feat: add dynamic deployment permissions precompile

CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Optional state-backed deployment-permissions precompile at `0xF102`, enabled by
+  `deployAllowlistAdmin` at `deployAllowlistActivationHeight`. The fixed admin can add or remove
+  deployers and reversibly pause enforcement while preserving policy.
+
+### Changed
+
+- Dynamic deployment-permission chains use execution state as the authoritative admission check,
+  including transaction-order updates within a block. Chains without a non-zero admin retain the
+  existing static allowlist and txpool behavior.
+
 ## [0.5.0] - 2026-08-17
 
 ### Added

README.md

@@ -456,7 +456,8 @@ This design ensures safe upgrades for existing networks: contracts that were pre
 
 ### Restricting Contract Deployment
 
-If you want a permissioned chain where only specific EOAs can deploy contracts, configure a deploy allowlist in the chainspec:
+If you want a permissioned chain where only specific accounts can submit top-level deployments,
+configure a deploy allowlist in the chainspec. Without an admin, the list remains static:
 
 ```json
 "config": {
@@ -484,6 +485,30 @@ Operational notes:
 - The allowlist is static and must be changed via a chainspec update.
 - Duplicate entries or the zero address are rejected at startup.
 
+To manage permissions on-chain, configure the deployment-permissions admin:
+
+```json
+"config": {
+  ...,
+  "evolve": {
+    "deployAllowlist": [
+      "0xInitialDeployerAddress"
+    ],
+    "deployAllowlistActivationHeight": 20000000,
+    "deployAllowlistAdmin": "0xAdminProxyOrGovernanceAddress"
+  }
+}
+```
+
+At `deployAllowlistActivationHeight`, `deployAllowlist` becomes the baseline for the state-backed
+precompile at `0x000000000000000000000000000000000000F102`. Enforcement is enabled by default.
+The fixed admin can add or remove deployers and can temporarily disable enforcement; disabling is
+fail-open for top-level deployments and preserves the policy for later re-enablement. An empty
+baseline therefore means deny-all while enabled, not “feature disabled.” Use standard `eth_call`
+for inspection. See the [permissioned EVM guide](docs/guide/permissioned-evm.md) for the interface
+and rollout procedure. Existing networks can opt in only while their configured activation height
+is still in the future; v1 intentionally has no second activation field.
+
 ### Payload Builder Configuration
 
 The payload builder can be configured with:

crates/ev-precompiles/README.md

@@ -1,6 +1,7 @@
 # ev-precompiles
 
-Custom EVM precompiles for Evolve, providing native token supply management functionality.
+Custom EVM precompiles for Evolve, providing native token supply management, proposer control, and
+state-backed deployment permissions.
 
 ## Overview
 
@@ -295,3 +296,30 @@ Invalid ABI data also halts the precompile. None of these emit logs.
 - Compromise of the admin (or AdminProxy owner) is compromise of sequencer selection.
 - `evolve_getNextProposer` is a public read of execution state. It is not registered when the
   precompile is disabled, so ev-node treats method-not-found as "feature off".
+
+## Deployment Permissions Precompile
+
+The optional deployment-permissions precompile is installed at
+`0x000000000000000000000000000000000000f102` when `deployAllowlistAdmin` is configured and
+`deployAllowlistActivationHeight` is reached.
+
+```solidity
+interface IDeployPermissions {
+    function addDeployer(address account) external;
+    function removeDeployer(address account) external;
+    function setEnabled(bool enabled) external;
+    function isDeployerAllowed(address account) external view returns (bool);
+    function isEnabled() external view returns (bool);
+    function deployerCount() external view returns (uint256);
+    function admin() external view returns (address);
+}
+```
+
+The genesis `deployAllowlist` is the baseline. Enforcement is enabled when its state flag is unset,
+so no bootstrap call is required. `setEnabled(false)` allows all top-level deployments without
+discarding membership. Member changes are permitted while disabled and apply when enforcement is
+re-enabled. The active set is capped at 1024 and excludes the zero address.
+
+The admin is fixed by chainspec and should normally be an AdminProxy, multisig, or governance
+contract. Read the interface through standard `eth_call`; no custom RPC is required. See the
+[permissioned EVM guide](../../docs/guide/permissioned-evm.md) for rollout and security details.