Link Slither baseline issues

[punk6529]

Summary

• create canonical GitHub issues for each open or needs-issue Slither remediation stream
• replace TBD issue placeholders in ops/SLITHER_BASELINE.md with issue links
• add linked issue traceability to the roadmap Slither appendix, test matrix, ADR index, and autonomous run state

Created Issues

• [P0-PAY-008] Bound emergency withdrawals and prove owed-balance invariants #8 P0-PAY-008: emergency withdrawal and payment invariants
• [P0-META-001] Replace dependency-script packed concatenation with collision-safe encoding #9 P0-META-001: dependency-script packed encoding
• [P0-AUTH-002] Replace drop authorization with replay-safe EIP-712 typed data #10 P0-AUTH-002: EIP-712 drop authorization
• [P0-LIB-001] Prove vendored library provenance or replace retained libraries #11 P0-LIB-001: vendored library provenance
• [P0-AUCT-002] Fix auction bidding reentrancy and convert outbid refunds to pull credits #12 P0-AUCT-002: auction bidding reentrancy and outbid refunds
• [P0-CORE-001] Resolve uninitialized mint-accounting state variables #13 P0-CORE-001: uninitialized mint-accounting state
• [P0-RAND-ADR] Decide randomness provider model and retire or contain weak block-based helpers #14 P0-RAND-ADR: randomness provider ADR / weak helper scope
• [P0-INIT-001] Triage and resolve first-party uninitialized-local findings #15 P0-INIT-001: first-party uninitialized-local findings

Important Notes

• This is a roadmap/ops documentation PR only.
• No Solidity, test, CI, or deployment code changes are included.
• Accepted test-only Slither rows intentionally remain issue-free and documented as accepted test-only baseline rows.

Validation

• Slither baseline table check: every Open or Needs Issue row has a github.com/6529-Collections/6529Stream/issues/ link in the Issue column
• rg -n "^#|^##|^###" ops/SLITHER_BASELINE.md ops/ROADMAP.md ops/AUTONOMOUS_RUN.md
• git diff --check
• make check passed with 17 tests and the known existing warnings
• powershell -ExecutionPolicy Bypass -File scripts\check.ps1 passed with 17 tests and the known existing warnings

Summary by CodeRabbit

• Documentation
  • Updated internal project tracking and planning documentation, including autonomous run state, roadmap details, and static analysis baseline requirements with GitHub issue linkage.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: aa15bef7-690b-4789-8f4a-2e3427efb1a3

📥 Commits

Reviewing files that changed from the base of the PR and between 3201bd1 and 7612152.

📒 Files selected for processing (3)

• ops/AUTONOMOUS_RUN.md
• ops/ROADMAP.md
• ops/SLITHER_BASELINE.md

---

📝 Walkthrough

Walkthrough

This PR updates three operational documentation files to track autonomous PR execution progress, establish GitHub issue links for Slither baseline findings, and expand roadmap planning with explicit decision and test matrix entries reflecting protocol prerequisites and coverage requirements.

Changes

Autonomous Execution and Slither Issue Linkage

Layer / File(s)	Summary
Autonomous Run State and PR Queue Progress ops/AUTONOMOUS_RUN.md	Repository state metadata, PR queue table, and decision log are updated to reflect PR #7 merge with final validation details and PR #8 initiation as in-progress with created GitHub issue links for Slither remediation goals and validation checklist items.
Slither Triage Semantics and GitHub Issue Links ops/SLITHER_BASELINE.md, ops/ROADMAP.md	Triage rules and baseline findings table are updated to require canonical GitHub issue links instead of placeholders; "Needs Issue" rule now specifies keeping rows linked to GitHub issues rather than converting them, and roadmap Slither appendix strengthens the requirement for issue links on all Open/Needs Issue findings.
Roadmap Decision and Testing Updates ops/ROADMAP.md	Protocol Decisions table gains Randomness ADR entry with linked issue; High/medium detector summary table is updated with revised detector rows; Test Matrix appendix is expanded with new test coverage rows for EIP-712, ERC-1271, auction reentrancy/refunds, randomness callbacks, metadata encoding, initialization, and curator scenarios; ADR Index adds Randomness entry with issue reference.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• 6529-Collections/6529Stream#7: Main PR updates ops/AUTONOMOUS_RUN.md/ops/ROADMAP.md/ops/SLITHER_BASELINE.md to reflect the merged Slither baseline work from PR #7 and to tighten Open/Needs Issue issue-linking semantics, directly building on the baseline introduced in PR #7.
• 6529-Collections/6529Stream#3: The main PR updates the operational control-plane docs—especially ops/AUTONOMOUS_RUN.md and ops/ROADMAP.md—to advance the PR queue/worklog and Slither issue-link requirements, building directly on the documentation framework added by PR #3.

Poem

🐰 A queue marches on through PR #8,
Where Slither issues find their fate,
Each finding linked, no TBD's in sight,
GitHub issues shining bright! ✨
The roadmap blooms with ADRs true,
From randomness to tests brand new.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Link Slither baseline issues' directly and specifically describes the main objective of the PR: creating GitHub issue links to replace TBD placeholders in the Slither baseline documentation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/slither-issue-links

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[punk6529]

@claude please review this roadmap/ops-only PR for Slither issue traceability. Please focus on whether every open or needs-issue high/medium Slither finding has an appropriate canonical GitHub issue link, whether the grouping is clear enough for future remediation PRs, and whether the roadmap/test-matrix links are accurate. No Solidity, tests, CI, or deployment code changes are included.

[punk6529]

@claude please review the refreshed head 7612152f64248934a9fca991d75a94d89fa9dcd2 for this roadmap/ops-only Slither issue-link PR. The post-open amend only records the PR URL and review ping in ops/AUTONOMOUS_RUN.md; the substantive issue-link scope is unchanged.