# V2 ABI Baseline Follow-up — VaultfireBatchOnboarder

> Historical note: this report described the package at the earlier
> `08e88bb` state. Its former `VaultfireTrustAttestation` gap is resolved by
> the truth-labeled, runtime-bound source plan documented in
> `baseline/V2_ABI_PROVENANCE.md`; the validation transcript below must not be
> read as the current strict-gate result.

## Scope

This follow-up starts from `08e88bb` and adds exactly one ABI:
`VaultfireBatchOnboarder` at Base chain ID `8453`, address
`0x82c6a0dd34F5cF57F8B98Ee118e911B977618890`. No V2 source was changed.

## Authoritative evidence

- Endpoint: https://base.blockscout.com/api?module=contract&action=getsourcecode&address=0x82c6a0dd34F5cF57F8B98Ee118e911B977618890
- Collection: `pplx_sdk.content.fetch`, `cache_enabled=False`, `return_html=True`.
- Retrieval timestamp: `2026-08-21T03:50:38.618834Z`.
- Frozen raw Blockscout response:
  `baseline/verified-source/blockscout/base/0x82c6a0dd34f5cf57f8b98ee118e911b977618890/getsourcecode.json`
  - SHA-256: `e7d65970facdce536ec7afcde036a03b129369c96edebd7f604f0be769057953`
- Frozen SDK response envelope:
  `baseline/verified-source/blockscout/base/0x82c6a0dd34f5cf57f8b98ee118e911b977618890/pplx_content_fetch_response.json`
  - SHA-256: `3a4d6b6e77fd5b126a111bd5e5ad017e54a057d02713270e17e401fd9990b16e`
- Frozen retrieval metadata:
  `baseline/verified-source/blockscout/base/0x82c6a0dd34f5cf57f8b98ee118e911b977618890/provenance.json`
  - SHA-256: `4dce6aa02e7e2ee9158a9ea60c9e8a60a961bc2168ffcd43a86528c5a9020163`

The response is a successful singleton with contract name
`VaultfireBatchOnboarder` and compiler `v0.8.24+commit.e11b9ed9`. The frozen
ABI field hash is `d714f12b68d9c5c39c6e34f761d6aed59581c76ee428bdf568cb787ad1d7c3d1`.
The normalized ABI payload is
`legacy/v2/abis/VaultfireBatchOnboarder.json`, with SHA-256
`44c453e5033ccc89a8a96b0ecb5398ad797722122cf67fe295a8230c82a7d638`.

## Controls added

`baseline/build_v2_abi_package.py` now accepts a frozen verified deployed-source
input only when its raw response, SDK envelope, retrieval metadata, exact
chain/address deployment, contract name, compiler version, source-code hash,
ABI-field hash, and canonical ABI hash all agree. It makes no network calls.

`baseline/check_v2_abi_package.py` rechecks all of those bindings and rejects a
changed evidence file. It also rejects ABI files that are missing from or extra
to the manifest inventory. The tests cover normal coverage, strict release
blocking, ABI drift, pinned snapshot requirements, and verified-source evidence
drift.

## Validation performed

```text
python3 baseline/build_v2_abi_package.py --v2-root /home/user/workspace/vaultfire-v3/v2-repo
# froze 35 traceable V2 ABIs; 1 deployed name remains explicitly blocked

python3 baseline/check_v2_abi_package.py --v2-root /home/user/workspace/vaultfire-v3/v2-repo
# verified 35 frozen, provenance-backed V2 ABIs

python3 baseline/check_v2_abi_package.py --strict --v2-root /home/user/workspace/vaultfire-v3/v2-repo
# expected exit 1: VaultfireTrustAttestation remains blocked

python3 -m unittest -v tests/test_v2_abi_package.py
# 5 tests passed
```

Two rebuilds produced the same aggregate `legacy/v2` package SHA-256:
`603b53bbef52e0e00565cfb0f3b1eac04dd61eb03ba283ef60efa7be84fb9e1e`.

## Exact remaining gap

`VaultfireTrustAttestation` is the sole remaining blocked deployed name. The
pinned V2 checkout has no exact matching Solidity source, canonical ABI JSON, or
compiled artifact; recorded Sourcify attempts are `not_found_in_sourcify`.
Attestation-like files with mismatched contract names or addresses remain
excluded. Strict mode must continue to fail until exact canonical or verified
source evidence is added.
