# Vaultfire V3 governance and operations gates

This directory is the additive, canonical control plane for V3 release status.
It does not alter contracts, deploy, sign, broadcast, use a wallet, or access an
RPC endpoint.

## Authority and fail-closed state

`release-status.json` is the only current authority for these five independent
states, in order:

1. `sourceComplete`
2. `evidenceComplete`
3. `deploymentAuthorized`
4. `deployed`
5. `activated`

A later state cannot be true while an earlier state is false. Deployment
authorization and activation require explicit, evidenced human authorization.
All five states are currently false. Partner acceptance, privacy, counsel, and
independent audit are external blockers; this repository cannot self-satisfy
them.

`readiness-supersession.json` preserves earlier documents as historical or
surface-specific evidence while removing their authority to make a current
release claim. No historical evidence is deleted.

## Controls

- `governance-selector-policy.json` denies unknown calls and native value by
  default, binds allowed calls to supported V3 modules, limits calldata, applies
  a 24-hour minimum timelock, and rejects unsafe decision inputs.
- `policy-commitment.json` and the generated Solidity commitment interface bind
  the exact selector policy, supported-module manifest, disposition manifest,
  schemas, operations candidate, final governance source, governance tests, and
  compiled governance artifact with canonical or raw SHA-256 digests. The
  candidate also binds and independently verifies the immutable 117-file Base
  source snapshot manifest and its checker.
- `governance-enforcement.json` records the source-, test-, ABI-, and
  snapshot-evidenced integration of the exact selector policy. Proposal and
  execution both apply target, selector, zero-value, canonical calldata,
  argument, timelock, policy-snapshot, and lifetime predicates.
- `role-control-policy.json` defines thresholds, separation, rotation,
  revocation, recusal, conflicts, and mandatory incident and reconciliation
  responder coverage. Member lists are intentionally empty rather than
  inventing assignments; this is a release blocker.
- `operations-control.json` defines bounded guardian pause/recovery, incident
  severities and runbooks, monitoring/reconciliation, evidence freshness, and
  isolated deployment/rollback drills.
- `schemas/` provides machine-readable contracts for the selector, role, and
  release-status records.

The source-verified `SafeBondFactoryV3` and `ThresholdConsensusV3` modules are
included in the supported source scope with their exact administrative
selectors. They remain not deployed and not authorized. The final Base
governance exposes canonical selector-policy SHA-256
canonical JSON SHA-256
`c94784bc91de3b01c7ea27f945fbd27a3fb9a25f345bf681fc91fe119aee8eaf`
and uses the same bounded verifier at proposal and execution. The governance
integration and pilot-supported-scope blockers are therefore satisfied, but
all five release stages remain false because other source, evidence,
operations, external, and human-authorization blockers remain open.

## Validation

Run from the repository root:

```text
python v3-operations/check_v3_operations_gates.py
python -m unittest -v v3-operations/tests/test_v3_operations_gates.py
git diff --check
```

The checker validates the 15-module remediated supported set and all 36 disposition records,
recomputes selectors, enforces role separation and status implications, checks
freshness, and verifies the external blockers. A pass means the control package
is internally valid; it does not mean the release is ready or authorized.
