# Base V3 Pilot — Owner Decisions Required Before Any Production Payload

**Status: blocked.** The checked-in deployment manifest is intentionally
`review-only`; every V3 deployment address is `null`, and its validator rejects
payload readiness. This file records decisions that the code cannot make.

## 1. Name the accountable governance identities

Provide five distinct signer addresses and explicitly approve **3-of-5**. Provide
one nonzero guardian address that is not any signer. The deployment manifest
pins a 24-hour (`86400`) operational timelock, immutable 24-hour floor, and a
24-hour guardian rotation delay; owners must accept those values or request a
reviewed configuration change before approval.

## 2. Name the treasury and operating roles

Provide the treasury address, at least one attester, at least one adjudicator,
**exactly one** design partner with written acceptance, and each actual pilot
module. The treasury is an
explicit constructor input for `TaskEscrowV3` and
`ERC8004ValidationRegistryV3Safe`; it must not be filled with a deployer EOA.
The review-only manifest intentionally records zero active partners. Before
activation, the approved allowlist must contain one—and only one—partner, its
permitted module/route, data-minimization terms, exit path, and no-governance-
role confirmation. `BasePilotAccessControllerV3` has an allowlist but does not
on its own prove a one-partner maximum, so an independent post-state review is
required.

## 3. Review the selected native-bond caps and evidence the pilot integration

`PartnershipBondV3Safe` and `AccountabilityBondV3Safe` are native-only. Their
constructors reject zero caps and bind immutable native-wei limits directly:

1. partnership per-party, per-bond, and aggregate principal/liability caps; and
2. accountability per-bond and aggregate principal/liability caps.

The owner selected the tiny initial Base pilot profile on 2026-08-21. The
review manifest now binds the following exact positive atomic values:

1. partnership per-party: `0.01 ETH` (`10000000000000000` wei);
2. partnership per-bond: `0.02 ETH` (`20000000000000000` wei);
3. partnership aggregate: `0.20 ETH` (`200000000000000000` wei);
4. accountability per-bond: `0.02 ETH` (`20000000000000000` wei); and
5. accountability aggregate: `0.20 ETH` (`200000000000000000` wei).

These satisfy `party <= bond <= aggregate` for partnership and
`bond <= aggregate` for accountability. There are no USDC economics in the
bond constructors. Changing any value requires a new reviewed manifest change,
regression tests, and a fresh Base fork rehearsal.

The aggregate accounting remains occupied when terminal settlement or refund
merely creates a pull-payment credit; it releases only after the recipient's
successful withdrawal. This preserves a real liability ceiling without trapping
pause-safe exits.

`BasePilotAccessControllerV3` remains an additional deployment/allowlist gate
for a participating module. It is not a substitute for the bond contracts'
immutable caps. Owners must record the participating module and Base-fork
evidence that its controller allocation release is post-settlement/withdrawal
safe and remains disabled until timelocked governance enables it.

The controller cap decision is native ETH, not USDC: global `0.40 ETH`
(`400000000000000000` wei) and per position `0.20 ETH`
(`200000000000000000` wei). Its untyped allocation must be verified against
the participating module's native-ETH accounting; no USDC conversion or
generic-base-unit interpretation is permitted.

## 4. Approve the constructor bootstrap and actual Base addresses

There is no governance constructor cycle in the read-only profile: it deploys
with no guardian pause targets. Any later target requires a separate 3-of-5
timelocked self-call before value enablement. A full-pilot rehearsal may still
predict the governance CREATE address to bind a child bond's final owner at
construction time, but that is an optional construction technique rather than
an activation authorization. Owners must approve any later target-addition and,
only after independent verification, populate every V3 address in the manifest.

The two V2 integration addresses are already explicit read-only inputs; owners
must confirm they remain the intended Base registry and legacy KYA integration.

## 5. Review the fixed unsigned governance transport

`SafeBondFactoryV3.owner` is the deployed `MultisigGovernanceV3` contract. The
approved transport is consequently fixed:

1. submit `MultisigGovernanceV3.propose(target, value, calldata)`;
2. record the `ProposedV3` proposal ID and collect three distinct current-signer
   `confirm(proposalId)` calls; and
3. after the emitted `eta` and never before the 24-hour floor, call
   `MultisigGovernanceV3.execute(proposalId)`.

`pr8/migration/safe_payload_generator.py` emits deterministic, unsigned outer
proposal payloads and confirmation/execution instructions. It never emits a
direct factory/module transaction. Any direct Safe or EOA call to an owned
factory/module must be rejected as an ownership-model failure.

If a Safe is used, it may be one of the five governance signers only. It must
be recorded as a signer transport, not represented as the owner, and must
submit/confirm/execute against `MultisigGovernanceV3`. A Safe-owner architecture
would require an explicit ownership redesign, tests, and review; it is not
authorized by this patch.

## 6. Supply independent evidence and an explicit approval

Before a production-ready manifest can pass validation, attach at least one
independent-audit SHA-256 evidence record and set an explicit deployment
approval. The existing pilot gate remains independently fail-closed until all
its recorded audit, fork, monitoring, incident, deployment-address, and
operational evidence requirements are complete.

The corresponding partner acceptance, qualified-counsel review, Base Sepolia
rehearsal, and x402 settlement-evidence fields are deliberately `null` in the
review manifest. Do not fill them from a template, test, branch, or historical
V2/Solana/cross-chain material. Solana and all cross-chain value flows remain
outside this Base-only pilot.
