feat(script): author the follow-up authoriser swap for still-V3 vaults

[hardyjosh]

The executed 20260623 batch covered every vault in the table at signing
time; the six tokens deployed after it (MU/AMD/AVGO/AMAT/LRCX/TTWO) came up
on the V3 authoriser and red-line the strict uniform-authoriser invariants
until swapped. Add 20260722-swap-remaining-vault-authorisers, a run-script
Safe Tx Builder authoring that is deliberately SELF-SCOPING: it reads every
production vault's live authorizer() and targets exactly the still-V3
ones — a later un-swapped vault is picked up by re-dispatch, an unknown
authoriser aborts the authoring (UnexpectedVaultAuthoriser), and an
all-swapped table refuses to author an empty bundle (NoVaultsLeftToSwap).

Pre-flight pins the clone (codehash + full grant map incl. the seven
auto-granted admins on the Safe); post-state asserts STRICT authoriser
uniformity across the whole table plus uniform Safe ownership.

Notable finding, proven by the n+1 walk: the swap is ONE-WAY. The V4 vault
impl validates the incoming authoriser and reverts
AuthorizerMissingCorporateActionAdmin for V3, so rollback is structurally
impossible; recovery is forward-only (the Safe re-points at any
V4-compatible authoriser). The n+1 leg proves that class clears the live
threshold instead of simulating an impossible V3 rollback.

Registered in run-script.yaml (append-only). Fork suite: happy path checks
the authored bundle matches the live-derived target set tx-for-tx; inverted
guards cover the empty-set and unknown-authoriser aborts.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01VPs1hCTxusmaSeFKvoc4Kr

Summary by CodeRabbit

• New Features

  • Added a controlled process to update remaining production receipt vaults to the approved V4 authorizer.
  • Added safeguards that validate configuration, detect unexpected authorizers, and verify the resulting state.
  • Added Safe transaction artifact generation for review and execution.
  • Added the process to the manual workflow dispatcher.

• Tests

  • Added coverage for completed migrations and unexpected authorizer configurations.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 636d1b60-4609-4bb4-befb-b3f39cab9321

📥 Commits

Reviewing files that changed from the base of the PR and between 4dd480d and 9a941bd.

📒 Files selected for processing (3)

• .github/workflows/run-script.yaml
• script/20260722-swap-remaining-vault-authorisers.s.sol
• test/script/20260722-swap-remaining-vault-authorisers.t.sol

---

📝 Walkthrough

Walkthrough

Adds a Solidity script that authorizes Safe transactions to migrate remaining production receipt vaults from the V3 to the pinned V4 authoriser clone, with validation, simulation, artifact emission, and forked failure-path tests. The workflow dispatcher exposes the script.

Changes

Vault authoriser migration

Layer / File(s)	Summary
Authoriser validation and Safe bundle script/20260722-swap-remaining-vault-authorisers.s.sol	Validates the V4 clone, selects V3-authorised vaults, builds Safe setAuthorizer calls, simulates them, checks post-state invariants, and emits a transaction artifact.
Forked failure-path coverage test/script/20260722-swap-remaining-vault-authorisers.t.sol	Tests the no-target and unexpected-authoriser revert paths on a live fork.
Workflow dispatch registration .github/workflows/run-script.yaml	Adds the new script to the workflow dispatch selection list.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Dispatcher
  participant SwapRemainingVaultAuthorisers
  participant Safe
  participant ReceiptVaults
  Dispatcher->>SwapRemainingVaultAuthorisers: invoke run()
  SwapRemainingVaultAuthorisers->>ReceiptVaults: inspect authorizer()
  SwapRemainingVaultAuthorisers->>Safe: simulate setAuthorizer(V4 clone)
  Safe-->>SwapRemainingVaultAuthorisers: return simulation results
  SwapRemainingVaultAuthorisers->>ReceiptVaults: verify V4 clone authorisers

Loading

Possibly related PRs

• S01-Issuer/st0x.deploy#197: Adds a closely related Safe-routed receipt-vault authoriser swap flow.
• S01-Issuer/st0x.deploy#268: Addresses overlapping V4 authoriser swap retargeting.
• S01-Issuer/st0x.deploy#271: Adds a similar Forge script for Safe authoriser swap transactions.

Poem

I’m a bunny with a bundle so neat,
V3 hops out as V4 takes its seat.
Safe calls line up, checks guard the way,
Fork tests catch wrong hops astray.
The dispatcher now knows where to play!

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/20260722-swap-remaining-authorisers

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/run-script.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hardyjosh]

• ops(script): HyperEVM token deploy (RAI-1511) #278
• pin(invariants): HyperEVM invariant surface (RAI-1511) #277
• ops(script): HyperEVM beacon-owner migration + 0.1.1 beacon lib generalisation (RAI-1511) #276
• feat(multichain): HyperEVM token-owner Safe pin plumbing (RAI-1511) #275
• feat(multichain): HyperEVM V4 authoriser clone pin plumbing (RAI-1511) #274
• feat(multichain): HyperEVM bootstrap plumbing (RAI-1511) #273
• feat(script): author the follow-up authoriser swap for still-V3 vaults #269 👈 (View in Graphite)
• ops(script): RKLB catch-up — gap-fill Ethereum deploy + single-tx swap authoring #271
• pin(tokens): hydrate the Ethereum token table + add RKLB to the canonical set #259 : 1 other dependent PR (#270 )
• feat(script): deploy the Ethereum production tokens via the deploy key, matched to Base #231 : 1 other dependent PR (#257 )
• test(parity): cross-chain deployment parity pin + scheduled CI #230
• pin(ethereum): hydrate the V4 authoriser clone address #258
• feat(deploy): Ethereum V4 authoriser clone — chain-parametric deploy script + per-chain pin selector #229
• feat(tokens): add MU/AMD/AVGO/AMAT/LRCX/TTWO to the Base production token list #265
• fix(test): assert ownership of the IN-USE production beacons per chain #266
• feat(lib): chain-aware token-owner Safe assertion #267
• fix(test): retire executed-migration simulations, repoint authoriser truth #268
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[thedavidmeister]

Reviewed f3951fd: approve

Verified against the actual branch tip f3951fd (the main merge), not the PR object's head.sha, which is stale at 98b8ad2 — git ls-remote and the git-ref API both report f3951fd.

CI on f3951fd:

• rainix-sol / test — one failure, testDeployTag (0_1_8 != 0_1_27), the known soldeer autopublish drift: each release bumps foundry.toml while the test compares a pinned 0_1_8.
• git-clean — "Assert committed artifacts match freshly built".

Both are inherited: main at 592d002 is red on the same two jobs. This branch adds no new failure.

The four run-once guard failures visible on the older 98b8ad2 (testRunOnceGatePassesOnTheShippedTable, testRunOnceGateInspectsEveryLeg, testRunOnceGateFiresOnAHydratedTable, testRunRevertsWhenCoreNotDeployed) are resolved by the main merge, which brings in #279's local virginTable(...) fixture. Those tests no longer read the live hydrated productionTokensEthereum() table.

[thedavidmeister]

Reviewed 9a941bd: approve

Tip is 9a941bd, an empty resync commit on f3951fd — content identical to the tree verified above. Reds remain testDeployTag + git-clean, both inherited from main (592d002). Merging at the user's explicit direction despite the PR-object head desync.