# Governance Proposal Generator — Implementation Notes

Completed offline migration artifacts:

- `safe_payload_generator.py` — Base-only `MultisigGovernanceV3` proposal
  package generator.
- `base-pilot-batch.example.json` — deterministic dummy-address proposal
  package.
- `dry-run-dummy-output.json` — captured `--dry-run` output for the same
  inputs.
- `test_safe_payload_generator.py` — standard-library `unittest` coverage.

Each package item is a two-level payload:

| Level | Recipient | Call |
|---|---|---|
| Outer transaction | `MultisigGovernanceV3` | `propose(target, 0, calldata)` |
| Governed call | controller then `SafeBondFactoryV3` | ordered `setModule`, `setDesignPartner`, manifest-exact `setCaps`, `setDeployEnabled`, then factory configuration, factory enablement, and two child deploys |

`SafeBondFactoryV3` is never a direct transaction recipient. Three distinct
current signers must call `confirm(proposalId)`, then a current signer may call
`execute(proposalId)` only at/after the event's `eta`, subject to the 86,400
second floor. A Safe, if listed, is an optional governance signer only—not the
factory or module owner.

The dummy inner calldata selectors are:

| Call | Calldata prefix |
|---|---|
| `configureFactories(address,address)` | Derived and independently tested |
| `setDeployAllowed(true)` | `0x3a281eb8` |
| `deployPartnership(address,address)` | Derived and independently tested |
| `deployAccountability(address)` | Derived and independently tested |

Validation fails closed for non-Base chains, zero/malformed addresses,
incorrect mixed-case checksums, an optional Safe equal to the governance
contract, any non-finalization manifest, cap mismatch/above-ceiling declaration,
and new specialized `*FactoryV3.sol` sources
without explicit manifest support. The generator produces no network requests,
signatures, transactions, or broadcasts.

Validation run on dummy values:

```text
python3 -m unittest pr8/migration/test_safe_payload_generator.py -v
3 focused construction/cap-source tests passed
```

No checked-in address is a production address or authorization.
