A+ pass — closes the four residual-risk items v0.7.x flagged as pre-mainnet blockers and populates the previously empty .agents/ + .codex/ directories.
Added
- Bridge daily caps + rate limits — sliding 24h USD-equivalent volume cap (MAX_DAILY_MINT_USD / MAX_DAILY_PAYOUT_USD) + per-source rate limit on both bridges. Returns HTTP 429 + Retry-After. State is durable across restarts via the existing idempotency directories. +18 bridge unit tests.
- MultisigGuard.sol — minimal m-of-n primitive (strictly-ascending signer dedup, nonce-bumped pre-call for re-entry safety) + 17 Foundry tests + demos/multisig-operator.mjs that transfers SSDC.treasuryVault to a 2-of-3 guard and proves the single-key bypass is closed.
- demos/verify-onchain.mjs — receipt → SetRegistry commitment cross-check + optional upstream STARK verifier call. Closes the doc-only "off-chain handshake" half of the proof-validation gap.
- .agents/ + .codex/ — five harness-neutral runbook prompts: gate-runner, release-prep, security-reviewer, bridge-debugger, onchain-auditor. Codex CLI config + AGENTS.md mirror the same workflows.
- Why-comments on dense Solidity (SetRegistry state-root chaining + Merkle walk, SetPaymentBatch USDT-shaped transfer handling + Merkle inclusion, NAVOracle per-attestation cap + threshold auto-clamp).
Changed
- stack/stateset demo accepts multisig | verify-onchain; completion + gates step updated.
- docs/THREAT_MODEL.md residual-risk numbered list rewritten — items #1, #2, #3 now partial-or-closed with explicit pointers to the new code.
- bridges/README.md env table gains five new variables + new "Limits" section.
Verified
- 5/5 non-chain gates green via ./stack/stateset gates
- 233/233 contract tests green (was 216; +17 MultisigGuardTest)
- 68/68 bridge unit tests green (was 50; +18 limits.test.mjs)
- multisig + verify-onchain demos run end-to-end against fresh anvil