Harden autonomous AgentPool and prepare v4.4 mainnet candidate

.agents/mcp_config.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "agentpool": {
+      "command": "node",
+      "args": [
+        "public/agentpool-mcp.mjs"
+      ],
+      "cwd": "."
+    }
+  }
+}

.env.example

@@ -3,6 +3,10 @@ AGENTPOOL_WALLET_PROFILE=
 AGENTPOOL_CHAIN_ID=84532
 AGENTPOOL_RPC_URL=https://sepolia.base.org
 DEPLOYER_PRIVATE_KEY=
+# Hosted Base Sepolia-only gas sponsor. Store only as a Sites secret.
+# It may send tiny capped test-ETH grants only after a device-signed
+# GAS_REQUEST. Never use a mainnet-funded key.
+AGENTPOOL_V43_GAS_SPONSOR_PRIVATE_KEY=
 # Optional override; defaults to 0.001 test ETH in wei.
 MIN_DEPLOYER_BALANCE_WEI=
 
@@ -59,6 +63,7 @@ V43_GENESIS_TIMESTAMP=
 V431_GENESIS_TIMESTAMP=
 V433_GENESIS_TIMESTAMP=
 V434_GENESIS_TIMESTAMP=
+V435_GENESIS_TIMESTAMP=
 MIN_V43_DEPLOYER_BALANCE_WEI=100000000000000
 
 # Hosted secret used to derive private capability exercises. Store only as a

.env.v44.mainnet.example

@@ -0,0 +1,49 @@
+# AgentPool v4.4 Base mainnet release candidate.
+# Copy to .env.v44.mainnet.local only after every evidence gate is approved.
+# Never commit the local file and never paste DEPLOYER_PRIVATE_KEY into chat.
+
+AGENTPOOL_MAINNET_RPC_URL=https://your-base-mainnet-rpc.example
+AGENTPOOL_V44_TESTNET_RPC_URL=https://sepolia.base.org
+DEPLOYER_PRIVATE_KEY=0xREPLACE_LOCALLY
+MIN_V44_DEPLOYER_BALANCE_WEI=10000000000000000
+
+# Exact clean Git commit containing the audited source and compiled settings.
+V44_SOURCE_COMMIT=0000000000000000000000000000000000000000
+
+# Ignored local copy of mainnet-v44-gates.json containing evidence approvals.
+# Keeping approvals outside the tracked source avoids a circular source hash.
+V44_GATES_FILE=.mainnet-v44-gates.local.json
+
+# Unix timestamp 72 hours to 30 days after deployment.
+V44_GENESIS_TIMESTAMP=0
+
+# The deployment EOA, proposer, and all validators must be different addresses.
+V44_BOOTSTRAP_PROPOSER=0x0000000000000000000000000000000000000000
+V44_VALIDATOR_1=0x0000000000000000000000000000000000000000
+V44_VALIDATOR_2=0x0000000000000000000000000000000000000000
+V44_VALIDATOR_3=0x0000000000000000000000000000000000000000
+
+# Public, non-zero bytes32 identifiers backed by validator-independence evidence.
+V44_VALIDATOR_1_GROUP_ID=0x0000000000000000000000000000000000000000000000000000000000000000
+V44_VALIDATOR_2_GROUP_ID=0x0000000000000000000000000000000000000000000000000000000000000000
+V44_VALIDATOR_3_GROUP_ID=0x0000000000000000000000000000000000000000000000000000000000000000
+
+# Evidence-addressed bootstrap system-improvement catalog. It must contain
+# 24-32 distinct objective tasks. Twenty successful settlements open the
+# ownerless transition; at least four additional tasks provide bounded
+# non-minting redundancy when a worker declines, expires, or fails.
+V44_BOOTSTRAP_ISSUE_ID=0x0000000000000000000000000000000000000000000000000000000000000000
+V44_BOOTSTRAP_OBJECTIVES_FILE=.mainnet-v44-bootstrap-objectives.local.json
+V44_BOOTSTRAP_OBJECTIVES_SHA256=0000000000000000000000000000000000000000000000000000000000000000
+V44_GENESIS_MODULE_HASH=0x0000000000000000000000000000000000000000000000000000000000000000
+V44_GENESIS_MANIFEST_HASH=0x0000000000000000000000000000000000000000000000000000000000000000
+
+# These must equal the whole-file SHA-256 of each non-empty evidenceFile
+# referenced by the approved V44_GATES_FILE. Zero placeholders are rejected.
+V44_GATE_FINAL_SOURCE_REPRODUCIBILITY_SHA256=0000000000000000000000000000000000000000000000000000000000000000
+V44_GATE_INDEPENDENT_SECURITY_REVIEW_SHA256=0000000000000000000000000000000000000000000000000000000000000000
+V44_GATE_PUBLIC_TESTNET_RELIABILITY_SHA256=0000000000000000000000000000000000000000000000000000000000000000
+V44_GATE_VALIDATOR_INDEPENDENCE_SHA256=0000000000000000000000000000000000000000000000000000000000000000
+V44_GATE_ECONOMIC_INVARIANT_REVIEW_SHA256=0000000000000000000000000000000000000000000000000000000000000000
+V44_GATE_DEPLOYER_LEGAL_ASSESSMENT_SHA256=0000000000000000000000000000000000000000000000000000000000000000
+V44_GATE_NAME_AND_SYMBOL_CLEARANCE_SHA256=0000000000000000000000000000000000000000000000000000000000000000

.env.v44.testnet.example

@@ -0,0 +1,29 @@
+# AgentPool v4.4 Base Sepolia campaign deployment.
+# Copy to .env.v44.testnet.local. Never commit private keys.
+
+V44_TESTNET_ONLY_ACK=I_UNDERSTAND_THIS_IS_VALUELESS_BASE_SEPOLIA
+AGENTPOOL_V44_TESTNET_RPC_URL=https://sepolia.base.org
+DEPLOYER_PRIVATE_KEY=0xREPLACE_LOCALLY
+MIN_V44_TESTNET_DEPLOYER_BALANCE_WEI=1000000000000000
+
+# Exact clean Git commit and its generated source evidence.
+V44_SOURCE_COMMIT=0000000000000000000000000000000000000000
+V44_SOURCE_EVIDENCE_FILE=outputs/v44-source-reproducibility.json
+
+# Unix timestamp 72 hours to 30 days after deployment.
+V44_GENESIS_TIMESTAMP=0
+
+# The deployer, proposer, and validators must be five distinct addresses.
+V44_BOOTSTRAP_PROPOSER=0x0000000000000000000000000000000000000000
+V44_VALIDATOR_1=0x0000000000000000000000000000000000000000
+V44_VALIDATOR_2=0x0000000000000000000000000000000000000000
+V44_VALIDATOR_3=0x0000000000000000000000000000000000000000
+V44_VALIDATOR_1_GROUP_ID=0x0000000000000000000000000000000000000000000000000000000000000000
+V44_VALIDATOR_2_GROUP_ID=0x0000000000000000000000000000000000000000000000000000000000000000
+V44_VALIDATOR_3_GROUP_ID=0x0000000000000000000000000000000000000000000000000000000000000000
+
+V44_BOOTSTRAP_ISSUE_ID=0x0000000000000000000000000000000000000000000000000000000000000000
+V44_BOOTSTRAP_OBJECTIVES_FILE=.testnet-v44-bootstrap-objectives.local.json
+V44_BOOTSTRAP_OBJECTIVES_SHA256=0000000000000000000000000000000000000000000000000000000000000000
+V44_GENESIS_MODULE_HASH=0x0000000000000000000000000000000000000000000000000000000000000000
+V44_GENESIS_MANIFEST_HASH=0x0000000000000000000000000000000000000000000000000000000000000000

.github/workflows/ci.yml

@@ -20,5 +20,30 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run contracts:compile
+      - run: npm run evidence:v4.4:source
+      - run: npm run evidence:v4.4:source:verify
+      - run: npm run contracts:rehearse:v4.3:public
+      - run: npm run contracts:rehearse:v4.3.9
+      - run: npm run contracts:rehearse:v4.4:mainnet
+      - run: npm run contracts:rehearse:v4.4:full
       - run: npm run build
       - run: npm test
+
+  security-static:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: "22.13.0"
+          cache: npm
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+      - run: npm ci
+      - run: npm run contracts:compile
+      - run: python -m pip install slither-analyzer==0.11.6
+      - run: solc-select install 0.8.36
+      - run: solc-select use 0.8.36
+      - run: npm run security:slither:v4.4

.gitignore

@@ -32,6 +32,13 @@ yarn-error.log*
 .env*
 !.env.example
 !.env.wallets.example
+!.env.v44.mainnet.example
+!.env.v44.testnet.example
+/.mainnet-v44-gates.local.json
+/.mainnet-v44-bootstrap-objectives.local.json
+/.testnet-v44-bootstrap-objectives.local.json
+/deployments/8453.v44.partial.json
+/deployments/84532.v44.partial.json
 
 # vercel
 .vercel