Audit: file Protofire r3.0 report (sol-v0.1.5, jul-2026)

[thedavidmeister]

Files the third-round (r3.0, July 2026) Protofire audit report of rain.factory, uploaded by the human on #48.

Closes #48

What the report is

• Round: 3.0, dated July 2026 (review row: 30/07/26).
• Audited state: commit c29d5827309d2f10a6e68c76bc2ea385e0a4e701, tag sol-v0.1.5 — verified: the tag exists in this repo and points at exactly that commit.
• Scope: src/concrete/CloneFactory.sol, src/interface/ICloneableFactoryV2.sol, src/interface/ICloneableFactoryV3.sol, src/interface/ICloneableV2.sol, src/lib/LibCloneFactoryDeploy.sol.
• Findings: zero at every severity (Critical 0, High 0, Medium 0, Low 0, Informational 0 — each section states "No X severity issue found."). A clean report.

PDF in this PR: audit/protofire/rain.factory.sol-v0.1.5-r3.0.jul-2026.pdf (repo path audit/protofire/rain.factory.sol-v0.1.5-r3.0.jul-2026.pdf after merge).

Filename choice

The report audits a release tag, so it takes the version+round pattern (like rain.factory.v0.1.1-r2.0.may-2026.pdf), not the ref pattern (rain.factory.1a92a86.feb-2026.pdf). The tag is used verbatim (sol-v0.1.5, not v0.1.5) because roh-scan's parse_audited_tag captures the sol- prefix and resolves the full tag as a git ref — v0.1.5 alone resolves to nothing in this repo.

Findings triage

Nothing to triage: the report contains no findings at any severity, so there are no unresolved findings to verify against main, no dedup against existing issues, and no new issues filed. Triage tally: 0 filed / 0 already-fixed-on-main / 0 resolved-in-report. The #47 library/deploy split routing question therefore does not arise for any finding.

Scan visibility (rain-org-health)

Checked against roh-scan source (plugins/rain-org-health-check/roh-scan/src/{protofire.rs,main.rs}):

• The scanner walks audit/protofire/ for .pdf blobs — this file sits flat in that dir, so it is collected.
• parse_audited_tag("rain.factory.sol-v0.1.5-r3.0.jul-2026.pdf") → sol-v0.1.5 (the (?:sol-)?vX.Y.Z regex; the raindex.sol-v0.1.12.jun-2026.pdf unit test pins this exact shape). Tag-anchored, and the tag resolves.
• Recency: the anchor commit's date (2026-07-12) is the newest of the three PDFs' anchors (feb 1a92a86, may v0.1.1, this one), so this becomes the reference audit.
• Drift sol-v0.1.5...main is currently one workflow file (.github/workflows/package-release.yaml), zero non-test .sol lines; this PR adds only a PDF. Post-merge the scan will report rain.factory external audit = current, anchored at tag sol-v0.1.5.

QA

• Discriminating tests: n/a — the diff is one binary PDF added under audit/protofire/; no source or test code changes, nothing a test could discriminate. reuse lint run locally with the PDF present: green (37/37 files licensed; REUSE.toml's audit/**/ annotation covers it identically to the two existing reports, no sidecar needed) — same check CI's rainix-sol-legal runs.
• Mutations applied: n/a — a binary PDF has no mutable code lines.
• Oracle: the report PDF itself (audited commit/tag read from its Reviews table and verified against this repo's refs: sol-v0.1.5 → c29d582…), the two existing audit/protofire/ filenames for the naming convention, and roh-scan source (protofire.rs parse_audited_tag + its unit tests) for scanner-visibility — all independent of this diff.
• Category check: issue Upload the new audit report to audit/protofire/ (human task) #48 asks: upload the report under audit/protofire/ per convention, REUSE-compliant, scanner-visible. Covered: PDF filed per the version+round convention (tag verbatim); REUSE green; findings triaged 0 filed / 0 already-fixed / 0 resolved-in-report (clean report, zero findings at all severities); scan-visibility confirmed against roh-scan source (tag-anchored at sol-v0.1.5, becomes reference audit, verdict current post-merge).

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• audit/protofire/rain.factory.sol-v0.1.5-r3.0.jul-2026.pdf is excluded by !**/*.pdf

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 44f1616d-6402-4b58-b38b-2a5937cf3e7a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thedavidmeister]

QA: finding-by-finding triage — Protofire r3.0 (jul-2026)

Report parsed in full (pdftotext, all 7 pages). The Technical analysis chart and every severity section agree: the report contains no findings.

Finding ID	Severity	Title	Status per report	Verified vs main	Disposition
—	Critical	"No critical severity issue found."	n/a	n/a	nothing to file
—	High	"No high severity issue found."	n/a	n/a	nothing to file
—	Medium	"No medium severity issue found."	n/a	n/a	nothing to file
—	Low	"No low severity issue found."	n/a	n/a	nothing to file
—	Informational	"No informational severity issue found."	n/a	n/a	nothing to file

Tally: 0 filed / 0 already-fixed-on-main / 0 resolved-in-report. No dedup needed; the #47 library/deploy split routing question does not arise for any finding.

Cross-checks done while triaging:

• Reviews table names three rounds: 1a92a86 (11/02/26), v0.1.1 = 08fecb9 (27/05/26), sol-v0.1.5 = c29d582 (30/07/26). The first two match the two PDFs already in audit/protofire/; the third is this filing. All three refs verified present in this repo.
• One oddity noted for the record: tag sol-v0.1.5 points at commit c29d582, whose commit message is "Package Release: soldeer rain-factory 0.1.6" — the git tag series and the soldeer package version are offset by one at that point. The report's tag→commit mapping matches the repo exactly, so the filename follows the tag.

[thedavidmeister]

Reviewed 91fc7eb: ready — r3.0 filed under the scanner-verified tag-anchored name (sol- prefix required by parse_audited_tag, checked against the scanner's own test), REUSE covered by the existing audit annotation, clean report so zero findings to file, post-merge scan verdict current, tag/package offset anomaly on the record.