e4cead319d
Aere Network public source. Everything here can be checked against the live chain (chain id 2800, https://rpc.aere.network). Scope note, stated up front rather than buried: consensus on chain 2800 is classical secp256k1 ECDSA QBFT. The post-quantum work in this repository is at the signature, precompile, account and transport layers. Nothing here makes the consensus post-quantum, and no document in it should be read as claiming so.
56 lines
3.5 KiB
Markdown
56 lines
3.5 KiB
Markdown
# Summary: AERE-NEW-CONTRACTS-DEPLOY-RUNBOOK.md
|
|
|
|
Deliverable written to `aerenew/docs/AERE-NEW-CONTRACTS-DEPLOY-RUNBOOK.md`. Covers 17 new founder-gated
|
|
contracts, read directly from source under `aerenew/contracts/contracts/`. Nothing is deployed; every one
|
|
is founder-gated (confirmed: none has a `deployments/*.json` entry, none in `sdk-js/src/addresses.ts`).
|
|
|
|
## Method
|
|
- Read every contract's real constructor.
|
|
- Cross-referenced live addresses from `sdk-js/src/addresses.ts` and precompiles from
|
|
`docs/AERE-EIP-COMPATIBILITY-MATRIX.md` (0x0AE1 Falcon-512, 0x0AE3 ML-DSA-44, both live block 9,189,161).
|
|
- Mapped per-contract risk from `docs/AERE-SECURITY-REVIEW-NEW-CONTRACTS.md` + `AERE-SECURITY-FIXES.md`.
|
|
- Named the Hardhat test file for each contract.
|
|
|
|
## Live wiring addresses used
|
|
- SP1VerifierGateway 0x9ca479C8c52C0EbB4599319a36a5a017BCC70628
|
|
- AerePQCKeyRegistry 0x1eCa3c5ADcBD0b22636D8672b00faC6D89363691
|
|
- AereAgentDID 0xce641d7d7C10553D82b06B7C21d423550e7522C5
|
|
- AereAIReputation 0x781ef746c08760aa854cDa4621d54db6734bfeBF
|
|
- AerePQCAccountFactory 0xd5315Ea7caa60d320c4f34b1bEd70dd9cc02CE58 (runtime ref for migrator)
|
|
- AERE402FacilitatorV2 0xFC2f7FAa94919caF1126b3c995F0F6AcCef291de
|
|
- Foundation 0x0243A4f47D44b40b65D33f20329dE20D00c6f3C3
|
|
- Deployer 0xbeB33D20dFBBD49eC7AC1F617667f1f02dfd6465
|
|
|
|
## Deploy order (topological)
|
|
Wave A (no sibling dep): AereAccountMigrator, AereRandomnessBeaconV2, AereRecoveryRegistry,
|
|
AereDestinationSettler, AerePQAttestationKeyRegistry, AereBitstringStatusList(0), AereIdentityRegistry8004(DID),
|
|
AereValidationRegistry8004(reg,DID), AereAP2MandateVerifier(reg,executor), AereTrustRegistry(reg),
|
|
AereVectorStore(facilitator), AereComputeMarketV3(gateway,arbiter,governance).
|
|
Wave B: AereReputationRegistry8004(reputation, identity=A7), AereVerifiableCredential(trust=A10, statusList=A6).
|
|
Wave C (circuit-gated): AerePQAggregateVerifier(gateway, aggVkey), AereFinalityCertificateVerifier(gateway, finVkey, registry=A5).
|
|
Wave D: AerePQAggregateModule(verifier=C1).
|
|
|
|
## Gate buckets
|
|
- Deploy-when-ready (low risk): Migrator, RandomnessBeaconV2, RecoveryRegistry, DestinationSettler,
|
|
IdentityRegistry8004, ValidationRegistry8004, VerifiableCredential, BitstringStatusList, VectorStore.
|
|
- Founder-config/action before useful: AP2 (executor), TrustRegistry (owner+accredit),
|
|
ReputationRegistry8004 (attestor grant + owner), AttestationKeyRegistry (enroll+keys), ComputeMarketV3
|
|
(arbiter+governance).
|
|
- External-audit-gated (fund flow, strongest = ComputeMarketV3): also recommended for VectorStore,
|
|
DestinationSettler, AccountMigrator.
|
|
- MUST NOT deploy until a circuit exists: AerePQAggregateVerifier, AereFinalityCertificateVerifier,
|
|
AerePQAggregateModule, and the zk non-revocation path of AereBitstringStatusList.
|
|
|
|
## [VERIFY] items at deploy
|
|
- AP2 settlementExecutor (non-zero, required in prod; L3).
|
|
- ReputationRegistry8004 reputation instance for write-through (new instance listing the adapter).
|
|
- VectorStore facilitator (AERE402FacilitatorV2; confirm settle ABI).
|
|
- ComputeMarketV3 arbiter + governance (Foundation recommended).
|
|
- vkeys (immutable, circuit not built): AerePQAggregateVerifier.aggregateProgramVKey,
|
|
AereFinalityCertificateVerifier.programVKey, AereBitstringStatusList.setNonRevocationVKey.
|
|
|
|
## Security-review carry-through
|
|
No CRITICAL/HIGH. M1 (reputation write gate) fixed, L1 x3 (code-less-gateway guard) fixed in
|
|
AerePQAggregateVerifier/AereComputeMarketV3/AereBitstringStatusList, L2 (vector-store receipt-provider bind)
|
|
fixed, L3 (AP2 open-path replay) documented as accepted risk closed by the executor gate.
|