Sovryn Perimeter Delay: core contracts

.env.example

@@ -0,0 +1,54 @@
+# Sovryn Perimeter Fee — deployment inputs for scripts 01–04.
+#
+#   cp .env.example .env && $EDITOR .env && source .env
+#
+# `.env` is gitignored; this template is not. It holds no secrets: the signing
+# key stays in the Foundry keystore and is selected with `--account <name>`.
+#
+# Every variable below is REQUIRED. The scripts read them with vm.envAddress /
+# vm.envUint / vm.envBool, which revert on an absent variable — there are no
+# silent defaults, so a missing input stops the deploy instead of guessing.
+
+# --- RPC -------------------------------------------------------------------
+# foundry.toml exposes rsk_mainnet as "${RSK_MAINNET_RPC}"; the hardhat repos
+# configure the same endpoint for rskSovrynMainnet. Pass it explicitly on every
+# command (--rpc-url $RSK_RPC) rather than relying on a tool default.
+export RSK_RPC=https://mainnet-dev.sovryn.app/rpc
+export RSK_MAINNET_RPC=$RSK_RPC
+# If a run stalls: https://mainnet.sovryn.app is the proven fallback. A stall is
+# not a failed deploy — check the chain before doing anything, and never re-run
+# a deploy script blind.
+
+# Broadcasting waits longer than the default; an RPC hiccup otherwise looks like
+# a dropped transaction when the transaction actually landed.
+export ETH_TIMEOUT=300
+
+# --- Ownership and administration ------------------------------------------
+# All four are the Exchequer Multisig at launch. The vault and controller are
+# deployed owned by the deployer, then handed over via Ownable2Step: the
+# bootstrap scripts queue the transfer and the multisig accepts it separately.
+export EXIT_FEE_VAULT_ADMIN=0x924f5ad34698Fd20c90Fe5D5A8A0abd3b42dc711
+export EXIT_FEE_VAULT_RECIPIENT=0x924f5ad34698Fd20c90Fe5D5A8A0abd3b42dc711
+export EXIT_FEE_CONTROLLER_ADMIN=0x924f5ad34698Fd20c90Fe5D5A8A0abd3b42dc711
+export EXIT_FEE_OPERATIONAL_ADMIN=0x924f5ad34698Fd20c90Fe5D5A8A0abd3b42dc711
+
+# --- Launch rates, in basis points -----------------------------------------
+# 10 bps = 0.10% on each charging surface. The AMM surface is written inactive
+# by the bootstrap and takes no rate: nothing consumes it in this release.
+export PERIMETER_LENDING_LENDER_BPS=10
+export PERIMETER_LENDING_BORROWER_BPS=10
+export PERIMETER_ZERO_WITHDRAW_COLL_BPS=10
+export PERIMETER_ZERO_CLAIM_SURPLUS_BPS=10
+
+# --- Charging switch --------------------------------------------------------
+# The release invariant: deploy disabled. Charging is enabled only after
+# governance executes and every checkpoint is green. Setting this true at
+# deploy time would charge users before the vote.
+export PERIMETER_ENABLE_AT_DEPLOY=false
+
+# --- Filled in mid-deploy ---------------------------------------------------
+# Not knowable up front: script 01 deploys the vault, and script 04 needs its
+# proxy address to wire the controller's fee receiver. Export it after 01 and
+# before 04 — script 04 reverts without it rather than bootstrapping a
+# controller that could never pay a fee anywhere.
+# export EXIT_FEE_VAULT_PROXY=0x...

README.md

@@ -138,18 +138,18 @@ export EXIT_FEE_VAULT_PROXY=<vault proxy from step 1>
 # Rates for the four surfaces that ship ON. All REQUIRED — a missing one reverts
 # the script rather than shipping a rate nobody chose. 0 does NOT mean "skip":
 # the surface is still written, active and free.
-export COLFEE_LENDING_LENDER_BPS=<bps>
-export COLFEE_LENDING_BORROWER_BPS=<bps>
-export COLFEE_ZERO_WITHDRAW_COLL_BPS=<bps>
-export COLFEE_ZERO_CLAIM_SURPLUS_BPS=<bps>
-# SURFACE_AMM_REMOVE_LIQUIDITY has no consumer in this release and takes no env
+export PERIMETER_LENDING_LENDER_BPS=<bps>
+export PERIMETER_LENDING_BORROWER_BPS=<bps>
+export PERIMETER_ZERO_WITHDRAW_COLL_BPS=<bps>
+export PERIMETER_ZERO_CLAIM_SURPLUS_BPS=<bps>
+# PERIMETER_SURFACE_AMM_REMOVE_LIQUIDITY has no consumer in this release and takes no env
 # var: the script writes it as (active=false, 0). Turning it on later is a single
 # setSurfacePolicy call from the owner.
 # MAINNET: keep this false. Enabling at deploy would turn the
 # system on while the deployer EOA still owns the proxies — enable via the governance
 # Safe only after the ownership handoff and the release gates in SIP-0094.
 # =true is for local/test chains only.
-export COLFEE_ENABLE_AT_DEPLOY=false
+export PERIMETER_ENABLE_AT_DEPLOY=false
 forge script script/04_BootstrapController.s.sol \
     --rpc-url $RSK_RPC --broadcast --account deployer \
     --sig "run(uint256)" <chainId>
@@ -259,17 +259,17 @@ The upgrade-safety check deliberately does **not** verify candidate-bytecode-vs-
 
 ## Home-repo integration
 
-Perimeter Fee is consumed by three product repos. Each one copies the `IExitFeeController` interface file into its own tree on a `private/colfee` branch — **no git submodule** (the file-copy approach avoids submodule-pointer churn during private-branch development and audit):
+Perimeter Fee is consumed by three product repos. Each one copies the `IExitFeeController` interface file into its own tree on a `private/perimeter` branch — **no git submodule** (the file-copy approach avoids submodule-pointer churn during private-branch development and audit):
 
 | Home repo                                  | Pragma | Interface copy                                                                                       | Hook location                                                                                       |
 | ------------------------------------------ | ------ | ---------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
-| `Sovryn-smart-contracts`                   | 0.5.17 | `contracts/external/colfee/IExitFeeController.sol` ← copy of `src/interfaces/IExitFeeController.sol` | lending: `LoanTokenLogicShared` · loan/margin: `ModuleCommonFunctionalities` + `LoanClosingsShared` |
+| `Sovryn-smart-contracts`                   | 0.5.17 | `contracts/external/perimeter/IExitFeeController.sol` ← copy of `src/interfaces/IExitFeeController.sol` | lending: `LoanTokenLogicShared` · loan/margin: `ModuleCommonFunctionalities` + `LoanClosingsShared` |
 | `zero-contracts`                           | 0.6.11 | same path ← copy of `src/interfaces/IExitFeeController.sol`                                          | `BorrowerOperations`                                                                                |
 | `oracle-based-amm` _(deferred to Phase 6)_ | 0.4.26 | same path ← copy of `src/interfaces/v0_4/IExitFeeController.sol`                                     | `ConverterBase`                                                                                     |
 
 The 0.5+/0.6+/0.8 range pragma on the unified interface means Sovryn-smart-contracts and zero-contracts copy the same file; only AMM needs the structurally-different `v0_4/` outlier.
 
-When the interface changes here, each home repo re-copies its respective file (with a provenance header pinning the colfee SHA) and runs `tools/check-abi-equivalence.sh` against the colfee source to confirm the v0_4 outlier still matches.
+When the interface changes here, each home repo re-copies its respective file (with a provenance header pinning the perimeter SHA) and runs `tools/check-abi-equivalence.sh` against the perimeter source to confirm the v0_4 outlier still matches.
 
 ---
 
@@ -288,7 +288,7 @@ When the interface changes here, each home repo re-copies its respective file (w
 
 **Phase 1 complete**: shared Perimeter Fee contracts (controller + vault) + interfaces + deploy/upgrade tooling. 99/99 tests passing (95 unit + 4 invariant). ABI-equivalence guard green across four compilers. The local/EOA deploy → finalize → upgrade-safety flow is smoke-tested; production Safe execution requires the Safe-aware artifact-refresh step noted above.
 
-**Next**: Phase 2 (lending hooks in `Sovryn-smart-contracts-colfee`), Phase 3 (loan/margin hooks in same repo), Phase 4 (Zero hooks in `zero-contracts-colfee`). Phase 6 (AMM) deferred until proof gates pass.
+**Next**: Phase 2 (lending hooks in `Sovryn-smart-contracts-perimeter`), Phase 3 (loan/margin hooks in same repo), Phase 4 (Zero hooks in `zero-contracts-perimeter`). Phase 6 (AMM) deferred until proof gates pass.
 
 
 ---