Orchestrator instance deploy script + pinned invariants

[hardyjosh]

Stacked on #314 (the audited 0.1.30 orchestrator-set workflow) — merge that first.

Why

#314 makes the orchestrator singletons deployable, but creating the production orchestrator instance (ST0xOrchestratorBeaconSetDeployer.deploy(owner)) had no sanctioned path. This adds it in the token-deploy pattern: a dated manual-broadcast script that broadcasts as the CI deploy key and lands DEFAULT_ADMIN_ROLE on the chain's token-owner Safe, with the result pinned and asserted the way the token beacons and token instances are.

What

• script/20260818-deploy-orchestrator.s.sol (PENDING, registered in manual-broadcast.yaml, one dispatch per network): pre-flights the audited 0.1.30 closure by codehash, validates the chain's token-owner Safe policy, then calls deploy(safe) and asserts the end state. One divergence from 20260807-deploy-missing-tokens, documented in the NatSpec: there is no owner-gated wiring step (no setAuthorizer analogue), so the Safe is passed straight to deploy(owner) and the deploy key never holds DEFAULT_ADMIN_ROLE at all (asserted). Operational MINT_ROLE/BURN_ROLE grants for the issuance bot's signer stay Safe transactions per the issuance-side onboarding runbook.
• Pins live in LibProdDeployV4 (emitted by BuildPointers beside the authoriser-clone pin) and are aliased by the new LibOrchestratorInvariants; testOrchestratorBeaconPin / testOrchestratorInstancePin re-derive both from the beacon-set deployer pin via the CREATE/RLP derivation, so a drifted literal fails a test. The whole surface is deterministic, so it is pinned up front rather than hydrated from the broadcast:
  • beacon 0xb9DCd744…4613 = the set deployer's CREATE at nonce 1 (CREATE nonce-1 of the 0.1.30 set-deployer);
  • instance 0x3A7387a4…03E2 = the first deploy()'s BeaconProxy, the set deployer's CREATE at nonce 2 — identical on every chain.
    Asserts: beacon reported by the set deployer, beacon impl = the audited 0.1.30 orchestrator, beacon owner = BEACON_INITIAL_OWNER, instance admin = chain Safe, vaultLogicIsExpected() true.
• Drift guards: a live pinned instance ⇒ OrchestratorAlreadyDeployed (re-dispatch refusal, like NoMissingTokens); set-deployer nonce ≠ 2 without code at the pin ⇒ UnexpectedSetDeployerNonce (an unpinned earlier deploy() — resolve manually, never deploy a second instance). The pin, not Deployment-event discovery, is the source of truth — deploy is permissionless and the event is front-runnable (see the interface NatSpec).
• test/script/20260818-deploy-orchestrator.prod.t.sol — live-fork rollout walk per chain (no mocks), with a 2026-10-01 deadline after which a still-pending chain red-lines cron:
  1. closure pending (Ethereum/HyperEVM today) → pins the ClosureNotDeployed refusal + logs the outstanding dispatch;
  2. instance pending (Base today) → drives run() end to end on the fork: instance lands at the pin, Safe 0xe70d…d611 holds admin, deploy key holds nothing, vault-logic lock passes, ERC-1967 beacon slot = pinned beacon;
  3. executed → steady-state instance asserts (the orchestrator analogue of the token-instance prod asserts) + the re-dispatch refusal. Never expires.
• test/script/20260818-deploy-orchestrator.t.sol — every guard and assertDeployLanded failure mode shown to fire without a fork (11 tests).

Verification

• Unit: 15/15 (incl. the nonce-1/nonce-2 pin-derivation tests). Prod fork: 3/3 — all chains assert the closure-pending refusal.
• slither . 0 results; forge fmt --check, reuse lint clean.

Rollout order per chain

1. manual-sol-artifacts-0-1-8 suites in listed order (no-ops on Base) — Deploy workflow for the audited 0.1.30 orchestrator set #314
2. manual-broadcast → 20260818-deploy-orchestrator (this PR)
3. Safe: grant MINT_ROLE/BURN_ROLE to the issuance bot's signer; then the issuance-side preflight/cutover runbook

Flag (not in scope)

The orchestrator beacon's owner is still BEACON_INITIAL_OWNER (0x8E4b…f5b) on Base — it never joined the beacon-owner migration that moved the token beacons to the per-chain Safes. The invariant pins that as current truth; if the beacon should follow the token beacons (or the timelock), that's a separate Safe op + pin flip.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KbsbYN4C4YDa8pu9DdudoX

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 1675b9d3-28a5-49c2-8fd0-5b7b25b56a62

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hardyjosh]

• Fleet upgrade bundle: receipt + receipt-vault beacons to audited 0.1.30 #325
• Cutover bundle: mint/burn to the orchestrator, signer via MINT/BURN #324
• Orchestrator beacon-owner migration to the chain Safe #317
• Orchestrator instance deploy script + pinned invariants #316 👈 (View in Graphite)
• Deploy workflow for the audited 0.1.30 orchestrator set #314
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.