From 878508b9d1b10a880aaae6aa926405a0bb9791c9 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 6 Oct 2026 21:30:47 +0000 Subject: [PATCH 1/2] fix: recognize the pre-release Vault build that holds token #45744 Its runtime hash (1,955 bytes, no heldAgent()) was read from Vault 0x6bdC52c8e262c6D139e618260400614c2Bfe51d7 on Base with ethagent custody --verify --json. Simulations against it match the current build's permissions. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01HG2miyE22qTuug1Quxj7iw --- src/identity/registry/vault.ts | 2 +- src/identity/registry/vault/builds.ts | 25 ++++++++++--------------- test/identity/registry/vault.test.ts | 5 ++++- 3 files changed, 15 insertions(+), 17 deletions(-) diff --git a/src/identity/registry/vault.ts b/src/identity/registry/vault.ts index a6d6918..a9ef447 100644 --- a/src/identity/registry/vault.ts +++ b/src/identity/registry/vault.ts @@ -16,7 +16,7 @@ export type { AssertVaultBytecodeClient, VaultCheckPacing } from './vault/byteco export { CURRENT_VAULT_BUILD, FIRST_COMMITTED_VAULT_BUILD, - PRE_RELEASE_VAULT_BUILD_HASH, + PRE_RELEASE_VAULT_BUILD, knownVaultBuilds, vaultBuildForCode, vaultBuildForHash, diff --git a/src/identity/registry/vault/builds.ts b/src/identity/registry/vault/builds.ts index c954c9d..1069bcf 100644 --- a/src/identity/registry/vault/builds.ts +++ b/src/identity/registry/vault/builds.ts @@ -27,23 +27,18 @@ export const FIRST_COMMITTED_VAULT_BUILD: VaultBuild = { hasHeldAgent: true, } -// A build deployed before the source was committed (1,955 bytes). It behaves like the -// current build except that it has no heldAgent() view. Its full runtime hash starts -// 0xf8f23197; it is filled in from a live read of a deployed Vault running it -// (`ethagent custody --json` prints `build.observedHash`). -export const PRE_RELEASE_VAULT_BUILD_HASH: Hex | undefined = undefined +// A build deployed before the source was committed (1,955 bytes), read from Vault +// 0x6bdC52c8e262c6D139e618260400614c2Bfe51d7 on Base, which holds token #45744. It +// behaves like the current build except that it has no heldAgent() view. +export const PRE_RELEASE_VAULT_BUILD: VaultBuild = { + id: 'pre-release', + label: 'pre-release build, no heldAgent()', + runtimeHash: '0xf8f2319752c7b0a6382ef0d233426d0bd605641e65300a4e1b2ece5479a64c13', + hasHeldAgent: false, +} export function knownVaultBuilds(): VaultBuild[] { - const builds: VaultBuild[] = [CURRENT_VAULT_BUILD, FIRST_COMMITTED_VAULT_BUILD] - if (PRE_RELEASE_VAULT_BUILD_HASH) { - builds.push({ - id: 'pre-release', - label: 'pre-release build, no heldAgent()', - runtimeHash: PRE_RELEASE_VAULT_BUILD_HASH, - hasHeldAgent: false, - }) - } - return builds + return [CURRENT_VAULT_BUILD, FIRST_COMMITTED_VAULT_BUILD, PRE_RELEASE_VAULT_BUILD] } export function vaultBuildForHash(hash: Hex, builds: readonly VaultBuild[] = knownVaultBuilds()): VaultBuild | undefined { diff --git a/test/identity/registry/vault.test.ts b/test/identity/registry/vault.test.ts index 879ffb9..fafe9d2 100644 --- a/test/identity/registry/vault.test.ts +++ b/test/identity/registry/vault.test.ts @@ -466,10 +466,13 @@ test('assertVaultBytecode accepts any known build for an existing Vault but only ) }) -test('the builds table knows the current and first committed builds by runtime hash', () => { +test('the builds table knows the current, first committed, and pre-release builds by runtime hash', () => { assert.equal(vaultBuildForCode(VAULT_RUNTIME_BYTECODE)?.id, 'current') assert.equal(vaultBuildForHash(FIRST_COMMITTED_VAULT_BUILD.runtimeHash)?.id, 'first-committed') assert.equal(FIRST_COMMITTED_VAULT_BUILD.runtimeHash, '0xfea7e898c15b1e72a5a54ec35bdad917dfed8ea3d4bfe078fafa3cf00784cde4') + const preRelease = vaultBuildForHash('0xF8F2319752C7B0A6382EF0D233426D0BD605641E65300A4E1B2ECE5479A64C13') + assert.equal(preRelease?.id, 'pre-release') + assert.equal(preRelease?.hasHeldAgent, false) assert.equal(vaultBuildForHash(('0x' + '11'.repeat(32)) as Hex), undefined) }) From 515f88ae02a0ab8f14d0e054cd17f0ad520afef2 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 6 Oct 2026 21:34:04 +0000 Subject: [PATCH 2/2] docs: describe the pre-release Vault build from its reproduced code Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01HG2miyE22qTuug1Quxj7iw --- src/identity/registry/vault/builds.ts | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/identity/registry/vault/builds.ts b/src/identity/registry/vault/builds.ts index 1069bcf..1da0b1f 100644 --- a/src/identity/registry/vault/builds.ts +++ b/src/identity/registry/vault/builds.ts @@ -28,8 +28,15 @@ export const FIRST_COMMITTED_VAULT_BUILD: VaultBuild = { } // A build deployed before the source was committed (1,955 bytes), read from Vault -// 0x6bdC52c8e262c6D139e618260400614c2Bfe51d7 on Base, which holds token #45744. It -// behaves like the current build except that it has no heldAgent() view. +// 0x6bdC52c8e262c6D139e618260400614c2Bfe51d7 on Base, which holds token #45744. Its +// executable code was reproduced from a reconstructed source with solc 0.8.24 (only +// the metadata hash differs). The owner, operator, and refusal rules match the +// current build, with three differences: +// - no heldAgent() view; +// - no registry or token binding: it accepts any ERC-721 (AlreadyDeposited per +// token, no UnexpectedToken); +// - no operator epoch: approvals survive a withdraw and apply to whoever deposits +// the same token next. export const PRE_RELEASE_VAULT_BUILD: VaultBuild = { id: 'pre-release', label: 'pre-release build, no heldAgent()',