# Current-diff Finding Closure Matrix — 2026-08-24

## Scope and identifier rule

This is a source-state crosswalk for the mutable remediation worktree rooted at
`vaultfire-v3-mainnet-release-20260822`. It maps only the four findings in
`/home/user/workspace/audit_final_remediation_20260824.md` (the original finding
record for this matrix). It intentionally does **not** assign a disposition to
unretained historical labels such as `H-01`, `M-01`, or `L-01`: those labels are
not uniquely defined for this worktree and therefore are not audit evidence.

Finalization must bind this document, the exact source commit/tree, and the
captured command outputs. Until then the status is engineering remediation, not
deployment approval.

| Original finding record and source location | Applicability to this bonds-only scope | Current remediation code and configuration | Adversarial regression / deterministic gate | Current disposition |
|---|---|---|---|---|
| **H-NEW-01**, `audit_final_remediation_20260824.md:17-38`: inherited `EIP712BaseV3._VERSION_HASH` omitted from child runtime identities | Direct: both factory-created child types are constructor-pinned by `SafeBondFactoryV3` runtime hashes | `pr8/pilot/generate_bootstrap_package.py`: `EIP712_V3_VERSION_HASH` is derived from `keccak256(b"3.0.0")`; `_immutable_values` binds `_VERSION_HASH` for both children; build-info AST handling combines inherited source-unit declarations. `generate_bonds_only_package.py` consumes the same runtime function. | `BaseReadOnlyBootstrapProfileTests.test_foundry_style_artifacts_bind_every_specialized_and_inherited_immutable` creates clean Foundry-layout artifacts, separated build-info AST source units, all specialized-factory and child immutable references, and asserts the inherited first child word equals the derived version hash. `SafeBondFactoryV3Test` verifies deployed child `codehash` equals the pinned expectation. Required final evidence: clean `forge build --force --build-info` plus package generation. | **Remediated in source; final validation pending recorded clean-artifact output.** |
| **M-NEW-01**, `audit_final_remediation_20260824.md:40-56`: reviewed controller ceilings were tooling policy rather than on-chain ceilings | Direct: controller registers and accounts for every bonds-only child allocation | `v3-src/contracts/pilot/BasePilotAccessControllerV3.sol`: immutable `maxGlobalCap` and `maxPerPositionCap`, constructor zero/inconsistency rejection, and `setCaps` enforcement. Controller ABI bindings are updated in `generate_bootstrap_package.py`, `generate_bonds_only_package.py`, `deployment_manifest.py`, and `base_v3_deployment_manifest.json` to bind exactly 0.40/0.20 ETH. | `BasePilotAccessControllerV3Test.testConstructorRejectsZeroOrInconsistentImmutableMaximumCaps` and `.testGovernanceCanLowerCapsButCannotExceedImmutableMaximums` prove governance cannot raise either cap and preserve safe lower-cap configuration. Manifest/package Python regressions verify exact constructor arguments. | **Remediated in source; Foundry and package-validation output pending.** |
| **L-NEW-01**, `audit_final_remediation_20260824.md:58-72`: governance runbook placed coordinator/factories before required controller code | Direct: `SafeBondFactoryV3` constructor rejects a nonzero controller with no code | `pr8/governance/MULTISIG_TIMELOCK_PLAN.md` now orders governance, controller, consensus, dispute registry, coordinator, Partnership factory, Accountability factory, and explicitly calls controller code a coordinator precondition. `deployment_manifest.py` and `base_v3_deployment_manifest.json` enforce the same order. | `BondsOnlyManifestTests.test_checked_in_manifest_is_cryptographically_bound_and_review_only` asserts the deployment-label order; `deployment_manifest.validate_manifest` rejects drift. | **Remediated in source; Python validation output pending.** |
| **L-NEW-02**, `audit_final_remediation_20260824.md:74-88`: historical/remediation IDs could not be independently closed from retained evidence | Direct as a release-evidence and reviewer traceability requirement | This matrix is the required current-diff crosswalk. It identifies only the original final-audit records by document and location, avoids ambiguous historical ID reuse, gives exact current code/configuration locations, and names the regression/gate required for final evidence. | Review this matrix together with the exact finalization provenance produced by `pr8/pilot/finalize_bonds_only_manifest.py`; reject a finalization artifact that lacks source/evidence commit and validation archive bindings. | **Documentation control added; finalization evidence remains pending by design.** |

## ABI and storage declaration

`BasePilotAccessControllerV3` changes its fresh-deployment constructor from
`(address governance)` to `(address governance, uint256 maxGlobalCap, uint256
maxPerPositionCap)`. It adds public immutable getter selectors for both maximums
and an `InvalidMaximumCap()` custom error. The two immutable values are embedded
in runtime code and do not consume storage slots; all existing controller storage
variables and mappings retain their declaration order. This is not proxy-safe or
an in-place migration: the manifest and package tooling mark it fresh-deployment
only. No V2 ABI or storage surface is changed.
