baofinance · rootminus0x1 · Mar 27, 2026 · Mar 30, 2026 · Mar 30, 2026 · Mar 30, 2026
diff --git a/.claude/settings.json b/.claude/settings.json
@@ -2,7 +2,20 @@
   "permissions": {
     "allow": [
       "Bash(grep:*)",
-      "Bash(git log:*)"
+      "Bash(git log:*)",
+      "Bash(forge coverage:*)",
+      "Bash(yarn sizes:*)",
+      "WebSearch",
+      "WebFetch(domain:fxprotocol.gitbook.io)",
+      "WebFetch(domain:www.openzeppelin.com)",
+      "Read(~/.claude/plans/**)",
+      "Bash(git -C ~/.claude/plans commit -am )",
+      "Bash(yarn slither:*)",
+      "WebFetch(domain:github.com)",
+      "WebFetch(domain:docs.liquity.org)",
+      "WebFetch(domain:www.liquity.org)",
+      "WebFetch(domain:raw.githubusercontent.com)",
+      "WebFetch(domain:liquity.gitbook.io)"
     ]
   }
 }
diff --git a/.claude/settings.local.json b/.claude/settings.local.json
diff --git a/.github/workflows/CI-test-foundry-stable.yml b/.github/workflows/CI-test-foundry-stable.yml
@@ -16,6 +16,8 @@ env:
 jobs:
   test_foundry_os:
     strategy:
+      max-parallel: 1
+      fail-fast: false # ensure all jobs run even if one fails
       matrix:
         include:
           - os: ubuntu-latest
@@ -27,20 +29,14 @@ jobs:
           # - os: windows-latest
           #   foundry: stable
 
-      fail-fast: false # ensure all jobs run even if one fails
-
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout repository with submodules
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           submodules: recursive
           fetch-depth: 0
 
-      - name: Verify audited sources unchanged
-        shell: bash
-        run: lib/bao-base/bin/verify-audit audit-2025-07
-
       - name: Run Bao-base CI actions
         uses: ./lib/bao-base/.github/actions/test-foundry
         with:

diff --git a/.gitignore b/.gitignore
@@ -2,7 +2,6 @@
 .env
 
 # put your personal stuff in your personal vscode settings file
-.vscode/settings.json
 
 # libraries
 node_modules
@@ -11,6 +10,9 @@ venv
 # wake
 .wake/
 
+# claude
+.claude/settings.local.json
+
 # generated files
 cache/
 out/
@@ -54,4 +56,9 @@ docs/
 *.log
 
 # temp or prliminary files
-*.*-
+*.*-
+.wake
+pytypes
+*.py[cod]
+.hypothesis/
+wake-coverage.cov
diff --git a/.gitmodules b/.gitmodules
@@ -10,9 +10,10 @@
 [submodule "lib/forge-std"]
 	path = lib/forge-std
 	url = https://github.com/foundry-rs/forge-std
-[submodule "lib/bao-base"]
-	path = lib/bao-base
-	url = https://github.com/baofinance/bao-base
 [submodule "lib/chainlink-brownie-contracts"]
 	path = lib/chainlink-brownie-contracts
 	url = https://github.com/smartcontractkit/chainlink-brownie-contracts
+[submodule "lib/bao-base"]
+	path = lib/bao-base
+	url = https://github.com/baofinance/bao-base
+	branch = main
diff --git a/.solhintignore b/.solhintignore
@@ -1,3 +1,3 @@
 src/util/WordCodec.sol
 *_v1.sol
-src/minter/PostRebalanceRemediationForStabilityPool_v2.sol
+script/verify/spl-remediation/PostRebalanceRemediationForStabilityPool_v2.sol
diff --git a/.validate-ignore b/.validate-ignore
@@ -0,0 +1,32 @@
+# Syntax: check file
+# Supported checks: naming, pragma, storage, upgrades, base-imports, relative-imports
+
+# These contracts predate the filename=contract-name convention. The class
+# names intentionally omit the _v2 suffix (they are abstract bases, not
+# deployed contracts) while the files carry _v2 to distinguish from v1.
+naming src/reward/accumulator/MultipleRewardCompoundingAccumulator_v2.sol
+naming src/reward/distributor/LinearMultipleRewardDistributor_v2.sol
+
+# Deployed contracts that predate the remapped-import convention.
+# Their source files cannot be modified (audit traceability).
+bare-imports src/reward/accumulator/MultipleRewardCompoundingAccumulator.sol
+bare-imports src/reward/accumulator/MultipleRewardCompoundingAccumulator_v2.sol
+bare-imports src/reward/distributor/LinearMultipleRewardDistributor.sol
+bare-imports src/reward/distributor/LinearMultipleRewardDistributor_v2.sol
+bare-imports src/minter/StabilityPoolManager_v1.sol
+bare-imports src/minter/library/ConfigIncentiveLib.sol
+bare-imports src/minter/library/Config_v1.sol
+bare-imports src/minter/ReservePool_v1.sol
+bare-imports src/minter/StabilityPool_v1.sol
+bare-imports src/minter/StabilityPool_v2.sol
+bare-imports src/minter/TokenDistributor_v1.sol
+bare-imports src/minter/Minter_v1.sol
+bare-imports src/minter/Minter_v2.sol
+bare-imports src/minter/Genesis_v1.sol
+
+# Deployed contracts and interfaces transitively imported by them —
+# cannot be modified (audit traceability).
+relative-imports src/reward/distributor/LinearMultipleRewardDistributor.sol
+relative-imports src/reward/distributor/LinearMultipleRewardDistributor_v2.sol
+relative-imports src/interfaces/IPriceOracle.sol
+relative-imports src/interfaces/IWrappedPriceOracle.sol
diff --git a/.verify-audit-ignore b/.verify-audit-ignore
@@ -0,0 +1,9 @@
+# Syntax: tag [file1 file2 ...]
+#   tag alone        — ignore the whole tag
+#   tag file1 file2  — ignore specific files within the tag only
+
+# deploy/harbor-1.2: PostRebalanceRemediationForStabilityPool_v2.sol was a one-shot
+# upgrade implementation. After remediation, the proxy was upgraded back to
+# StabilityPool_v2. The source now lives in script/verify/spl-remediation/ alongside
+# the remediation tests and docs.
+deploy/harbor-1.2 src/minter/PostRebalanceRemediationForStabilityPool_v2.sol
diff --git a/.vscode/settings.json b/.vscode/settings.json
@@ -0,0 +1,17 @@
+{
+  "[python]": {
+    "editor.defaultFormatter": "charliermarsh.ruff",
+    "editor.tabSize": 4, // as per PEP 8 standard
+    "editor.formatOnSave": true,
+    // "editor.codeActionsOnSave": {
+    //   "source.organizeImports": "explicit"
+    // }
+  },
+  "ruff.interpreter": [
+    "./we-need-a-self-loading-wrapper-for/python"
+  ],
+  "ruff.path": [
+    "lib/bao-base/bin/ruff"
+  ],
+  "ruff.configuration": "pyproject.toml"
+}
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -1,5 +1,3 @@
 # CLAUDE.md
 
-- Do not create functions that are only called once. Inline the logic instead.
-- When diagnosing an issue, do not use words like "likely", "probably", or "may" to describe a root cause. Either verify the hypothesis with data (dry run, log, trace) or state explicitly that it is unverified. Never proceed with a fix based on an unverified hypothesis.
-- use forge install/remove for managing submodule dependencies
+@./lib/bao-base/CLAUDE.md
diff --git a/EXECUTIVE_SUMMARY.md b/EXECUTIVE_SUMMARY.md