# V3 Base fork deployment and rollback gate

## Scope and safety

`test/fork/base/BasePilotDeploymentRollbackV3.t.sol` is an **ephemeral Foundry
fork simulation**. It requires only `BASE_RPC_URL`, never calls
`startBroadcast`, never reads a private key, and does not deploy to or modify
Base. State changes exist only in Foundry's local fork process.

The V3 pilot controller rejects every chain except Base (chain ID `8453`).
Avalanche, Arbitrum, and Polygon are supported only by the optional read-only
endpoint checks in `test/fork/SupportedChainForkAvailabilityV3.t.sol`; they
must never run the Base pilot deployment path.

## Deterministic bootstrap order

The full-pilot rehearsal uses a conservative address-prediction sequence:

1. The pause targets (`PartnershipBondV3Safe` and
   `AccountabilityBondV3Safe`) must receive final governance as `owner` in
   their constructors.

The simulation uses that prediction without a temporary EOA owner or ownership
transfer:

1. Read the simulation contract's next CREATE nonce.
2. Predict the governance address at nonce `+5`.
3. Deploy `RewardProgramV3`, `ThresholdConsensusV3`, `DisputeRegistryV3`,
   `PartnershipBondV3Safe`, and `AccountabilityBondV3Safe` with that predicted
   address. The bonds and factory receive consensus/dispute dependencies and
   nonzero immutable native-wei caps directly in their constructors. The
   non-broadcast script reads the five cap values from named environment inputs;
   production values must first be selected in the manifest.
4. Deploy `MultisigGovernanceV3` with the two bonds in its append-only guardian
   pause allowlist and assert the resulting address equals the prediction.
5. Deploy the Base controller, bond factory, escrow, evidence,
   reputation, validation, identity, mandate, mutual-aid, and vault contracts
   with final governance/treasury bindings.

The separate read-only bootstrap starts with no guardian targets, so it does
not need this construction pattern; every future target must be appended by a
timelocked governance self-call before value enablement.

`script/BasePilotForkSimulation.s.sol` provides the same bootstrap ordering as
a manual simulation entry point. It is intentionally not a deployment script:
there is no `--broadcast` command in this document and the source contains no
broadcast cheatcode.

## Assertions

With Base RPC available, the fork test asserts:

- all constructor owner/governance/treasury bindings, including specialized
  bond factory child ownership;
- the Base pilot governance configuration is exactly 3-of-5 with a 24-hour
  timelock and floor, and the guardian is not a signer;
- Base-only controller construction, zero caps, and deploy/write paths closed
  by default;
- governance-only configuration, module/design-partner allowlists, global and
  per-position caps;
- timelocked rollback disabling new deployments and writes;
- append-only guardian pause allowlist accepts the two bond targets and rejects
  the controller;
- controller release accounting remains usable while writes/deploys are
  disabled;
- pull-payment withdrawal remains usable after guardian pause; and
- two known Base V2 addresses are read before and after the simulation, with
  code hash and native balance unchanged. The test does not invoke V2 state
  changing methods.

The V2 witnesses are `MissionEnforcement`
(`0xBc4208A7A59af3B7E438d3308C3dc0d299d739a7`) and
`ERC8004IdentityRegistry`
(`0xa7BD20bf5De63df949cA5Be2F20835978eCba81A`). Their expected bytecode sizes
come from `../baseline/deployments.json`.

## Commands

Normal local tests never require a chain endpoint:

```bash
cd v3-src
forge build
forge test --no-match-path 'test/fork/**'
```

Run all gate behavior, keeping unavailable endpoints as logged skips:

```bash
ci/fork-gates.sh
```

Run Base simulation only when a Base RPC endpoint is deliberately supplied:

```bash
BASE_RPC_URL='https://your-base-rpc' \
  forge test --match-contract BasePilotDeploymentRollbackV3ForkTest -vv
```

To require every configured-chain endpoint in CI, use:

```bash
REQUIRE_FORK_RPCS=1 \
BASE_RPC_URL=... AVAX_RPC_URL=... ARB_RPC_URL=... POLYGON_RPC_URL=... \
  ci/fork-gates.sh
```

No command above broadcasts a transaction. Do not add `--broadcast`, a private
key, or production configuration to this gate.
