Deterministic authoriser clones everywhere: chain-invariant address, pinned up-front, migrate Base off the nonce-based clone

[thedavidmeister]

Goal (explicit, ruled 2026-08-04)

We hate the placeholder→backfill dance. Killing it is an explicit goal: every authoriser clone is deployed deterministically (cloneDeterministic + salt, rain-factory 0.1.5), at the same chain-invariant address on every chain, pinned up-front in generated pointers — no address(0) placeholders, no post-deploy hydration PRs.

Why the address is chain-invariant

clone = f(impl, keccak(deployer, salt), factory) — verified from 0.1.5 source: init data is NOT in the derivation (atomic initialize after CREATE2), and the salt is deployer-namespaced (unsquattable). Factory and impl are Zoltu-deployed (same address everywhere), so same deployer key + same salt ⇒ same clone address on every chain, even though per-chain init config (paymentToken, owner Safe) differs.

Two steps (the user's shape — artifacts map 1:1)

Step 1 — deploy deterministic authorisers: PR #250, complete in one PR. rain-factory 0.1.5 (+ forced rain-vats 0.1.7) bump, clone()→cloneDeterministic fixture migration, nonce-factory pin (bytecode-complete per #293), AND the dated cloneDeterministic deploy script for every chain with prod config (Base + Ethereum; the HyperEVM wave — #274/#276/#278 — rescopes to deploy deterministically from the start and never needs migration), with the predicted address pinned as a migration-target constant per the #293 shape (address + EIP-1167 runtime bytecode + codehash + offline predicted==pinned and keccak asserts). Live pins (STOX_PROD_AUTHORISER_V4_CLONE, the Ethereum clone pin) stay untouched. Post-merge: broadcast via the manual dispatch with the deployer key; the deployed clones are inert (initialized, grantless, unreferenced) until step 2.

Step 2 — upgrade to them (the only follow-up):

• Replay live authority onto the deterministic clones: enumerate from RoleGranted/RoleRevoked logs on the nonce clones — never repo greps (issuer DEPOSIT+WITHDRAW per feat(script): grant new issuer DEPOSIT+WITHDRAW on shared authoriser #221, service signer per feat(authoriser): additional service signer — canonical pin + provisioning #280, admin-holders per feat(lib): LibTimelockInvariants + authoriser grant-map admin-holder parameterisation #284).
• Sweep escrowed payment-token balance from the old clones; signer-service cutover in the same window (verified: no EIP-712 domain bound to the clone address — re-verify at migration time).
• Per-vault setAuthorizer Safe bundles (owner-gated, pairing guard) — timelocked choreography after feat(script): 20260729-migrate-governance-to-timelock Safe bundle #286–feat(timelock): migrate the upgrade beacons under the timelock too #290 settles.
• Flip the pins to the deterministic address and demote the nonce-clone pins to bytecode-complete historicals.

History

• RAI-794 chore(deploy): post-Bundle-1 V4 authoriser clone-pin (placeholder) #211 was the placeholder→backfill instance this kills; Deploy the V4 authoriser clone deterministically via Zoltu (pin up-front, retire #211) #248 proposed deterministic-up-front (close-candidate as moot-on-Base — superseded by this ruling); PR feat(deploy): deterministic-clone toolchain + deterministic V4 authoriser deploy capability (#292 step 1) #250 was the original proposal, reworked in place as step 1.
• Hash-only and address-only pins across the repo: embed runtime bytecode on every deployed-artifact pin (ruling from #250) #293 rules pin shape: every deployed-artifact pin embeds runtime bytecode.

[thedavidmeister]

Sequence refinement (ruled 2026-08-04): step 3 splits into 3a deploy / 3b migrate, so the deterministic clones go up immediately after #250 merges and the live-state choreography follows separately.

3a — deploy script PR + broadcast (no governance needed): new dated script calling cloneDeterministic(impl, initData, SALT) on the 0.1.5 factory for Base + Ethereum (the chains with live nonce clones; HyperEVM deploys deterministic directly per step 2 and never needs migration). Pins the predicted address as a NEW migration-target constant — STOX_PROD_AUTHORISER_V4_CLONE stays the live nonce clone until 3b completes. Verified from 0.1.5 source: init data is NOT in the address derivation (f(impl, keccak(deployer, salt), factory), atomic initialize) ⇒ per-chain config differences don't move the address; same deployer key + salt ⇒ one address on all chains; deployer-namespaced salt ⇒ unsquattable. Pin shape per the #293 ruling: address + EIP-1167 runtime bytecode + codehash + offline asserts (predicted == pinned via CREATE2 re-derivation, codehash == keccak(code)). Deployed-but-unmigrated clone is inert: initialized but grantless, no vault points at it.

3b — migration follow-up: grant replay from RoleGranted/RoleRevoked logs, escrow sweep, signer cutover, timelocked per-vault setAuthorizer bundles, THEN flip the pin and demote the nonce-clone pins to bytecode-complete historicals.

[thedavidmeister]

Correction to the previous comment (ruled): 3a is NOT a separate PR — the deterministic deploy capability (dated cloneDeterministic script + migration-target pin, live pins untouched) folds into #250 itself, so post-merge the clones deploy via dispatch immediately and the ONLY follow-up is 3b (migration).