode-manifest.json`: 134 frozen runtime identities.
- `legacy/v2/manifest.json`: 36 frozen ABIs.
- `baseline/extracted/v2_api_routes.txt`: 132 V2 source routes.
- `pr7/generated/route-registry.json` and alignment data: route metadata.
- Frozen public discovery evidence plus the settled
  `recovered-97-public-x402-identities.json` authority: 97 unique method/path
  identities (86 core x402, two well-known, eight Solana source-only lanes,
  and one cross-chain handler).
- The 117-file Base-only source/build/test snapshot, Base pilot manifest, final SDK supported
  closure and four reviewed ABI artifacts (36/55/45/24), x402 129-test
  evidence, Solana 68-test source-policy closure, and the current fail-closed operations
  finalized SDK/x402/open-spec authorities; operations are downstream and excluded.
- The final open-spec mapping/interface/report closure: 64/64 normal and
  optimized tests, with 28/29 conformance checks passing and only
  `EXACT_COMMIT` blocked.
- `current-authority-facts.json`, which distinguishes repository-verified facts
  from handoff-reported audit facts. The reported fourteenth partner audit has
  no repository artifact in the current worktree and is therefore not promoted
  to repository or external audit evidence.
- Repository source entry points and relevant source-file surfaces.

The recovered x402 inventory closes method/path identity enumeration, but its
qualification is preserved: identity recovery is not evidence of public
deployment, payment behavior, settlement, or authorization.

## Commands

```sh
python v3-migration/completeness/generate_ledger.py
v3-migration/completeness/ci.sh
python v3-migration/completeness/build_checksums.py
python v3-migration/completeness/publication_gate.py --stage pre-push
python v3-migration/completeness/publication_gate.py --stage final
```

`ci.sh` fails on omitted or extra inventory IDs, duplicate IDs, unsupported
dispositions, missing required fields/tests, unsupported completion claims,
missing or drifting evidence, count drift, canonical-source drift, and
prohibited signal/control coupling.

## Disposition semantics

- `ported`: V3 target exists and has evidence.
- `redesigned`: the V2 implementation obligation is satisfied by an explicitly
  different V3 safety model and exact source-module closure.
- `retired`: the capability is explicitly unsupported in V3 because retaining
  it would violate the mission boundary or release scope.
- `deferred`: the capability has no V3 support claim in this release.
- `compatibility-wrapper`: V2 behavior is intentionally preserved behind an
  evidenced V3 wrapper.
- `intentionally-retired`: an authorized retirement decision and migration
  communication exist.
- `blocked`: no activation is permitted until the item gate is satisfied.
- `not-applicable`: immutable V2 reference evidence; it is not a V3 port claim.

Newly discovered inventory work remains unresolved/`blocked`, but the 36
canonical V2 contract identities do **not** default to blocked. Their
implementation obligation, V3 support status, evidence status, deployment
status, rationale, and exact target modules come from
`v2-contract-dispositions.json`. This makes the ledger a tracker of recorded
decisions rather than a blanket placeholder.

Source support is never a deployment claim. Every supported module and all 36
identity rows currently say `not-deployed-not-authorized`.

`retirement-enforced` is stronger than source existence or a prose decision.
It means the canonical retirement decision, Base pilot disabled/deployment
sets, SDK supported closure, and checker agree that the retired capability
cannot be active. Task escrow, generic disputes, discretionary mutual aid, and
the stake/slashing validation registry use this status.

## Safety manifests

- `v2-contract-dispositions.json`: one canonical record for each of the 36
  immutable V2 ABI identities.
- `supported-v3-modules.json`: exact supported source-module closure. Belief,
  flourishing, reputation, trust-score, and behavioral-routing capabilities
  have no direct protected-decision permission.
- `mission-boundary-graph.json`: influence graph used for transitive checks.
  It covers contracts, SDKs, API metadata, wrappers, cross-chain messages, and
  governance automation, with sinks for custody, access, eligibility, pricing,
  slashing, settlement, disputes, and routing.
- Matching `*.schema.json` files define the machine-readable contract.
- `BASE_V3_SECURITY_DISPOSITIONS_20260825.md` records why TaskEscrowV3,
  DisputeRegistryV3, MutualAidPoolV3, ERC8004ValidationRegistryV3Safe, and the
  empty objective-rule schema are outside the supported Base closure.

The checker follows every `carriesDecisionInfluence: true` edge. Any path from
an unsafe capability node to a protected-decision sink fails, even if it passes
through several nominally safe surfaces. A `false` edge is an explicit
display/telemetry-only boundary, not an implicit allow.

The checker also requires the four retired runtime modules to be absent from
the supported module manifest and SDK, explicitly disabled in the Base pilot,
and absent from pilot deployment records.

## Publication stages

1. **Pre-push:** exact candidate is on `main`, clean, checksummed, fully reviewed,
   and independently validated in a fresh local clone/worktree with no local
   untracked dependencies.
2. **Post-push:** a fresh clone of GitLawb `main` proves the published
   commit/tree and repeats the complete matrix.
3. **Final:** both stages pass. Until then, publication is not represented as
   complete.

The publication input file is intentionally fail-closed. Release authorities
must replace `null`, `not-run`, `fail`, and unresolved release-blocking entries
with exact evidence. The gate never performs the push.
