[SaulBuilds]

This re-syncs citrate_sdk/_generated/federation_contract.json to the r1007 federation contract (citrate-federation#579, merged as 7ad590da). That contract is built from the r1007 root book on citrate-chain main, and R1007_GENESIS confirms its genesis 0xcf686345…ba96631.

• CitrateClient, the write-path managers (via pinned_send) and wallet verification now expect the r1007 block 0. They refuse an r1006 node as the wrong network, as they refused r1005 before.
• The block-0 and AA addresses are unchanged (CREATE2). The 28 post-genesis addresses moved.
• The docstrings in client.py, _chain_guard.py and identity/wallet.py, and the LiquidStakingPool message in learning.py, now name r1007.

Red first

• 580cc98 (tests only): tests/test_r1006_network_guard.py expects r1007 and the r1007 TenantHierarchy, forbids r1006 post-genesis addresses, and refuses an r1006 node. 8 cases fail against the committed r1006 artifact.
• 8f34bd7: python3 scripts/sync_contract.py.

Green: pytest 966 passed, 8 skipped. check-contract-drift.sh OK against fed main.

Pre-push: this went through the normal hook, now that citrate-labs#68 (per-job pip venv) is merged. On this push the keyshare-wheel-tripwire job was skipped by the quick budget, not failed. Run in full, #68's self-test shows that job passing locally. GitHub CI runs it in full here.

Release: a PyPI release is needed after merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_019cgBjDQkjCEEZwG1zJNnQi

[BerryManifold]

Automated Codex static review of 8f34bd7d79e21b4d0200a1cf8f71339f9716ebbc is complete. Result: clean; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.

[Matr0xshka]

Automated Codex static review of 8f34bd7d79e21b4d0200a1cf8f71339f9716ebbc is complete. Result: clean; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.

[BerryManifold]

MAC independent reviewer agent, not Codex, not DGX. Reviewed head 8f34bd7.

• Red then green: red 580cc98 (tests/test_r1006_network_guard.py) precedes green 8f34bd7.
• Contract parity: citrate_sdk/_generated/federation_contract.json is byte-identical (cmp) to citrate-federation main 7ad590da's contract/federation-contract.json, the r1007 artifact verified with gen-contract.mjs --check against chain main (fed #579). contract-drift is green.
• No logic change: _chain_guard.py, client.py, identity/wallet.py and learning.py change only docstrings and one error message (r1006 to r1007 wording).
• r1006 refused:
  • The client against an r1006 node raises WrongNetworkError naming both hashes.
  • An r1007 node, upper-cased, passes.
  • The genesis comes from the contract (0xcf686345…6631).
  • A staking deposit with no address in the r1007 book is refused with ConfigurationError.
• CI: green, including the keyshare-wheel-tripwire job on GitHub.

No P1/P2.

[Matr0xshka]

MAC independent reviewer agent, not Codex, not DGX. Reviewed head 8f34bd7.

• Vendored contract: citrate_sdk/_generated/federation_contract.json is byte-identical to citrate-federation main's contract/federation-contract.json at 7ad590d (#579). In my #579 review I checked that file against the r1007 root book: genesis 0xcf686345…6631, all 97 contracts, the deployer and chainAddresses 1b908e56….
• Source: only docstrings and messages change in _chain_guard.py, client.py, wallet.py and learning.py, and the guard reads the vendored genesis.
• r1006 is refused: red commit 580cc98 came first. The client, the managers' write paths and wallet verification each refuse an r1006 node before sending, with the message naming both hashes. An r1007 node passes, case-insensitive, with one block-0 check. A switching r1006-to-r1007 RPC and the explicit-pin and dev-chain escapes are kept. A new test asserts that no r1006 post-genesis address prefix leaks. Retired-contract checks remain for LiquidStakingPool and CitAgentTimelock. TenantHierarchy and DefensePrimeComplianceRegistry are now asserted present, since they are r1007 post-genesis contracts. No assertion was weakened.
• keyshare-wheel-tripwire ran in full on GitHub: job 131555585955, all 8 steps success, none skipped:
  • Run actions/checkout@11d5960
  • Run actions/setup-python@a26af69
  • Run python -m pip install --upgrade pip && pip install -e .
  • Key-share leak tripwire (built wheel)

No P1. CI is green. Approved.