acac2f00a6
Some checks failed
contracts-ci / Install (lockfile) → compile → full test suite (push) Has been cancelled
contracts-ci / Ethereum interop (EIP-2537 BLS, prague hardfork) (push) Has been cancelled
contracts-ci / PQC known-answer tests (NIST vectors) (push) Has been cancelled
contracts-ci / Coverage (scoped, with artifacts) (push) Has been cancelled
The published line and the local line had no common ancestor: the public one carried the redaction pass, the local one carried three weeks of corrections that never shipped. This commit ports the local work onto the public line, keeps every public redaction, and extends the same discretion to seven client mentions that were still named in published comments. Carried: LICENSE year and LICENSING.md; the measured burn figures replacing the deflation claim (the vault holds ~0.137 AERE of 2.8 billion, and burn is a share of validator coinbase revenue, which is zero today); 'audited' removed from next to Bouncy Castle; citation paths rewritten to published form with CITATIONS-UNRESOLVED.md remeasured 2026-08-11; VERIFY-POLICY.md; slashing and ownership comments brought down to what the code does; the AerePyth repair; the shutter test helper the tests cite; runnable package.json entries; the CI file split into a GitHub/Gitea twin pair with a real measured test-run status; and the .gitignore hardening written after a compiled artifact leaked a local path in a sibling repository. A false '2-of-3 multisig' description of the owner account is corrected to what the chain measures: an externally owned account. The self-audit findings catalog stays unpublished pending an explicit decision.
68 lines
2.0 KiB
Plaintext
68 lines
2.0 KiB
Plaintext
# Dependencies (install with `npm ci`, which reads package-lock.json)
|
|
node_modules/
|
|
|
|
# Hardhat production build outputs
|
|
cache/
|
|
artifacts/
|
|
|
|
# Coverage run outputs. Separate from the production build on purpose, so an
|
|
# instrumented build can never be mistaken for, or overwrite, the real one.
|
|
# See hardhat.config.coverage.js.
|
|
#
|
|
# `cov-out/` is the one that actually matters and it was MISSING from this file
|
|
# until 2026-07-20. hardhat.config.coverage.js writes its instrumented cache and
|
|
# artifacts to `AERE_COVERAGE_OUT || "./cov-out"`, so running the documented
|
|
# coverage command in a clean clone produced roughly 167 MB of untracked build
|
|
# output that git would cheerfully offer to commit. The two entries below it
|
|
# (`cache-coverage/`, `artifacts-coverage/`) are names the config does not use
|
|
# and are kept only in case an older revision is checked out.
|
|
#
|
|
# Worth noting how this was found: by running the documented command rather than
|
|
# by reading the file. Instructions that have never been followed are usually
|
|
# wrong somewhere, and this was the somewhere.
|
|
cov-out/
|
|
cache-coverage/
|
|
artifacts-coverage/
|
|
coverage/
|
|
coverage.json
|
|
*.lcov
|
|
|
|
# Local environment. NEVER commit a populated .env: this repository is public
|
|
# and holds no keys by design. See REPRODUCE.md, "The secrets boundary".
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
|
|
# Editor / OS noise
|
|
.DS_Store
|
|
Thumbs.db
|
|
.idea/
|
|
.vscode/
|
|
|
|
# Secret-bearing file types. This repository holds NO keys by design; these
|
|
# entries exist so that an accidental `git add -A` cannot change that.
|
|
*.pem
|
|
*.key
|
|
*.p12
|
|
*.pfx
|
|
*.keystore
|
|
id_rsa*
|
|
id_ed25519*
|
|
*.mnemonic
|
|
secrets.json
|
|
|
|
# Compiled Python. Added 2026-07-20 after a committed __pycache__ entry in a
|
|
# sibling repository was found to embed an absolute Windows build path
|
|
# containing the operator's account name. Text-based secret scanners skip
|
|
# compiled binaries, so the scanner passed and the leak shipped. Ignoring the
|
|
# artifact is the cheap half of the fix; the other half is not committing
|
|
# build output at all.
|
|
__pycache__/
|
|
*.pyc
|
|
*.pyo
|
|
*.pyd
|
|
|
|
# Python environments
|
|
.venv/
|
|
venv/
|