ops(script): rehearse the timelock before governance moves to it

.github/workflows/manual-broadcast.yaml

@@ -34,6 +34,7 @@ on:
           - 20260706-deploy-tokens-ethereum
           - 20260807-deploy-missing-tokens
           - 20260729-deploy-governance-timelock
+          - 20260813-execute-timelock-operations
       network:
         description: 'Network to broadcast against (default: base)'
         required: true

.github/workflows/run-script.yaml

@@ -31,6 +31,7 @@ on:
           - 20260722-swap-remaining-vault-authorisers
           - 20260723-provision-additional-service-signer
           - 20260729-migrate-governance-to-timelock
+          - 20260813-timelock-rehearsal
           - 20260810-revoke-fireblocks-service-signer
       network:
         description: 'Network to author against (default: base)'
@@ -61,6 +62,12 @@ on:
           # JSON path argument this dispatcher can't supply and runs off-chain
           # on the signer's machine, not in CI.
           - 'run()'
+          # `20260813-timelock-rehearsal` stages. `run()` schedules the
+          # no-op, `cancel()` cancels it, `reschedule()` schedules it
+          # again. Execution is not a Safe action — the timelock's
+          # executor role is open — so it lives in manual-broadcast.
+          - 'cancel()'
+          - 'reschedule()'
 # Manually dispatches an operational script from `script/` and uploads any
 # JSON it writes to `out/` as a build artifact.
 #

docs/TIMELOCK.md

@@ -138,6 +138,35 @@ The forcing function: `GovernanceTimelockMigration.t.sol` accepts
 Safe-or-timelock per surface until **2026-10-01T00:00:00Z**, then demands the
 timelock. An unfinished rollout red-lines cron past that date.
 
+## Rehearsing the timelock
+
+The timelock can be exercised end-to-end BEFORE any governance is handed to it,
+so signers see the real loop before it controls anything. The rehearsed
+operation is `timelock.updateDelay(TIMELOCK_MIN_DELAY)` — re-setting the delay
+to the value it already holds. It is a genuine no-op, it targets the timelock
+rather than any production contract, and OZ rejects `updateDelay` from any
+caller other than the timelock itself, so it can only happen via the full
+schedule → delay → execute path. Rehearsing it therefore exercises the real
+mechanism rather than a shortcut.
+
+Stages 1–3 are Safe actions, dispatched via `Actions → run-script` with
+`script = 20260813-timelock-rehearsal` and `sig` selecting the stage:
+
+1. `run()` — schedule the no-op.
+2. `cancel()` — cancel it. Proves the veto works and that the same operation id
+   becomes schedulable again afterwards.
+3. `reschedule()` — schedule it again.
+
+Then wait out the delay and execute. Execution is **not** a Safe action: the
+executor role is open, so anyone may execute. `Actions → manual-broadcast` →
+`20260813-execute-timelock-operations` does it from the CI deploy key, which
+holds no role on the timelock — if that succeeds, permissionless execution is
+demonstrated rather than merely configured.
+
+Each stage refuses to author a bundle whose call would revert: cancelling
+nothing, or scheduling something already scheduled, fails at authoring time
+rather than in the Safe.
+
 ## Operating under the timelock (future governance actions)
 
 Every admin action becomes two Safe transactions separated by ≥48h:

script/20260813-execute-timelock-operations.s.sol

@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: LicenseRef-DCL-1.0
+// SPDX-FileCopyrightText: Copyright (c) 2020 Rain Open Source Software Ltd
+pragma solidity =0.8.25;
+
+import {Script} from "forge-std-1.16.1/src/Script.sol";
+import {console2} from "forge-std-1.16.1/src/console2.sol";
+import {IAccessControl} from "@openzeppelin-contracts-5.6.1/access/IAccessControl.sol";
+import {TimelockController} from "@openzeppelin-contracts-5.6.1/governance/TimelockController.sol";
+
+import {LibSafeInvariants} from "../src/lib/LibSafeInvariants.sol";
+import {LibTimelockInvariants} from "../src/lib/LibTimelockInvariants.sol";
+
+/// @notice The active chain's governance-timelock pin is unhydrated.
+/// @param chainId The active chain id.
+error ExecuteTimelockNotPinned(uint256 chainId);
+
+/// @notice The operation is not in a state this script can execute: it is
+/// unknown, already done, or still waiting out its delay.
+/// @param id The operation id.
+/// @param pending Whether the timelock reports it pending.
+/// @param ready Whether the timelock reports it ready.
+/// @param done Whether the timelock reports it done.
+error OperationNotExecutable(bytes32 id, bool pending, bool ready, bool done);
+
+/// @notice Execution is not open on this timelock, so the CI deploy key —
+/// which holds no roles — cannot execute. Surfaced by name because the whole
+/// point of this script is that it needs no privilege.
+/// @param timelock The timelock inspected.
+error ExecutionNotPermissionless(address timelock);
+
+/// @title ExecuteTimelockOperations
+/// @notice **PENDING.** Executes a matured timelock operation from the CI
+/// deploy key.
+///
+/// This is deliberately NOT a Safe-routed script. The timelock grants
+/// `EXECUTOR_ROLE` to `address(0)`, so once an operation's delay has run
+/// ANYONE may execute it. Driving execution from the CI deploy key — a key
+/// that holds no role on the timelock, the authoriser or any vault — is the
+/// most direct demonstration that the property is real: if this succeeds,
+/// execution is genuinely permissionless and the operator cannot censor a
+/// matured operation.
+///
+/// Dispatch via `Actions → manual-broadcast` with
+/// `script = 20260813-execute-timelock-operations` and the target `network`.
+///
+/// ## Which operation
+///
+/// OZ's `TimelockController` stores only a timestamp per operation id; it
+/// keeps no enumerable list, so "every outstanding proposal" cannot be read
+/// from contract state alone — recovering it would mean indexing
+/// `CallScheduled` logs. Rather than pretend otherwise, this script executes
+/// operations it can RECONSTRUCT, and asserts their state before acting.
+/// Today that is the rehearsal no-op from
+/// `20260813-timelock-rehearsal`, whose parameters are fixed. A future
+/// operation is added by appending its reconstruction here, which also keeps
+/// the executor honest: it can only ever run something whose full calldata is
+/// committed in this repo and therefore reviewable.
+///
+/// @dev Pre-flight asserts the timelock's pinned configuration AND that
+/// execution is open, so a timelock whose executor role had been closed
+/// fails by name rather than as an opaque `AccessControl` revert.
+contract ExecuteTimelockOperations is Script {
+    /// @notice Salt of the rehearsal operation. Must match
+    /// `TimelockRehearsal.REHEARSAL_SALT`; the rehearsal test asserts the two
+    /// derive the same id so they cannot drift apart silently.
+    bytes32 internal constant REHEARSAL_SALT = keccak256("st0x.timelock.rehearsal.20260813");
+
+    /// @notice The rehearsal's no-op payload: re-set the minimum delay to the
+    /// value it already holds.
+    /// @return The `updateDelay` calldata.
+    function rehearsalPayload() internal pure returns (bytes memory) {
+        return abi.encodeCall(TimelockController.updateDelay, (LibTimelockInvariants.TIMELOCK_MIN_DELAY));
+    }
+
+    /// @notice Execute the rehearsal operation on the active chain if it has
+    /// matured. Broadcasts from the CI deploy key, which holds no roles.
+    function run() external {
+        address safe = LibSafeInvariants.assertActiveChainTokenOwnerSafe(block.chainid);
+        address timelock = LibTimelockInvariants.timelockForChainId(block.chainid);
+        if (timelock == address(0)) revert ExecuteTimelockNotPinned(block.chainid);
+        LibTimelockInvariants.assertTimelockState(timelock, safe);
+
+        // The property this script depends on, asserted rather than assumed.
+        if (!IAccessControl(timelock).hasRole(LibTimelockInvariants.TIMELOCK_EXECUTOR_ROLE, address(0))) {
+            revert ExecutionNotPermissionless(timelock);
+        }
+
+        TimelockController controller = TimelockController(payable(timelock));
+        bytes memory payload = rehearsalPayload();
+        bytes32 id = controller.hashOperation(timelock, 0, payload, bytes32(0), REHEARSAL_SALT);
+
+        bool pending = controller.isOperationPending(id);
+        bool ready = controller.isOperationReady(id);
+        bool done = controller.isOperationDone(id);
+        if (!ready) revert OperationNotExecutable(id, pending, ready, done);
+
+        console2.log("Executing matured operation:", vm.toString(id));
+        console2.log("Timelock:", vm.toString(timelock));
+        console2.log("Chain:", block.chainid);
+
+        vm.startBroadcast();
+        address executor = msg.sender;
+        controller.execute(timelock, 0, payload, bytes32(0), REHEARSAL_SALT);
+        vm.stopBroadcast();
+
+        require(controller.isOperationDone(id), "ExecuteTimelockOperations: operation did not complete");
+
+        // The executing key holds no role — that is the point.
+        require(
+            !IAccessControl(timelock).hasRole(LibTimelockInvariants.TIMELOCK_EXECUTOR_ROLE, executor),
+            "ExecuteTimelockOperations: executor unexpectedly holds EXECUTOR_ROLE"
+        );
+
+        console2.log("Executed by:", vm.toString(executor));
+        console2.log("That address holds no EXECUTOR_ROLE - execution is permissionless");
+    }
+}