Add SafeHarbor coverage controls

.wordlist.txt

@@ -1,4 +1,5 @@
 AGPLv
+ABI
 ALM
 Antipatterns
 AutoLine

spell/spell-crafter-mainnet-workflow.md

@@ -131,7 +131,7 @@ Repo: https://github.com/sky-ecosystem/spells-mainnet
   * [ ] Adjust system values, collateral values inside `config.sol`
   * [ ] Ensure every spell variable is declared as public/internal
   * Bug Bounty Registry Updates
-    * [ ] Check that output of `make safeharbor-generate` matches the instructions provided by Governance Facilitators
+    * [ ] Review the approved [SafeHarbor source spreadsheet](https://docs.google.com/spreadsheets/d/1e_KOYOeBGaA5EG3Xqco6lOP_a0zV4Vrm3w5-dqFk00U) and check that output of `make safeharbor-generate` matches the instructions provided by Governance Facilitators
       * [ ] IF no instructions were provided and script produces "no changes", then no further action is required
       * [ ] IF there is a mismatch, crafter should notify Governance Facilitators
       * [ ] IF the scripts outputs a warning indicated by ⚠️ ❗, notify Governance Facilitators
@@ -162,8 +162,9 @@ Repo: https://github.com/sky-ecosystem/spells-mainnet
     * [ ] Sanity checks of the constructor arguments
     * [ ] Sanity checks of all values added/updated by the spell function
     * [ ] End-to-end "happy path" interaction with the module
-  * IF bug bounty updates are present
-    * [ ] Test that all bug bounty registry calls execute successfully
+  * IF SafeHarbor registry updates are present
+    * [ ] SafeHarbor registry updates are exempt from Solidity-side test coverage
+    * [ ] Ensure `scripts/safeharbor` tests cover every supported state-diff operation and snapshot both raw calldata and ABI-decoded calldata
   * [ ] Tests PASS via `make test`
 * [ ] Ensure `DssExecLib` address used in current spell (`libraries` inside `foundry.toml`) matches `dss-exec-lib` [Latest Release Tag](https://github.com/sky-ecosystem/dss-exec-lib/releases/latest)
 * [ ] Push committed content to already opened PR
@@ -232,7 +233,10 @@ Repo: https://github.com/sky-ecosystem/spells-mainnet
   * [ ] Create testnet and cast deployed spell there using `make cast-on-tenderly spell=0x...` command
   * [ ] Check that returned `public explorer url` is publicly accessible (e.g. using incognito browser mode)
   * [ ] IF `cast-on-tenderly` command is executed several times for the same spell, delete all testnets of the same name except the last one
-* [ ] `make safeharbor-generate` returns "no updates" in the testnet environment after spell was cast
+* SafeHarbor registry post-cast reconciliation
+  * [ ] Set `ETH_RPC_URL` to the Tenderly Testnet RPC URL
+  * [ ] Run `make safeharbor-generate` in the Tenderly Testnet environment after the spell is cast
+  * [ ] Ensure it returns "no updates" and no validation warnings (⚠️ ❗)
 * [ ] Archive Spell via `make archive-spell` for the current date (or `make archive-spell date="YYYY-MM-DD"`) using Target Date inside the Exec Doc
 * [ ] Commit & push changes for review
 * [ ] Wait for CI to PASS

spell/spell-reviewer-mainnet-checklist.md

@@ -333,6 +333,11 @@ Repo: https://github.com/sky-ecosystem/spells-mainnet
     * [ ] IF the test needs to run, it MUST NOT have the `skipped` modifier; OTHERWISE, it MUST have the `skipped` modifier
   * [ ] Ensure each spell action has sufficient test coverage
     _List actions for which coverage was checked here_
+    * IF SafeHarbor registry updates are present
+      * [ ] SafeHarbor registry updates are exempt from Solidity-side test coverage
+      * [ ] Review the approved [SafeHarbor source spreadsheet](https://docs.google.com/spreadsheets/d/1e_KOYOeBGaA5EG3Xqco6lOP_a0zV4Vrm3w5-dqFk00U)
+      * [ ] Ensure `scripts/safeharbor` tests cover every supported state-diff operation and snapshot both raw calldata and ABI-decoded calldata
+      * [ ] Verify that the generated SafeHarbor payload exactly matches the payload in the spell
   * [ ] Ensure that any other env variable does not affect execution of the tests (for example, by inspecting the output of `printenv | grep "FOUNDRY_\|DAPP_"`)
   * IF a new module is initialized via the spell, the tests must include
     * [ ] Sanity checks of the constructor arguments
@@ -426,8 +431,8 @@ _Insert your local test logs here_
   * [ ] All actions are executed in the transaction trace
   * [ ] No reverts are present that block execution
   * [ ] No out-of-gas errors are present
-  * [ ] `make safeharbor-generate` against the testnet returns "no updates"
-    * [ ] IF the script outputs a warning indicated by ⚠️ ❗, notify Governance Facilitators
+  * [ ] Set `ETH_RPC_URL` to the Tenderly Testnet RPC URL
+  * [ ] `make safeharbor-generate` against the testnet returns "no updates" and no validation warnings (⚠️ ❗)
 * Archive checks
   * [ ] `make diff-archive-spell` for current date or `make diff-archive-spell date="YYYY-MM-DD"`
   * [ ] Ensure date corresponds to target Exec Doc date