Price Feed Resilience: Prepare PRICE v1.2 deployment and oracle proposal simulation

.claude/commands/update-emergency-config.md

@@ -101,6 +101,7 @@ Analyze the contract source in this order. Stop at the first match:
 - Owner: **ask user**
 - For each arg: determine if a static value can be inferred from context
     - If any arg is dynamic (can't determine a static value from the source), flag to user and ask how to resolve
+- **statusCheck detection:** If the shutdown call goes through a proxy/policy to affect a different module (e.g., `Emergency.shutdownMinting()` affects `MINTR`), a `statusCheck` is needed. Read the shutdown function's implementation to find which module it modifies, then find the view function on that module that reflects the state change. Add a `statusCheck` pointing to the target module.
 
 ##### Level 5 — None of the above
 
@@ -171,6 +172,12 @@ Before asking the user, **generate suggested values** for all metadata fields by
 
 6. **Dependencies** (optional): Other component IDs that should be shutdown together — check if any existing components reference related contracts
 
+7. **statusCheck** (optional): Determine if a `statusCheck` is needed. A `statusCheck` is needed when the contract being called for shutdown is NOT the same contract whose state you'd read to verify the shutdown worked.
+   - For PolicyEnabler/PeripheryEnabler contracts: **NOT needed** (`isEnabled()` lives on the same contract)
+   - For components that call through a proxy/policy to affect a different module: **NEEDED** (e.g., `Emergency.shutdownMinting()` affects `MINTR`, so status should be read from `OlympusMinter.active()`)
+   - When needed, read the shutdown function's implementation to find which module it modifies, then find the view function on that module that reflects the state change
+   - Include `contractKey`, `abi`, `functionName`, and `trueIsShutdown` (whether `true` return means shut down)
+
 **Step 2: Present all suggestions to the user for confirmation:**
 
 Use AskUserQuestion to present the generated values. Format the suggestions clearly so the user can approve, modify, or skip each one. For example:
@@ -233,13 +240,20 @@ Suggest a short, descriptive kebab-case component ID for the contract and confir
       "abi": "<matched abi key>"
     }
   ],
+  "statusCheck": {
+    "contractKey": "<module env key, if needed>",
+    "abi": "<abi key for module>",
+    "functionName": "<view function name>",
+    "trueIsShutdown": false
+  },
   "availableOn": ["<chains from env.json>"],
   "postShutdownSteps": ["<from user, if provided>"],
   "dependencies": ["<from user, if provided>"]
 }
 ```
 
 - Omit `shutdownCriteria`, `postShutdownSteps`, `dependencies` only if the user explicitly chose to skip them (the skill should always suggest values first)
+- Omit `statusCheck` when the shutdown target and status check target are the same contract (e.g., PolicyEnabler/PeripheryEnabler contracts). Include it when the shutdown action goes through a proxy/policy to affect a different module.
 
 1. Update `version` (bump patch version), `lastUpdated`, and `updatedBy` using `jq`:
 
@@ -294,6 +308,8 @@ Match function signatures to ABI keys in `documentation/emergency/emergency-abis
 | `shutdown(address[])` | `yield_repurchase_facility` |
 | `withdrawLiquidity(uint256)` | `ccip_lock_release_pool` |
 | `emergencyShutdownFixedExpiryMarket(uint256)` | `bond_manager` |
+| `active()` (OlympusMinter status check) | `mintr` |
+| `active()` (OlympusTreasury status check) | `trsry` |
 
 **Disambiguation:** If a function signature matches multiple ABI keys (e.g., `shutdown()` maps to both `emergency` and `emission_manager`; `deactivate()` maps to both `heart` and `reserve_migrator`), determine the correct key by checking which ABI contains the full set of functions used by the contract. If still ambiguous, ask the user.
 

.coderabbit.yaml

@@ -2,3 +2,8 @@ reviews:
     auto_review:
         # Review all branches, not just PRs against the base branch
         base_branches: [".*"]
+    path_instructions:
+        - path: "src/scripts/**/*.sol"
+          instructions: |
+              Solidity files under src/scripts are operational scripts, not deployed contracts.
+              Do not flag require statements, string revert messages, or missing custom errors in this path.

.codex/environments/environment.toml

@@ -0,0 +1,21 @@
+# THIS IS AUTOGENERATED. DO NOT EDIT MANUALLY
+version = 1
+name = "olympus-v3"
+
+[setup]
+script = "pnpm install"
+
+[[actions]]
+name = "lint"
+icon = "tool"
+command = "pnpm run lint"
+
+[[actions]]
+name = "format"
+icon = "tool"
+command = "pnpm run prettier"
+
+[[actions]]
+name = "unit tests"
+icon = "tool"
+command = "pnpm run test:unit"

.github/actions/bootstrap/action.yml

@@ -0,0 +1,30 @@
+name: Bootstrap CI environment
+description: Standardized repository setup for CI.
+
+inputs:
+    install-foundry:
+        description: Install foundry toolchain if required by the project.
+        required: false
+        default: "true"
+
+runs:
+    using: composite
+    steps:
+        - name: Setup Node.js
+          uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+          with:
+              node-version-file: .nvmrc
+
+        - name: Install pnpm
+          uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+
+        - name: Install Foundry
+          if: ${{ inputs.install-foundry == 'true' }}
+          uses: foundry-rs/foundry-toolchain@8789b3e21e6c11b2697f5eb56eddae542f746c10 # v1.7.0
+          with:
+              # Anything higher requires a change to foundry.toml compiler restrictions
+              version: 1.5.1
+
+        - name: Install dependencies
+          run: pnpm install --frozen-lockfile
+          shell: bash

.github/workflows/audit.yml

@@ -0,0 +1,30 @@
+name: Dependency Audit
+
+on:
+    pull_request:
+    workflow_dispatch:
+
+permissions:
+    contents: read
+    pull-requests: write
+
+jobs:
+    audit:
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              with:
+                  persist-credentials: false
+
+            - name: Bootstrap
+              uses: ./.github/actions/bootstrap
+
+            - name: Audit pnpm dependencies (fail on moderate+)
+              uses: JamesRobertWiseman/pnpm-audit@a6a8cc297d146014c029926e49d43571e776f85e # v3.2.0
+              with:
+                  package_json_path: ./
+                  github_token: ${{ secrets.GITHUB_TOKEN }}
+                  level: moderate
+                  fails: true
+                  single_comment: true

.github/workflows/coverage.yml

@@ -5,50 +5,40 @@ on:
             - master
     pull_request:
 
+permissions:
+    contents: read
+
 jobs:
-    run-ci:
+    coverage:
         runs-on: ubuntu-latest
 
         steps:
-            - uses: actions/checkout@v4
-              with:
-                  submodules: recursive
-
-            - uses: actions/setup-node@v4
-              with:
-                  node-version: 20
-
-            - uses: pnpm/action-setup@v2
-              with:
-                  version: 9
-
-            - name: Install Foundry
-              uses: foundry-rs/foundry-toolchain@v1
+            - name: Checkout
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
-                  version: 1.5.1
+                  persist-credentials: false
 
-            - name: Install dependencies
-              run: pnpm install --frozen-lockfile
+            - name: Bootstrap
+              uses: ./.github/actions/bootstrap
 
             - name: Build
               run: pnpm run build
 
-            # FYI: currently version 1.14
             - name: Setup lcov
-              uses: hrishikesh-kadam/setup-lcov@v1
+              uses: hrishikesh-kadam/setup-lcov@6c1aa0cc9e1c02f9f58f01ac599f1064ccc83470 # v1
 
             - name: Run Code Coverage
               run: pnpm run test:coverage
 
             - name: Add Artifacts
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
               with:
                   name: lcov.info
                   path: lcov.info
 
             # This action runs genhtml (which gives an error), but does not support providing arguments to ignore the error
             # - name: Report Code Coverage
-            #   uses: zgosalvez/github-actions-report-lcov@v3
+            #   uses: zgosalvez/github-actions-report-lcov@5aba2ff56b3dd258ec9916d3b5049dc5994db23e # v7.0.9
             #   with:
             #       coverage-files: lcov.info
             #       github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/lint.yml

@@ -5,30 +5,27 @@ on:
             - master
     pull_request:
 
+permissions:
+    contents: read
+
 jobs:
-    run-ci:
+    lint:
         runs-on: ubuntu-latest
 
         steps:
-            - uses: actions/checkout@v4
+            - name: Checkout
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
-                  submodules: recursive
+                  persist-credentials: false
 
-            - uses: actions/setup-node@v4
-              with:
-                  node-version: 20
+            - name: Bootstrap
+              uses: ./.github/actions/bootstrap
 
-            - uses: pnpm/action-setup@v2
+            - name: Run forge lint inline annotations
+              uses: 0xJem/forge-lint-inline-action@7f2d23ba91fe2839c0e16034869f4881d3fd2d41 # v0.1.0
               with:
-                  version: 9
-
-            - name: Install Foundry
-              uses: foundry-rs/foundry-toolchain@v1
-              with:
-                  version: 1.5.1
-
-            - name: Install Node dependencies
-              run: pnpm install --frozen-lockfile
+                  install-foundry: false
+                  fail-level: error
 
             - name: Run lint check
               run: pnpm run lint:check

.github/workflows/size.yml

@@ -5,30 +5,21 @@ on:
             - master
     pull_request:
 
+permissions:
+    contents: read
+
 jobs:
-    run-ci:
+    size-check:
         runs-on: ubuntu-latest
 
         steps:
-            - uses: actions/checkout@v4
-              with:
-                  submodules: recursive
-
-            - uses: actions/setup-node@v4
-              with:
-                  node-version: 20
-
-            - uses: pnpm/action-setup@v2
-              with:
-                  version: 9
-
-            - name: Install Foundry
-              uses: foundry-rs/foundry-toolchain@v1
+            - name: Checkout
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
-                  version: 1.5.1
+                  persist-credentials: false
 
-            - name: Install dependencies
-              run: pnpm install --frozen-lockfile
+            - name: Bootstrap
+              uses: ./.github/actions/bootstrap
 
             # Build will fail if a contract is over the size limit
             - name: Contract Size

.github/workflows/tests-crosschain.yml

@@ -5,30 +5,21 @@ on:
             - master
     pull_request:
 
+permissions:
+    contents: read
+
 jobs:
-    run-ci:
+    crosschain-tests:
         runs-on: ubuntu-latest
 
         steps:
-            - uses: actions/checkout@v4
-              with:
-                  submodules: recursive
-
-            - uses: actions/setup-node@v4
-              with:
-                  node-version: 20
-
-            - uses: pnpm/action-setup@v2
-              with:
-                  version: 9
-
-            - name: Install Foundry
-              uses: foundry-rs/foundry-toolchain@v1
+            - name: Checkout
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
-                  version: 1.5.1
+                  persist-credentials: false
 
-            - name: Install dependencies
-              run: pnpm install --frozen-lockfile
+            - name: Bootstrap
+              uses: ./.github/actions/bootstrap
 
             - name: Build
               run: pnpm run build

.github/workflows/tests-fork.yml

@@ -5,8 +5,11 @@ on:
             - master
     pull_request:
 
+permissions:
+    contents: read
+
 jobs:
-    run-ci:
+    fork-tests:
         name: Fork tests - ${{ matrix.shard.name }}
         runs-on: ubuntu-latest
         strategy:
@@ -23,25 +26,13 @@ jobs:
                       script: test:fork:misc
 
         steps:
-            - uses: actions/checkout@v4
-              with:
-                  submodules: recursive
-
-            - uses: actions/setup-node@v4
-              with:
-                  node-version: 20
-
-            - uses: pnpm/action-setup@v2
-              with:
-                  version: 9
-
-            - name: Install Foundry
-              uses: foundry-rs/foundry-toolchain@v1
+            - name: Checkout
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
-                  version: 1.5.1
+                  persist-credentials: false
 
-            - name: Install dependencies
-              run: pnpm install --frozen-lockfile
+            - name: Bootstrap
+              uses: ./.github/actions/bootstrap
 
             - name: Build
               run: pnpm run build