ops(script): RKLB catch-up — gap-fill Ethereum deploy + single-tx swap authoring

[hardyjosh]

Operational scripts split out of the token-table pin (#259), which stays
pins-only:

• 20260722-deploy-missing-tokens-ethereum (manual-broadcast): self-scoping
  gap-fill of the Ethereum token set — deploys exactly the canonical config
  rows whose Ethereum table entry is all-zero; refuses on a fully-hydrated
  table (NoMissingTokens). EXECUTED 2026-07-22 (run 29924926246, RKLB);
  status + post-execution test shape included.
• 20260722-swap-rklb-authoriser (run-script): single-tx Safe authoring for
  RKLB's Base authoriser swap, kept separate from the six-vault bundle that
  was already 2-of-3 signed when RKLB entered the table (a regenerated 7-tx
  bundle would void those signatures). PENDING.

Both registered in their append-only workflow dropdowns; fork suites green
against live chains.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01VPs1hCTxusmaSeFKvoc4Kr

Summary by CodeRabbit

• New Features

  • Added an operational workflow for deploying missing canonical tokens on Ethereum.
  • Added an operational workflow to prepare the RKLB receipt vault authorizer upgrade and generate a Safe transaction proposal.
  • Added preflight validation to prevent deployments or upgrades when required contracts, permissions, or configuration are inconsistent.

• Tests

  • Added coverage for fully provisioned token tables, missing deployment prerequisites, already-completed upgrades, and unexpected authorizers.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 50ed5dbe-a725-4686-972a-025911ccf95c

📥 Commits

Reviewing files that changed from the base of the PR and between b2e3fa0 and 467c048.

📒 Files selected for processing (7)

• .github/workflows/manual-broadcast.yaml
• .github/workflows/run-script.yaml
• script/20260722-deploy-missing-tokens-ethereum.s.sol
• script/20260722-swap-rklb-authoriser.s.sol
• test/script/20260722-deploy-missing-tokens-ethereum.t.sol
• test/script/20260722-swap-rklb-authoriser.t.sol
• test/script/DeployMissingTokensEthereumHarness.sol

---

📝 Walkthrough

Walkthrough

Adds two Forge scripts: one deploys missing Ethereum token vaults, and the other authors a Safe transaction to swap the RKLB vault authoriser. Both scripts gain workflow entries and focused fork-based or harness tests for preflight failures.

Changes

Ethereum token deployment

Layer / File(s)	Summary
Deployment preflight and execution script/20260722-deploy-missing-tokens-ethereum.s.sol	Validates pinned deployment prerequisites, selects missing canonical tokens, deploys vaults, configures the V4 authoriser, transfers ownership, and logs deployed addresses.
Deployment registration and validation .github/workflows/manual-broadcast.yaml, test/script/DeployMissingTokensEthereumHarness.sol, test/script/20260722-deploy-missing-tokens-ethereum.t.sol	Registers the deployment script and tests fully hydrated selection plus a missing core deployer revert.

RKLB authoriser swap

Layer / File(s)	Summary
Authoriser preflight and Safe simulation script/20260722-swap-rklb-authoriser.s.sol	Validates the pinned V4 authoriser and RKLB vault state, simulates the Safe transaction, writes a Safe Tx Builder artifact, and checks forward-only re-issuance.
Swap registration and validation .github/workflows/run-script.yaml, test/script/20260722-swap-rklb-authoriser.t.sol	Registers the swap script and tests already-swapped and unexpected-authoriser reverts on a Base fork.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• S01-Issuer/st0x.deploy#252: Hydrates the pinned V4 authoriser clone used by these scripts.
• S01-Issuer/st0x.deploy#259: Updates the canonical production token configuration used by Ethereum deployment selection.
• S01-Issuer/st0x.deploy#268: Updates receipt-vault authoriser-swap behavior and V4 authoriser expectations.

Suggested labels: ai:reject

Poem

I’m a rabbit with scripts in my den,
Deploying missing tokens again.
V4 guards the gate,
Safe hashes await,
And RKLB swaps cleanly—amen!

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ops/rklb-catchup-scripts

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/manual-broadcast.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

.github/workflows/run-script.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hardyjosh]

• ops(script): HyperEVM token deploy (RAI-1511) #278
• pin(invariants): HyperEVM invariant surface (RAI-1511) #277
• ops(script): HyperEVM beacon-owner migration + 0.1.1 beacon lib generalisation (RAI-1511) #276
• feat(multichain): HyperEVM token-owner Safe pin plumbing (RAI-1511) #275
• feat(multichain): HyperEVM V4 authoriser clone pin plumbing (RAI-1511) #274
• feat(multichain): HyperEVM bootstrap plumbing (RAI-1511) #273
• feat(script): author the follow-up authoriser swap for still-V3 vaults #269
• ops(script): RKLB catch-up — gap-fill Ethereum deploy + single-tx swap authoring #271 👈 (View in Graphite)
• pin(tokens): hydrate the Ethereum token table + add RKLB to the canonical set #259 : 1 other dependent PR (#270 )
• feat(script): deploy the Ethereum production tokens via the deploy key, matched to Base #231 : 1 other dependent PR (#257 )
• test(parity): cross-chain deployment parity pin + scheduled CI #230
• pin(ethereum): hydrate the V4 authoriser clone address #258
• feat(deploy): Ethereum V4 authoriser clone — chain-parametric deploy script + per-chain pin selector #229
• feat(tokens): add MU/AMD/AVGO/AMAT/LRCX/TTWO to the Base production token list #265
• fix(test): assert ownership of the IN-USE production beacons per chain #266
• feat(lib): chain-aware token-owner Safe assertion #267
• fix(test): retire executed-migration simulations, repoint authoriser truth #268
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[thedavidmeister]

Reviewed 467c048: approve

Run 29987588312 leaves one test failure — testDeployTag (0_1_8 != 0_1_22) — plus git-clean. Both inherited main-red. No PARITY PENDING in the log at all, so testCrossChainParity ran fully armed for the first time: all three legs compared on both chains now that #259 hydrated the Ethereum table.

Both scripts are well built, and better guarded than their predecessors in this stack. The gap-fill carries NoMissingTokens and TokenTableMisaligned, which cross-checks the canonical config against the table row-by-row on underlying — so it cannot deploy the right token into the wrong slot if the two lists ever drift. That is a structural check where a comment would have done. The swap script pre-flights the target authoriser's deployment, codehash and full grant map with distinct typed errors, refuses on RklbAlreadySwapped / UnexpectedRklbAuthoriser, and simulates the swap and asserts the post-state before authoring.

Keeping RKLB as its own single-tx bundle was right: the six-vault bundle was already 2-of-3 signed, and regenerating it as 7 txs would have changed the SafeTxHash and voided those signatures.

Two things I changed:

ee38675 — the swap script still read **PENDING.** after the Safe executed it today. Flipped to **EXECUTED 2026-07-23.** with the evidence, and retired testRunCompletesAndWritesArtifact. That test drove run() against live Base, so it began failing the instant the swap landed — its own comment called for retiring it at exactly this point. Left in place it would have held this PR red on a test designed to stop existing. The inverted coverage remains, which is what refuses a re-dispatch.

467c048 — rainix-sol / static was failing on rainix-sol-single-contract: the .t.sol declared both the test contract and an inline DeployMissingTokensEthereumHarness. That gate exists precisely to stop inline helpers accumulating in test files, so it was working as intended. Split out to mirror test/src/lib/LibBeaconInvariantsHarness.sol. Verified before pushing: the gate run over every tracked .sol is clean, forge fmt --check clean, all four tests pass.

Worth recording what this PR now is: both scripts have executed, and both refuse to run again. It is a record of what happened plus the guards that stop it happening twice — which is the shape rain.deploy#15 argues should be an on-chain migration registry rather than a status marker a human flips.