Aere Network public source. Everything here can be checked against the live chain (chain id 2800, https://rpc.aere.network). Scope note, stated up front rather than buried: consensus on chain 2800 is classical secp256k1 ECDSA QBFT. The post-quantum work in this repository is at the signature, precompile, account and transport layers. Nothing here makes the consensus post-quantum, and no document in it should be read as claiming so.
3.5 KiB
Summary: AERE-NEW-CONTRACTS-DEPLOY-RUNBOOK.md
Deliverable written to aerenew/docs/AERE-NEW-CONTRACTS-DEPLOY-RUNBOOK.md. Covers 17 new founder-gated
contracts, read directly from source under aerenew/contracts/contracts/. Nothing is deployed; every one
is founder-gated (confirmed: none has a deployments/*.json entry, none in sdk-js/src/addresses.ts).
Method
- Read every contract's real constructor.
- Cross-referenced live addresses from
sdk-js/src/addresses.tsand precompiles fromdocs/AERE-EIP-COMPATIBILITY-MATRIX.md(0x0AE1 Falcon-512, 0x0AE3 ML-DSA-44, both live block 9,189,161). - Mapped per-contract risk from
docs/AERE-SECURITY-REVIEW-NEW-CONTRACTS.md+AERE-SECURITY-FIXES.md. - Named the Hardhat test file for each contract.
Live wiring addresses used
- SP1VerifierGateway 0x9ca479C8c52C0EbB4599319a36a5a017BCC70628
- AerePQCKeyRegistry 0x1eCa3c5ADcBD0b22636D8672b00faC6D89363691
- AereAgentDID 0xce641d7d7C10553D82b06B7C21d423550e7522C5
- AereAIReputation 0x781ef746c08760aa854cDa4621d54db6734bfeBF
- AerePQCAccountFactory 0xd5315Ea7caa60d320c4f34b1bEd70dd9cc02CE58 (runtime ref for migrator)
- AERE402FacilitatorV2 0xFC2f7FAa94919caF1126b3c995F0F6AcCef291de
- Foundation 0x0243A4f47D44b40b65D33f20329dE20D00c6f3C3
- Deployer 0xbeB33D20dFBBD49eC7AC1F617667f1f02dfd6465
Deploy order (topological)
Wave A (no sibling dep): AereAccountMigrator, AereRandomnessBeaconV2, AereRecoveryRegistry, AereDestinationSettler, AerePQAttestationKeyRegistry, AereBitstringStatusList(0), AereIdentityRegistry8004(DID), AereValidationRegistry8004(reg,DID), AereAP2MandateVerifier(reg,executor), AereTrustRegistry(reg), AereVectorStore(facilitator), AereComputeMarketV3(gateway,arbiter,governance). Wave B: AereReputationRegistry8004(reputation, identity=A7), AereVerifiableCredential(trust=A10, statusList=A6). Wave C (circuit-gated): AerePQAggregateVerifier(gateway, aggVkey), AereFinalityCertificateVerifier(gateway, finVkey, registry=A5). Wave D: AerePQAggregateModule(verifier=C1).
Gate buckets
- Deploy-when-ready (low risk): Migrator, RandomnessBeaconV2, RecoveryRegistry, DestinationSettler, IdentityRegistry8004, ValidationRegistry8004, VerifiableCredential, BitstringStatusList, VectorStore.
- Founder-config/action before useful: AP2 (executor), TrustRegistry (owner+accredit), ReputationRegistry8004 (attestor grant + owner), AttestationKeyRegistry (enroll+keys), ComputeMarketV3 (arbiter+governance).
- External-audit-gated (fund flow, strongest = ComputeMarketV3): also recommended for VectorStore, DestinationSettler, AccountMigrator.
- MUST NOT deploy until a circuit exists: AerePQAggregateVerifier, AereFinalityCertificateVerifier, AerePQAggregateModule, and the zk non-revocation path of AereBitstringStatusList.
[VERIFY] items at deploy
- AP2 settlementExecutor (non-zero, required in prod; L3).
- ReputationRegistry8004 reputation instance for write-through (new instance listing the adapter).
- VectorStore facilitator (AERE402FacilitatorV2; confirm settle ABI).
- ComputeMarketV3 arbiter + governance (Foundation recommended).
- vkeys (immutable, circuit not built): AerePQAggregateVerifier.aggregateProgramVKey, AereFinalityCertificateVerifier.programVKey, AereBitstringStatusList.setNonRevocationVKey.
Security-review carry-through
No CRITICAL/HIGH. M1 (reputation write gate) fixed, L1 x3 (code-less-gateway guard) fixed in AerePQAggregateVerifier/AereComputeMarketV3/AereBitstringStatusList, L2 (vector-store receipt-provider bind) fixed, L3 (AP2 open-path replay) documented as accepted risk closed by the executor gate.