# Base V3 security dispositions — 2026-08-25

This file records source-support decisions only. Nothing here claims a
deployment, authorization, wallet action, RPC verification, or operational
readiness.

## Retired from the supported Base closure

- `TaskEscrowV3`: retired because its generic dispute commitment and
  owner-selected payout split can encode prohibited off-chain judgment. Its
  fee and treasury are nevertheless snapshotted for any archival use.
- `DisputeRegistryV3`: retired because opaque evidence plus boolean threshold
  voting is not an objective source-verification rule.
- `MutualAidPoolV3`: retired because owner-selected recipient, amount, and
  reason are discretionary routing.
- `ERC8004ValidationRegistryV3Safe`: retired because stake custody and slashing
  are economic decisions and cannot be labeled informational-only.
- `ObjectiveRuleSchemaV3`: removed from support because it implements no
  allowed objective rule.

These contracts may remain in source for historical compatibility tests, but
the canonical support manifest and V2 disposition closure prohibit their
deployment or authorization as supported Base V3 modules.

## Retained with enforced constraints

- Accountability enforcement reads the exact
  `IAccountabilityCanonicalSourceV3` interface on-chain, pins the source runtime
  code hash in mutually signed terms, rejects all threshold-signer evidence,
  and computes the fixed slash from the canonical timestamp.
- Accountability deployment uses a thin generic CREATE deployer with one-time
  committed initcode and runtime hashes. The coordinator verifies the child
  runtime and registers it with the Base controller.
- Governance is default-deny by exact target and selector, enforces a maximum
  native value, commits every policy update, binds each proposal to that
  commitment, enforces a timelock, and expires proposals after 30 days.
- Mandates require non-empty target and selector scopes, sorted unique entries,
  and nonzero finite spend and hourly-use caps.
- The ERC-8004 identity adapter pins an immutable registry address and runtime
  code hash, probes its read interface at construction, and fails closed on
  later code-hash drift.
- Evidence attestations reject zero authority, unknown independence classes,
  and future observations/timestamps.
- StreetCred remains informational-only and source-isolated; inputs are
  validated, exact-time expiry is excluded, scoring is order-independent, and
  the evidence root is deterministically derived on-chain.

Operational runbooks may consume these source decisions, but are maintained in
`v3-operations` and were intentionally not modified by this remediation.

## Post-audit cross-surface closure

- Governance exposes the stable canonical selector-policy content digest
  canonical JSON SHA-256
  `0xc94784bc91de3b01c7ea27f945fbd27a3fb9a25f345bf681fc91fe119aee8eaf`.
  It does not use the self-referential candidate digest. Every canonical rule
  is checked at proposal and execution for exact or bounded calldata length,
  canonical ABI words, no trailing bytes, zero value, target module identity,
  and selector-specific argument/state predicates.
- `SafeBondFactoryV3` constructor-pins the accountability child initcode hash.
  The specialized factory independently stores that immutable hash and checks
  it before CREATE; the coordinator checks factory hash, initcode hash, child
  runtime hash, and critical post-construction state.
- The only accepted accountability source runtime is the concrete,
  non-upgradeable `AccountabilityCanonicalSourceV3`. Its append-only timestamp
  can be written only by the account encoded in the obligation identifier.
  Schema-compatible arbitrary sources and proxy/dispatcher runtimes have a
  different codehash and fail closed.
- Generic dispute bindings are deprecated to `address(0)` in both bonds, both
  specialized factories, and the coordinator. Base pilot and read-only
  bootstrap manifests no longer enable or deploy `DisputeRegistryV3`.
- The Base controller authorizes only modules exposing the exact supported
  factory marker and binding back to that controller. Retired dispute, task,
  mutual-aid, validation, and informational reputation modules fail this gate.
- Mandate authorization uses one immutable codehash-pinned identity adapter.
  Allowed action entries bind the semantic action, target, selector, finite
  spend cap, and exact calldata hash, eliminating Cartesian authorization and
  operator-selected trailing/argument bytes.
- The mission graph includes biometric, profiling, surveillance, quality, and
  loyalty, plus concrete canonical-source, governance-calldata, mandate
  identity/tuple, initcode, Base-pilot, and retired-module surfaces. The ledger
  gate independently checks the policy digest and pilot-supported subset.
- `ci/manifests/base-v3-remediation-source.sha256` freezes the exact Base
  source/test/policy snapshot without requiring a commit, which remained
  prohibited for this task.
