DRAFT / DO NOT MERGE — AIP-14b dispute system CI/audit gate validation only

.env.example

@@ -0,0 +1,123 @@
+# =============================================================================
+# actp-kernel — .env.example  (SECRET-FREE TEMPLATE — placeholders only)
+# =============================================================================
+# Copy to .env and fill in. NEVER commit a real .env (it is gitignored).
+# NEVER put a private key in any tracked file. On mainnet, admin actions are
+# submitted via the Gnosis Safe (2-of-3), not a raw deployer key.
+# -----------------------------------------------------------------------------
+
+# --- Deployer (deploy-only hot wallet; testnet / dry-run) --------------------
+# Used by forge scripts that broadcast. For mainnet prefer a throwaway deploy
+# key whose ONLY power is contract creation; all admin authority lives in the Safe.
+PRIVATE_KEY=0xYOUR_DEPLOYER_PRIVATE_KEY
+
+# --- RPC endpoints -----------------------------------------------------------
+BASE_SEPOLIA_RPC=https://sepolia.base.org
+# Base Mainnet RPC — REQUIRED for the AIP-14b UMA Tier-2 fork test (P4-5), since
+# Base Sepolia has NO UMA OOV3 (G2 probe 2026-06-21). Use your own gateway key.
+BASE_MAINNET_RPC=https://YOUR_BASE_MAINNET_GATEWAY
+
+# --- Verification ------------------------------------------------------------
+BASESCAN_API_KEY=
+
+# --- Core kernel deploy params (DeployKernel / DeployBaseSepolia / Mainnet) ---
+KERNEL_ADMIN=0xYOUR_ADMIN_OR_SAFE_ADDRESS
+KERNEL_PAUSER=0xYOUR_PAUSER_ADDRESS_OR_BLANK_FOR_ADMIN
+KERNEL_FEE_RECIPIENT=0xYOUR_FEE_RECIPIENT_ADDRESS
+TREASURY_ADDRESS=0xYOUR_TREASURY_ADDRESS
+ARCHIVE_UPLOADER=0xYOUR_ARCHIVE_UPLOADER_OR_BLANK_FOR_SAFE
+USDC_ADDRESS=0xYOUR_USDC_ADDRESS
+MOCK_USDC_ADDRESS=0x444b4e1A65949AB2ac75979D5d0166Eb7A248Ccb
+
+# recoveryGrace (F-6 6-arg ACTPKernel constructor). MUST be >= MIN_RECOVERY_GRACE
+# (1 hour). Convention: mainnet = 7 days (604800), testnet = 1 hour (3600).
+RECOVERY_GRACE=604800
+
+# =============================================================================
+# AIP-14b — Three-Tier Dispute System (P4-0 / P4-1 / P4-5)
+# Ref: DISPUTE SYSTEM/PRD-dispute-system-implementation.md §7.4, §8.4, §8.6, §11
+# Address slots live in deployments/aip14b.json (null until P4-1 broadcasts).
+# =============================================================================
+
+# --- Dispute deploy admin (BondEscalation.admin; evaluator-registry governor) -
+# Testnet: typically the deployer EOA. Mainnet: the Gnosis Safe (Safe-submitted).
+DISPUTE_ADMIN=0xYOUR_DISPUTE_ADMIN_OR_SAFE_ADDRESS
+
+# --- Evaluator registry (BondEscalation constructor, §4.6) -------------------
+# Two FIXED evaluator addresses (must be distinct from each other and from the
+# rotating pool — constructor enforces MAJOR-1 disjointness) + at least one
+# rotating-pool address. These are the on-chain addresses of the 3-LLM
+# evaluator signers; the private keys live in KMS/keystore, NEVER here.
+EVALUATOR_FIXED_0=0xYOUR_FIXED_EVALUATOR_0_ADDRESS
+EVALUATOR_FIXED_1=0xYOUR_FIXED_EVALUATOR_1_ADDRESS
+# Rotating pool. PREFERRED: a single comma-delimited list (any pool size).
+# P4-4 operational floor: the InitEvaluatorRegistry genesis script REQUIRES >= 3
+# rotating members (defense-in-depth over the contract's >= 1). At least one
+# member SHOULD be a third vendor lineage (D1 / §4.10: e.g. Claude+GPT fixed,
+# Gemini rotating). Addresses are KMS-derived; private keys live in KMS, NEVER here.
+EVALUATOR_ROTATING=0xROTATING_0,0xROTATING_1,0xROTATING_2
+# LEGACY fallback (used only if EVALUATOR_ROTATING is unset): individual vars
+# EVALUATOR_ROTATING_0 .. _7, read in order, stops at the first unset.
+EVALUATOR_ROTATING_0=0xYOUR_ROTATING_EVALUATOR_0_ADDRESS
+EVALUATOR_ROTATING_1=0xYOUR_ROTATING_EVALUATOR_1_ADDRESS
+EVALUATOR_ROTATING_2=0xYOUR_ROTATING_EVALUATOR_2_ADDRESS
+
+# --- Optional dispute-deploy address overrides (read by InitEvaluatorRegistry) -
+# DISPUTE_KERNEL / DISPUTE_USDC override the per-chain defaults so the genesis
+# init can be pointed at a G3 v2 redeploy (kernel) or a custom USDC without
+# editing the script. Leave blank to use the built-in per-chain ground-truth.
+DISPUTE_KERNEL=
+DISPUTE_USDC=
+
+# --- Testnet-only live Tier-2 (DeployDisputeSystem STEP 1.5) -------------------
+# true → the P4-1 deploy script ALSO deploys a MockOOV3 on Sepolia and constructs
+# BondEscalation against it, making Tier-2 (escalateToUMA → mockResolve /
+# mockArmResult+settleAssertion → resolved callbacks) LIVE-drivable on testnet.
+# Needed because the canonical UMA OOV3 has NO code on Base Sepolia (G2 probe
+# 2026-06-21). The mock's resolve surface is PERMISSIONLESS — acceptable only for
+# MockUSDC-denominated testnet value. Preflight hard-reverts on base-mainnet.
+DEPLOY_MOCK_OOV3=false
+
+# --- Dispute-system contract addresses (written back by P4-1; read by P4-5) ---
+# Leave blank until DeployDisputeSystem.s.sol broadcasts and writes aip14b.json.
+COMPOSITE_MEDIATOR_ADDRESS=
+BOND_ESCALATION_ADDRESS=
+
+# --- Kernel/vault the dispute system wires against (G3 redeploy = v2) ---------
+# Per AIP14B-DECISIONS.md G3, P4-2 redeploys kernel+vault as v2. The dispute
+# deploy + UMA fork test read these from env, NOT stale broadcast literals.
+MAINNET_KERNEL_V2=0xYOUR_REDEPLOYED_KERNEL_V2_ADDRESS
+MAINNET_VAULT_V2=0xYOUR_REDEPLOYED_VAULT_V2_ADDRESS
+
+# --- recoveryGrace per chain (F-6) for the dispute deploy ---------------------
+# Mirrors the per-chain values recorded in deployments/aip14b.json.
+RECOVERY_GRACE_MAINNET=604800
+RECOVERY_GRACE_TESTNET=3600
+
+# =============================================================================
+# UMA Tier-2 (Optimistic Oracle V3) — §8.4 / §8.6 / G2 RECON
+# =============================================================================
+# Canonical Base-MAINNET OOV3. Production BondEscalation is deployed with
+# umaOOV3=address(0), which resolves DEFAULT_UMA_OOV3 on-chain; this env var
+# exists for the FORK test + scripts that need the literal. Base Sepolia has NO
+# OOV3 (G2 probe) → forkRequired=true for Tier-2 testnet coverage.
+UMA_OOV3_MAINNET=0x2aBf1Bd76655de80eDB3086114315Eec75AF500c
+# UMA_OOV3_SEPOLIA: ABSENT on Base Sepolia (left blank intentionally — see
+# deployments/aip14b.json base-sepolia.g2Recon). Do NOT invent an address.
+UMA_OOV3_SEPOLIA=
+
+# UMA bond (USDC, 6dp). G2: getMinimumBond(USDC) = $500 = UMA_BOND exactly (at
+# the floor, ZERO margin). Keep adjustable + min-bond drift alert (R6 / OPS P5-4).
+UMA_BOND=500000000
+UMA_LIVENESS=7200
+
+# Fork-mode flag for the UMA Tier-2 test (P4-5). On Sepolia this MUST be true.
+UMA_FORK_REQUIRED=true
+# Block to pin the Base-mainnet fork at (optional; blank = latest).
+UMA_FORK_BLOCK=
+
+# --- Evidence-bundle IPFS pinning (G-IPFS: Pinata, >=35-day retention) --------
+# Escalator self-pins by default (§8.6); these are for the canonical-prompt pin
+# + optional UX bundle pin (AGIRAILS_PINS_USER_BUNDLES defaults false, §7.5.8).
+IPFS_PINNING_PROVIDER=pinata
+PINATA_JWT=