docs/access-control-audit.md is a "function-by-function audit of every public entrypoint across the three contracts" — but it was written for #30, which closed before #56/#57/#58 (which added extend_deadline, keep_alive, contribute, and get_contribution to escrow and milestones) landed. None of these four functions appear in the audit's per-contract tables. A new contributor reading this doc for "what's the access model for every entrypoint" would miss that these exist at all, let alone whether their access control matches intent (worth double-checking too, e.g. keep_alive's deliberately-no-auth design isn't captured anywhere in this audit framework). Worth a refresh pass adding rows for all four.
docs/access-control-audit.mdis a "function-by-function audit of every public entrypoint across the three contracts" — but it was written for #30, which closed before #56/#57/#58 (which addedextend_deadline,keep_alive,contribute, andget_contributionto escrow and milestones) landed. None of these four functions appear in the audit's per-contract tables. A new contributor reading this doc for "what's the access model for every entrypoint" would miss that these exist at all, let alone whether their access control matches intent (worth double-checking too, e.g.keep_alive's deliberately-no-auth design isn't captured anywhere in this audit framework). Worth a refresh pass adding rows for all four.