docs: refresh README for 12 PRs of drift since #146 - #189
Merged
Merged
Conversation
The README was last updated at #146 (2026-05-01). Twelve PRs have landed since — TaskManager v2..v7, ZK Email role invitations (#170), the protocol security audit (#185), paymaster autowhitelisting, the eligibility lockdown (#167) and the cashout full-fill pin (#150). Corrections (all verified against HEAD): - src/ is ~21K LOC / 50+ suites, not ~17K / 40+ - PaymasterHub deploys behind a BeaconProxy off PoaManager, NOT via UUPS - LOC figures for PaymasterHub (1633), PasskeyAccount (711), the factory (379) - src/cashout is one Base-only singleton for a personal USDC->fiat off-ramp, not per-org "treasury exits" - ModulesFactory also deploys ZkEmailInvites (and EducationHub is optional) - Slither also excludes src/zkemail/vendor and CashOutRelay via filter_paths - src/libs list completed (3 paymaster libs, TaskPerm, RoleResolver, ...) New sections: - Task Management — the saturated 8-flag TaskPerm mask, the per-project-mask- replaces-global gotcha, lifecycle diagram, deadlines/takeover/unclaimTask, folders CAS, and the selector-change + silent-bit-grant upgrade traps - Role Invitations via ZK Email — claim flow, the four-gate trust model, the Poseidon-vs-keccak DKIM keying trap, and register-before-initialize - Cash-Out (ZKP2P Off-Ramp) Also: ZkEmailInvites/EligibilityModule/ToggleModule added to the org-layer table and architecture diagram; Access Control rewritten around the three eligibility paths and the superAdmin lockdown; a 2026-07 audit subsection (including the do-not-re-add TargetSelf note); subgraph event-emission rules; and the 7 docs missing from the Documentation Index. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The README was last substantively updated at #146 (2026-05-01); twelve PRs have landed since, so this rewrites it against HEAD — every claim, path, and number re-verified in code rather than in PR descriptions.
Corrections:
src/is ~21K LOC / 50+ suites (not ~17K / 40+); PaymasterHub deploys behind a BeaconProxy off PoaManager, not via UUPS despite inheritingUUPSUpgradeable; stale LOC figures for PaymasterHub/PasskeyAccount/the factory;src/cashoutis one Base-only singleton for a personal USDC→fiat off-ramp, not per-org "treasury exits"; ModulesFactory also deploys ZkEmailInvites; Slither also excludessrc/zkemail/vendorandCashOutRelay.solviafilter_paths; and thesrc/libsinventory was missing three paymaster libraries plusTaskPerm/RoleResolver.New sections: Task Management (the now-saturated 8-flag
TaskPermmask, the per-project-mask-replaces-global gotcha, lifecycle diagram, deadlines / expired-claim takeover /unclaimTask, folders CAS, and the two upgrade traps — four changed selectors needing paymaster re-whitelisting, and the silent bit-grant hazard); Role Invitations via ZK Email (#170's subsystem, previously unmentioned: claim flow, four-gate trust model, the Poseidon-vs-keccak DKIM keying trap, register-before-initialize); and Cash-Out (ZKP2P Off-Ramp).Also adds ZkEmailInvites/EligibilityModule/ToggleModule to the org-layer table and architecture diagram, rewrites Access Control around the three eligibility paths and the superAdmin lockdown, adds a 2026-07 audit subsection (including the do-not-re-add
TargetSelfnote), documents the subgraph event-emission rules, and lists the seven docs missing from the Documentation Index.Docs-only — no Solidity touched. All file links resolve, all 24 ToC anchors match their headings, and mermaid blocks were checked for parse-safety.
🤖 Generated with Claude Code