Retire bundle: signer's direct vault roles, after the burn-in

[hardyjosh]

Top of stack: #324 (enable) → #325 (fleet) → #334 (governed beacon set) → this.

The retire half of the enable/retire split: 20260831-retire-direct-signer-roles (run-script registry, per chain) revokes the service signer's direct DEPOSIT/WITHDRAW once the orchestrator has proven itself — closing the parallel burn-in window #324 deliberately opens.

• Burn-in gate (OrchestratorPathNotEnabled): refuses to author unless the orchestrator holds both vault roles AND the signer holds MINT/BURN on it — retirement can never strand a chain without a working mint path.
• Untouched: the signer's CERTIFY and the Safe's break-glass action roles.
• Own deadline 2026-10-15 — two weeks after the enable/fleet deadline, so the burn-in window is honoured by construction rather than by cron pressure.
• Self-scoping, post-sim row-by-row survival check, n+1 proves the Safe can restore the fallback, signer-side verify(), Fireblocks-style post-execution pin lifecycle.

Unit 7/7, prod walk 3/3 (today every chain pins the world/enable-pending refusals).

🤖 Generated with Claude Code

https://claude.ai/code/session_01KbsbYN4C4YDa8pu9DdudoX

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c1915f4c-761d-49ab-b819-afffc9ed7cb7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hardyjosh]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Retire bundle: signer's direct vault roles, after the burn-in #336 👈 (View in Graphite)
• Add the orchestrator beacon to the governed beacon set #334
• Fleet upgrade bundle: receipt + receipt-vault beacons to audited 0.1.30 #325
• Cutover bundle: mint/burn to the orchestrator, signer via MINT/BURN #324
• Orchestrator beacon-owner migration to the chain Safe #317
• Orchestrator instance deploy script + pinned invariants #316
• Deploy workflow for the audited 0.1.30 orchestrator set #314
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.