# V3 release-gate automation

`ci/release-gates.sh` is the single GitLab CI entrypoint for reproducibility
and compatibility automation. It is offline except for tool installation in
the CI image and never deploys, broadcasts, or writes production
configuration.

## Gates

- `check_v2_abi_package.py` verifies the frozen canonical V2 ABI package.
- `check_v2_bytecode_manifest.py` compares 134 frozen V2 runtime-bytecode
  observations against a checked-in SHA-256 manifest. It does **not** compile
  V2 source or make RPC calls.
- `check_generated_registries.py` regenerates deployments and x402 artifacts
  with `SOURCE_DATE_EPOCH=0`, validates the Bazaar registry, and fails if
  tracked generated output changes.
- `check_v3_reproducible_build.py` builds V3 twice in clean temporary output
  paths and compares SHA-256 creation/runtime bytecode manifests.
- `check_v3_runtime_sizes.py` builds with exact Solidity 0.8.24 settings and
  rejects every deployable runtime above 22,528 bytes, preserving at least a
  2,048-byte margin below EIP-170.
- `check_base_v3_source_snapshot.py` verifies SHA-256 hashes for the exact
  remediated Base Solidity, tests, CI policy, and canonical manifest inputs.
- `run_slither_gate.py` parses Slither JSON and fails on every non-baselined
  finding; the command forces `--fail-none` so the Python result handler, not
  shell exit-code suppression, decides the gate. The exclusions in
  `slither.config.json` are the reviewed legacy detector classes from
  `baseline/slither-v3-final.txt`; changing them needs review.
- `check_loop_bounds.py` inventories every Solidity loop. It currently blocks
  release on two uncontrolled loops rather than treating their presence as a
  pass.

The V2 ABI gate fails closed on any coverage or provenance gap. The frozen
package currently covers all 36 deployed V2 contract names, including the
truth-labeled `VaultfireTrustAttestation` deployment alias for
`TrustPortabilityExtension`; see `baseline/V2_ABI_PROVENANCE.md`.

## Fork jobs

Ordinary pipelines do not run fork tests. Set `RUN_FORK_TESTS=1` to expose the
manual `fork-release-gates` job, with a protected `BASE_RPC_URL` variable.
The job fails closed if the credential or fork test suite is missing. This is
an explicit skip policy, not a successful fork-test result.

## Proxy storage layouts

No V3 contract imports or uses a proxy or upgradeability implementation
pattern, so this patch intentionally provides **no proxy storage-layout
compatibility gate**. Adding a proxy, `delegatecall`, or EIP-1967/UUPS pattern
requires a dedicated storage-layout manifest and gate before release.

## Isolated Base read-only bootstrap tooling gate

`ci/base-read-only-bootstrap-release-gate.sh` is a separate fail-closed gate
for integrating the **read-only bootstrap tooling** only. It is not a global
release approval, deployment approval, activation approval, or substitute for
`ci/release-gates.sh`.

The gate pins the bootstrap source/import closure, generator contract and
runtime/init-code evidence paths, empty-role and `pilotReady=false` profile
state, and the two declared Base V2 integration records:
`ERC8004IdentityRegistry` and `MissionEnforcement`. For each it requires the
Base address, frozen runtime bytecode hash/length, canonical ABI provenance,
and reviewed method evidence. It fails on a closure expansion, manifest drift,
missing evidence, a readiness claim, an unreviewed website bootstrap
publication surface, or any `VaultfireTrustAttestation` reference in the
bootstrap closure/scope.

It also asserts that the full release entrypoint continues to call
`baseline/check_v2_abi_package.py --strict`, and that this strict command passes
independently. The isolated tooling gate **does not** weaken, bypass, modify,
or substitute for the full release gate.
