feat(script): 20260729-migrate-governance-to-timelock Safe bundle

[hardyjosh]

Authors the Safe Tx Builder bundle that hands governance to the timelock
on the active chain: grant the authoriser's seven _ADMIN roles to the
timelock, transfer every production receipt vault's ownership Safe ->
timelock, then renounce the Safe's _ADMIN copies — grants first,
renounces last, one atomic MultiSend, so the Safe gives nothing up until
everything it hands over has landed. The Safe keeps its three direct
action roles: day-to-day operations stay un-timelocked, only admin power
moves.

Self-scoping from live state (per-vault owner + per-role holder state
machine): partial prior executions resume cleanly, full completion
refuses with NothingToMigrate, any owner/holder outside {Safe, timelock}
aborts with a typed error. The _ADMIN slice is read from
LibAuthoriserInvariants' master map, not hand-listed.

Post-state: uniform timelock ownership + unchanged authoriser wiring,
full grant map with the timelock as admin holder, Safe stripped of
_ADMIN, Safe identity/threshold unchanged, timelock config unchanged.
Then the governance loop is proven end-to-end on the fork: the Safe
schedules an idempotent admin op through its threshold-gated
execTransaction (n+1 walk, undersigned attempts rejected), the op is
pending-not-ready inside the 48h window, and executes to Done after it —
the exact path every future governance action takes.

run-script.yaml: register the script and add a network choice input
(base/ethereum) so chain-aware authoring scripts dispatch per network;
concurrency group + RPC env extended to match.

Live-fork tests stand up the real timelock at its derived address via the
deploy script, drive the full authoring, and re-derive the expected
bundle independently from pre-run state, asserting the emitted artifact
matches tx-for-tx (7 grants -> 29 transfers -> 7 renounces on Base).

Co-Authored-By: Claude Fable 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01RquYKmoEVSfuVHy8kwn1yT

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ffe2dcfd-b33f-4f13-af6e-0e5ad1bc6aa2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hardyjosh]

• pin(timelock): hydrate the permissionless governance timelocks #303
• feat(timelock): permissionless execution #302
• feat(timelock): migrate the upgrade beacons under the timelock too #290
• docs: governance timelock runbook #288
• feat(invariants): governance-timelock migration-window forcing functions #287
• feat(script): 20260729-migrate-governance-to-timelock Safe bundle #286 👈 (View in Graphite)
• feat(script): 20260729-deploy-governance-timelock broadcast #285
• feat(lib): LibTimelockInvariants + authoriser grant-map admin-holder parameterisation #284
• ops(script): HyperEVM token deploy (RAI-1511) #278 : 1 other dependent PR (#291 )
• pin(invariants): HyperEVM invariant surface (RAI-1511) #277
• ops(script): HyperEVM beacon-owner migration + 0.1.1 beacon lib generalisation (RAI-1511) #276
• feat(multichain): HyperEVM token-owner Safe pin plumbing (RAI-1511) #275
• feat(multichain): HyperEVM V4 authoriser clone pin plumbing (RAI-1511) #274
• feat(authoriser): additional service signer — canonical pin + provisioning #280
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[thedavidmeister]

Reviewed 766f75f: ship — the migration Safe-bundle authoring script: simulation-only (never broadcasts; the CI key signs nothing), full live pre-flight with typed refusals (unpinned/zero timelock, codehash drift, missing operational grants, unknown vault owner), self-scoping selection from live chain state, atomic grants→transfers→renounces ordering, post-state asserting the Safe retains no _ADMIN, the end-to-end governance-loop proof through the Safe threshold gate, and the HyperEVM authoring wiring (dispatcher network + RPC). All repo CI green, no unresolved review threads.
Rulings-conformance: checked against every ruling stated for this work and the repo CLAUDE.md. (1) "zero is a checked case" — obeyed: the script refuses a zero pin with typed TimelockNotPinned before authoring anything. (2) "timelock code needs to be a constant" — obeyed: all timelock resolution goes through the frozen-pin lib now in main; assertTimelockState asserts the pinned literal codehash against the live instance in pre-flight. (3) no-brick assurances — the governance-loop proof in this layer is the authoring-time gate; the signer-side verify(string) rides the stack tip (#290) by explicit decision ("ok leave it"), since it must byte-match the beacon-inclusive final bundle. (4) merge ordering — retargeted to main on instruction; three-way merge is clean and main-side newer versions of the deploy-layer files prevail uncontested. (5) CLAUDE.md pragma/naming/single-profile rulings — obeyed; no deployed contract source changes, no pointer or CHANGELOG obligations.