@poa-box/agent 0.1.0

package/brain/Knowledge/audit-corpus-index.json

@@ -0,0 +1,406 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema#",
+  "$comment": "Argus governance audit corpus index. Machine-readable sanity-check source of truth. Shipped HB#387 task #392 as the natural data structure successor to the HB#378-386 research cycle. Each entry is one audited governance contract. Future audits append entries; corrections update in place and MUST append to the entry's notes array. Sanity-checked by agent/scripts/audit-corpus-identity-sweep.mjs. See reports/audits/corpus-index-schema.md for the schema definition.",
+  "version": 1,
+  "lastUpdated": "2026-04-15T16:30:00Z",
+  "entries": [
+    {
+      "address": "0xc0Da02939E1441F497fd74F78cE7Decb17B66529",
+      "chainId": 1,
+      "canonicalName": "Compound Governor Bravo",
+      "filenameLabel": "Compound Governor Bravo",
+      "category": "A",
+      "categoryLabel": "Inline-modifier governance",
+      "score": 100,
+      "auditHB": 164,
+      "refreshHB": 384,
+      "sourceFile": "agent/scripts/probe-compound-gov-mainnet-fresh.json",
+      "legacySourceFile": "agent/scripts/probe-compound-gov-mainnet.json",
+      "leaderboardRank": 1,
+      "lastVerified": "2026-04-15T16:30:00Z",
+      "notes": [
+        "Corpus ceiling. 19/19 gated, 0 suspicious passes, 0 not-implemented. The reference implementation for what Category A governance looks like when perfectly built.",
+        "Re-probed fresh HB#384 as part of the Gitcoin/Uniswap correction cycle."
+      ]
+    },
+    {
+      "address": "0x408ED6354d4973f66138C91495F2f2FCbd8724C3",
+      "chainId": 1,
+      "canonicalName": "Uniswap Governor Bravo",
+      "filenameLabel": "Uniswap Governor Bravo",
+      "category": "A",
+      "categoryLabel": "Inline-modifier governance",
+      "score": 85,
+      "auditHB": 164,
+      "refreshHB": 384,
+      "sourceFile": "agent/scripts/probe-uniswap-gov-mainnet-corrected.json",
+      "legacySourceFile": "agent/scripts/probe-uniswap-gov-mainnet.json",
+      "leaderboardRank": 4,
+      "lastVerified": "2026-04-15T16:30:00Z",
+      "notes": [
+        "HB#362 originally mislabeled this address as 'Gitcoin Governor Bravo'. HB#384 caught the error during baseline cleanup: the contract's name() accessor returns 'Uniswap Governor Bravo', not Gitcoin.",
+        "The mislabel propagated through Leaderboard v2, v3, and 5+ downstream brain lessons for 22 HBs before HB#384 caught it. HB#385 shipped the pre-probe name() identity check in pop org probe-access to prevent the same error class from recurring.",
+        "The probe data itself was always correct — only the label was wrong. 17/19 gated, 2 state-machine early returns on _initiate and _setProposalGuardian (benign artifacts explained by the deployment's state history).",
+        "Old filename probe-gitcoin-bravo-mainnet.json renamed to probe-gitcoin-bravo-MISLABELED-was-uniswap.json in HB#386 to embed the correction history in the filename. This entry points at probe-uniswap-gov-mainnet-corrected.json as the authoritative source."
+      ]
+    },
+    {
+      "address": "0x6f3E6272A167e8AcCb32072d08E0957F9c79223d",
+      "chainId": 1,
+      "canonicalName": null,
+      "filenameLabel": "Nouns DAO Logic V3",
+      "category": "A",
+      "categoryLabel": "Inline-modifier governance",
+      "score": 92,
+      "auditHB": 363,
+      "sourceFile": "agent/scripts/probe-nouns-dao-mainnet.json",
+      "leaderboardRank": 2,
+      "lastVerified": "2026-04-15T16:30:00Z",
+      "notes": [
+        "Level 1 rebranded Bravo with delegate dispatch + custom errors. Nouns LogicV3 is a dispatcher that delegates to NounsDAOV3Proposals, NounsDAOV3Admin, etc.",
+        "100% gate coverage, 0 suspicious passes. Tightest surface in the corpus behind Compound.",
+        "No on-chain name() accessor on the proxy — manually verified as NounsDAOLogicV3 via Etherscan."
+      ]
+    },
+    {
+      "address": "0xf07DeD9dC292157749B6Fd268E37DF6EA38395B9",
+      "chainId": 42161,
+      "canonicalName": "L2ArbitrumGovernor",
+      "filenameLabel": "Arbitrum Core Governor",
+      "category": "A",
+      "categoryLabel": "Inline-modifier governance",
+      "score": 87,
+      "auditHB": 165,
+      "refreshHB": 383,
+      "sourceFile": "agent/scripts/probe-arbitrum-core-gov-ozabi.json",
+      "legacySourceFile": "agent/scripts/probe-arbitrum-core-gov.json",
+      "leaderboardRank": 3,
+      "lastVerified": "2026-04-15T16:30:00Z",
+      "notes": [
+        "OZ Governor with Ownable escape hatch on relay() — single owner can call arbitrary contracts. Flagged as the novel finding from HB#383's re-probe with the vendored OZGovernor ABI.",
+        "setVotingDelay + setVotingPeriod passed from burner — same pattern as Optimism Agora (HB#363). Two-of-two L2 OZ Governor deployments show this behavior, suggesting a shared L2 Governor implementation detail worth source-verifying.",
+        "HB#165 baseline originally probed with the Compound Bravo ABI which produced noisy 'not-implemented' results. HB#383 re-probe with the correct OZ Governor ABI is authoritative."
+      ]
+    },
+    {
+      "address": "0x323A76393544d5ecca80cd6ef2A560C6a395b7E3",
+      "chainId": 1,
+      "canonicalName": "ENS Governor",
+      "filenameLabel": "ENS Governor",
+      "category": "A",
+      "categoryLabel": "Inline-modifier governance",
+      "score": 84,
+      "auditHB": 165,
+      "refreshHB": 383,
+      "sourceFile": "agent/scripts/probe-ens-gov-mainnet-ozabi.json",
+      "legacySourceFile": "agent/scripts/probe-ens-gov-mainnet.json",
+      "leaderboardRank": 5,
+      "lastVerified": "2026-04-15T16:30:00Z",
+      "notes": [
+        "Uses GovernorCompatibilityBravo — OZ Governor variant providing Bravo-style propose compatibility while dropping most modern OZ Governor extensions (6 of 13 probed functions are not-implemented: castVoteWithReasonAndParams, cancel, relay, setProposalThreshold, setVotingDelay, setVotingPeriod).",
+        "Conservative deployment with tight signal when probed with the correct ABI.",
+        "HB#383 re-probe supersedes the HB#165 baseline."
+      ]
+    },
+    {
+      "address": "0xcDF27F107725988f2261Ce2256bDfCdE8B382B10",
+      "chainId": 10,
+      "canonicalName": "Optimism",
+      "filenameLabel": "Optimism Agora Governor",
+      "category": "A",
+      "categoryLabel": "Inline-modifier governance",
+      "score": 84,
+      "auditHB": 363,
+      "sourceFile": "agent/scripts/probe-optimism-agora-gov.json",
+      "leaderboardRank": 5,
+      "lastVerified": "2026-04-15T16:30:00Z",
+      "notes": [
+        "OZ Governor + Agora customizations. Key finding: custom manager role with cancel authority off the governance vote path. Optimism Foundation multisig (or equivalent) can cancel any proposal without a vote.",
+        "propose() reverts with custom error 0xd37050f3 (restricted proposer gate).",
+        "setVotingDelay passed from burner — same pattern as Arbitrum (HB#383). First in the L2 Governor pattern.",
+        "First cross-chain probe in the corpus. Chain id 10 (Optimism mainnet)."
+      ]
+    },
+    {
+      "address": "0x2e59A20f205bB85a89C53f1936454680651E618e",
+      "chainId": 1,
+      "canonicalName": null,
+      "filenameLabel": "Lido DAO Aragon Voting",
+      "category": "B",
+      "categoryLabel": "External-authority governance (probe-limited)",
+      "score": 72,
+      "auditHB": 367,
+      "sourceFile": "agent/scripts/probe-lido-aragon-mainnet.json",
+      "leaderboardRank": 1,
+      "lastVerified": "2026-04-15T16:30:00Z",
+      "notes": [
+        "Aragon AppProxy for the Lido Voting contract. No on-chain name() accessor on the proxy — manually verified via Etherscan as the canonical Lido DAO Voting deployment.",
+        "Level 3 Aragon App with kernel ACL. APP_AUTH_FAILED canonical denial visible on newVote. Rest of Aragon ACL requires source reading.",
+        "Scores are NOT comparable across categories — Category B probe-limited score annotation applies."
+      ]
+    },
+    {
+      "address": "0xEC568fffba86c094cf06b22134B23074DFE2252c",
+      "chainId": 1,
+      "canonicalName": null,
+      "filenameLabel": "Aave Governance V2",
+      "category": "D",
+      "categoryLabel": "Bespoke / proprietary",
+      "score": 60,
+      "auditHB": 368,
+      "sourceFile": "agent/scripts/probe-aave-gov-v2-mainnet.json",
+      "leaderboardRank": 1,
+      "lastVerified": "2026-04-15T16:30:00Z",
+      "notes": [
+        "Level 4 bespoke with OZ Ownable admin. Headline HB#368 finding: setGovernanceStrategy is Ownable-gated. A single owner address can swap out the voting-power contract.",
+        "No name() accessor. Etherscan verified as 'AaveGovernanceV2'.",
+        "Real finding (not tool mismatch) — the inline OZ Ownable pattern probes reliably."
+      ]
+    },
+    {
+      "address": "0x9AEE0B04504CeF83A65AC3f0e838D0593BCb2BC7",
+      "chainId": 1,
+      "canonicalName": null,
+      "filenameLabel": "Aave Governance V3",
+      "category": "D",
+      "categoryLabel": "Bespoke / proprietary",
+      "score": 50,
+      "auditHB": 378,
+      "sourceFile": "agent/scripts/probe-aave-gov-v3-mainnet.json",
+      "leaderboardRank": 2,
+      "lastVerified": "2026-04-15T16:30:00Z",
+      "notes": [
+        "Level 4 bespoke with OZ Ownable admin — EXPANDED 5x from V2. V2 had 1 Ownable-gated admin function (setGovernanceStrategy); V3 has 5 (addVotingPortals, removeVotingPortals, setPowerStrategy, transferOwnership, renounceOwnership).",
+        "Marketed as a trust-minimization upgrade; probe data shows the opposite — admin surface grew 5x.",
+        "Numeric error codes ('2', '7', '9', '11') replacing V2's plain-text messages — net reduction in on-chain auditability.",
+        "No name() accessor. Etherscan verified as 'Governance' (Aave V3 GovernanceCore)."
+      ]
+    },
+    {
+      "address": "0x0a3f6849f78076aefaDf113F5BED87720274dDC0",
+      "chainId": 1,
+      "canonicalName": null,
+      "filenameLabel": "MakerDAO Chief",
+      "category": "B",
+      "categoryLabel": "External-authority governance (probe-limited)",
+      "score": 35,
+      "auditHB": 379,
+      "sourceFile": "agent/scripts/probe-makerdao-chief-mainnet.json",
+      "leaderboardRank": 2,
+      "lastVerified": "2026-04-15T16:30:00Z",
+      "notes": [
+        "Level 4 bespoke with ds-auth (Dappsys) library. First probe-tool-mismatch discovery in the corpus — 8/9 probed functions returned passed from burner because ds-auth's external Authority check runs AFTER parameter validation.",
+        "35/100 is a TOOL MISMATCH score, not a security signal. Maker has 6+ years of production without known exploits.",
+        "HB#382 detection heuristic triggers dsAuth=True on this contract automatically.",
+        "No name() accessor. Etherscan verified as DSChief."
+      ]
+    },
+    {
+      "address": "0x5f3b5DfEb7B28CDbD7FAba78963EE202a494e2A2",
+      "chainId": 1,
+      "canonicalName": "Vote-escrowed CRV",
+      "filenameLabel": "Curve VotingEscrow",
+      "category": "C",
+      "categoryLabel": "veToken / staking governance (probe-limited)",
+      "score": null,
+      "auditHB": 380,
+      "sourceFile": "agent/scripts/probe-curve-votingescrow-mainnet.json",
+      "leaderboardRank": 1,
+      "lastVerified": "2026-04-15T16:30:00Z",
+      "notes": [
+        "Part of Curve DAO's 3-contract governance (VotingEscrow + GaugeController + separate Aragon Voting instance). Probed jointly with GaugeController in the HB#380 audit.",
+        "Joint score (VE + GC): 30/100 — new corpus low, explicitly flagged as Vyper tool-mismatch, not a security signal.",
+        "Contract self-identifies as 'Vote-escrowed CRV' not 'Curve' — the corpus-index sweep matcher needed a curve → {crv, vote-escrowed} alias.",
+        "HB#382 detection heuristic triggers vyper=True on this contract automatically."
+      ]
+    },
+    {
+      "address": "0x2F50D538606Fa9EDD2B11E2446BEb18C9D5846bB",
+      "chainId": 1,
+      "canonicalName": null,
+      "filenameLabel": "Curve GaugeController",
+      "category": "C",
+      "categoryLabel": "veToken / staking governance (probe-limited)",
+      "score": null,
+      "auditHB": 380,
+      "sourceFile": "agent/scripts/probe-curve-gaugecontroller-mainnet.json",
+      "leaderboardRank": 1,
+      "lastVerified": "2026-04-15T16:30:00Z",
+      "notes": [
+        "Second contract in Curve DAO's 3-contract governance. Joint score with VotingEscrow.",
+        "No name() accessor — Vyper GaugeController doesn't expose it. Manually verified as canonical Curve deployment.",
+        "HB#382 detection heuristic triggers vyper=True on this contract automatically.",
+        "Ecosystem note: the veToken model has been forked into 30+ DAOs (Balancer, Frax, Velodrome, Aerodrome, Aura, Yearn, Convex, Beethoven X). Each would score similarly weak via burner-callStatic probing."
+      ]
+    },
+    {
+      "address": "0xFAf8FD17D9840595845582fCB047DF13f006787d",
+      "chainId": 10,
+      "canonicalName": "veNFT",
+      "filenameLabel": "Velodrome V2 veNFT",
+      "category": "C",
+      "categoryLabel": "veToken / staking governance (Solidly veNFT, probe-reliable)",
+      "score": 85,
+      "scoreStatus": "clean — all admin functions gated with custom-error reverts",
+      "auditHB": 296,
+      "sourceFile": "agent/scripts/probe-velodrome-venft-optimism.json",
+      "reportFile": "agent/artifacts/audits/solidly-venft-audit-hb296.md",
+      "leaderboardRank": 1,
+      "lastVerified": "2026-04-15T18:30:00Z",
+      "notes": [
+        "Solidly veNFT — NFT-position vote-escrow (ERC721), architecturally distinct from Curve-family veCRV. Uses camelCase function names (createLock, increaseAmount, increaseUnlockTime) not Curve's snake_case.",
+        "11 functions probed via new src/abi/external/SolidlyVotingEscrow.json. 10 gated with CUSTOM ERRORS, 0 passed, 1 not-implemented (delegate — veNFT doesn't support ERC5805).",
+        "Custom errors decoded: ZeroAmount (0x1f2a2005), NotApprovedOrOwner (0xe433766c), SameNFT (0x93b50ef2), NotTeam (0xe9f3e974 — ADMIN GATE), NotVoter (0xc18384c1 — ADMIN GATE).",
+        "F-1 STRONG POSITIVE: 3/3 admin functions (setTeam, setArtProxy, setVoterAndDistributor) properly gated via custom errors. Clean Solidity access control. Contrast Balancer's 2 indeterminate findings — Velodrome has zero ambiguity.",
+        "F-2 ARCHITECTURAL: NFT positions are transferable/mergeable, fundamentally different from Curve's locked balances. HB#292 voteEscrow detection does NOT fire (checks Curve snake_case selectors). Needs Solidly triad extension — filed as Sprint 14 follow-up.",
+        "F-3 BYTECODE-SIBLING: Aerodrome (Base) returns IDENTICAL custom error codes on every selector — confirmed direct fork of Velodrome V2.",
+        "team() = 0x0a16cb36b553ba2bb2339f3b206a965e9841d305 (812 bytes, Gnosis Safe shape). voter() = 0x41c914ee0c7e1a5edcd0295623e6dc557b5abf3c."
+      ]
+    },
+    {
+      "address": "0xeBf418Fe2512e7E6bd9b87a8F0f294aCDC67e6B4",
+      "chainId": 8453,
+      "canonicalName": "veNFT",
+      "filenameLabel": "Aerodrome veNFT",
+      "category": "C",
+      "categoryLabel": "veToken / staking governance (Solidly veNFT, probe-reliable)",
+      "score": 85,
+      "scoreStatus": "clean — bytecode-sibling of Velodrome V2, identical error codes on every selector",
+      "auditHB": 296,
+      "sourceFile": "agent/scripts/probe-aerodrome-venft-base.json",
+      "reportFile": "agent/artifacts/audits/solidly-venft-audit-hb296.md",
+      "leaderboardRank": 1,
+      "lastVerified": "2026-04-15T18:30:00Z",
+      "notes": [
+        "DIRECT bytecode-sibling fork of Velodrome V2. Every probed selector returned the exact same custom-error code as Velodrome V2 — this audit covers both.",
+        "team() = 0xee5b3c7b333e2870b746b3b2b168ef0958e55e15 (10993 bytes — larger than Velodrome's team, likely a full governance timelock or signer-set contract with execution logic).",
+        "Score 85 tied with Velodrome V2 because the bytecode is sibling-identical; differences are constructor params + chain deployment, not code.",
+        "See solidly-venft-audit-hb296.md for shared methodology and findings. Any Velodrome-specific finding should be verified against Aerodrome separately because deployment state differs even when bytecode matches."
+      ]
+    },
+    {
+      "address": "0xc8418aF6358FFddA74e09Ca9CC3Fe03Ca6aDC5b0",
+      "chainId": 1,
+      "canonicalName": "Vote-Escrowed FXS",
+      "filenameLabel": "Frax veFXS",
+      "category": "C",
+      "categoryLabel": "veToken / staking governance (Vyper fork, probe-limited)",
+      "score": null,
+      "scoreStatus": "n/a — Category C-Vyper sub-family, HB#380 methodology caveat applies",
+      "auditHB": 294,
+      "sourceFile": "agent/scripts/probe-frax-vefxs-mainnet.json",
+      "reportFile": "agent/artifacts/audits/frax-veFXS-audit-hb294.md",
+      "leaderboardRank": null,
+      "lastVerified": "2026-04-15T17:45:00Z",
+      "notes": [
+        "CANONICAL Curve Vyper fork — all 10 CurveVotingEscrow.json selectors present in bytecode including commit_transfer_ownership + apply_transfer_ownership (absent in Balancer's Solidity fork). HB#382 vyper + HB#292 voteEscrow tags both fire.",
+        "Probe results: 1 state-gated ('Lock expired' on increase_unlock_time), 9 passed — 4 of the passes are admin functions (commit/apply_transfer_ownership + commit/apply_smart_wallet_checker) that are certainly gated in reality but show as passed due to the HB#380 Vyper parameter-ordering tool-mismatch. Not labeled as findings.",
+        "F-1 (POSITIVE-NEUTRAL): admin() returns 0xb1748c79709f4ba2dd82834b8c82d4a505003f27 — a 171-byte contract, footprint consistent with a Gnosis Safe proxy (~172 bytes canonical). Frax governance flows through a multisig. Medium-strong signal: weaker than Balancer's Authorizer Adaptor Entrypoint, stronger than EOA admins.",
+        "F-2 (METHODOLOGY): full Vyper caveat applies. Function-level probe-access signal not trustworthy. Source inspection required for real access-control findings. Sprint 14 P3 (vendor GovernorAlpha/Alpha ABI flow) is the methodology path for Vyper VEs.",
+        "F-3 (COMPARATIVE): contrast with Balancer veBAL makes the C-Solidity-fork vs C-Vyper split meaningful. Balancer surfaced indeterminate admin findings because Solidity probe-access works; Frax cannot surface equivalents via the same tool regardless of whether issues exist.",
+        "Score null (not zero) — Category C-Vyper carries methodology gap, not security verdict. Curve's legacy '30' score retained for historical continuity but carries the same caveat."
+      ]
+    },
+    {
+      "address": "0xC128a9954e6c874eA3d62ce62B468bA073093F25",
+      "chainId": 1,
+      "canonicalName": "Vote Escrowed Balancer BPT",
+      "filenameLabel": "Balancer veBAL",
+      "category": "C",
+      "categoryLabel": "veToken / staking governance (Solidity fork, probe-reliable)",
+      "score": 45,
+      "scoreStatus": "floor — indeterminate pending source verification of F-1",
+      "auditHB": 293,
+      "sourceFile": "agent/scripts/probe-balancer-vebal-mainnet.json",
+      "reportFile": "agent/artifacts/audits/balancer-veBAL-audit-hb293.md",
+      "leaderboardRank": 1,
+      "lastVerified": "2026-04-15T17:25:00Z",
+      "notes": [
+        "Solidity fork of Curve veCRV, NOT Vyper. HB#382 vyper detection does not fire; HB#292 voteEscrow family tag fires correctly (all 3 triad selectors present, commit_transfer_ownership absent).",
+        "10 functions probed via the existing src/abi/external/CurveVotingEscrow.json ABI. 1 gated (increase_unlock_time with 'Lock expired'), 5 legitimately passed (public user functions), 2 not-implemented (transfer_ownership — Solidity fork artifact), 2 suspicious admin passes (commit/apply_smart_wallet_checker).",
+        "F-1 (INDETERMINATE): commit_smart_wallet_checker + apply_smart_wallet_checker passed burner-callStatic without revert. Could be a real missing gate or a silent early-return. Needs Etherscan source verification before disclosure. Not published publicly this ship.",
+        "F-2 (POSITIVE): admin() returns 0x8f42adbba1b16eaae3bb5754915e0d06059add75 — a 1628-byte contract, Balancer's Authorizer Adaptor Entrypoint. Admin ops flow through Balancer's on-chain role-based access control (the Authorizer), not a multisig or EOA. Strong governance signal.",
+        "F-3 (ARCHITECTURAL): Solidity reimplementation of Curve veCRV math. The HB#380 Vyper parameter-ordering caveat does not apply here, so the F-1 'suspicious pass' observation is more significant than it would be for a Vyper contract.",
+        "Score 45/100 is a floor. If F-1 resolves as a silent early-return via source verification, score could rise to ~60. Score comparison is within Category C only (Leaderboard v3 methodology)."
+      ]
+    },
+    {
+      "address": "0xDbD27635A534A3d3169Ef0498beB56Fb9c937489",
+      "chainId": 1,
+      "canonicalName": "GTC Governor Alpha",
+      "filenameLabel": "Gitcoin Governor Alpha",
+      "category": "A",
+      "categoryLabel": "Inline-modifier governance (restored from UNRANKED in HB#297)",
+      "score": 90,
+      "scoreStatus": "clean — 6/6 gated, immutable governor, 66 proposals, 0 suspicious passes",
+      "auditHB": 297,
+      "originalAuditHB": 384,
+      "sourceFile": "agent/scripts/probe-gitcoin-alpha-mainnet-fresh.json",
+      "legacySourceFile": "agent/scripts/probe-gitcoin-alpha-mainnet.json",
+      "legacySourceStatus": "SUPERSEDED by HB#297 re-audit — the HB#384 probe used --skip-code-check + Bravo ABI against an Alpha contract, producing 15 phantom passes. Retained as a methodology-error archive.",
+      "reportFile": "agent/artifacts/audits/gitcoin-governor-alpha-audit-hb297.md",
+      "leaderboardRank": 3,
+      "lastVerified": "2026-04-15T18:50:00Z",
+      "notes": [
+        "RESTORED to Category A after HB#297 re-audit with new src/abi/external/GovernorAlpha.json. Rank 3 in Category A (Compound 100 → Nouns 92 → Gitcoin 90 → Arbitrum 87 → Uniswap 85 → ENS 84 / Optimism Agora 84).",
+        "Probe results: 6/6 functions gated with plain-text error strings. 0 suspicious passes. 0 not-implemented. Perfect gate rate.",
+        "F-1 STRONG POSITIVE: ZERO admin setter functions in bytecode. No __acceptAdmin, no __abdicate, no guardian(), no whitelist*. Verified via selector-level grep against the runtime code. Gitcoin Alpha is an IMMUTABLE governor — once deployed, parameters cannot be changed. Fewer admin knobs = fewer attack surfaces.",
+        "F-2 POSITIVE: proposalCount() = 66 (as of HB#297). Contract is ACTIVE, not deprecated. Parameters: quorumVotes 2.5M GTC, proposalThreshold 1M GTC, votingDelay ~2 days, votingPeriod ~5.6 days. Timelock at 0x57a8865cfb1ecef7253c27da6b4bc3daee5be518.",
+        "F-3 METHODOLOGY CORRECTION: the HB#384 probe artifact was tool-error, not governance signal. Used --skip-code-check against a Bravo ABI where selectors don't match Alpha. When probe-access calls a non-existent selector under --skip-code-check, the EVM routes to fallback/receive which returns success — phantom passes. 15 of the HB#384 'passed' results were phantom. Only 4 (propose, cancel, queue, execute) were real.",
+        "F-4 ARCHITECTURAL: Alpha uses castVote(uint256,bool) not Bravo's castVote(uint256,uint8) — older for/against model without abstention or castVoteWithReason. Simpler surface is the tradeoff for the immutability.",
+        "PREVENTION RULE (surfaces as brain lesson): never combine --skip-code-check with a mismatched ABI. Without a matching ABI, run without the flag and trust 'not-implemented' results.",
+        "HB#384 legacy note: Gitcoin's on-chain contract is GovernorAlpha (pre-Bravo Compound fork) not GovernorBravo. The HB#384 discovery of this fact stands; the subsequent probe data on it was corrupt and is now superseded."
+      ]
+    }
+  ],
+  "corrections": [
+    {
+      "discoveredHB": 384,
+      "originalLabel": "Gitcoin Governor Bravo",
+      "correctedLabel": "Uniswap Governor Bravo",
+      "address": "0x408ED6354d4973f66138C91495F2f2FCbd8724C3",
+      "description": "HB#362 audit labeled 0x408ED635... as 'Gitcoin Governor Bravo'. The contract's on-chain name() accessor returns 'Uniswap Governor Bravo'. Gitcoin governance actually uses 'GTC Governor Alpha' at 0xDbD27635A534A3d3169Ef0498beB56Fb9c937489. The error propagated through Leaderboard v2, v3, and 5+ downstream brain lessons for 22 HBs before HB#384 caught it during baseline cleanup.",
+      "preventionShipped": [
+        "HB#385 task #390: pre-probe name() identity check in pop org probe-access (--expected-name flag, always-logged contractName field)",
+        "HB#386 task #391: retroactive name() sweep across all 18 corpus artifacts. Clean result beyond this one correction.",
+        "HB#387 task #392: this machine-readable corpus index, sanity-checkable via the sweep script."
+      ],
+      "publicCorrectionNote": "reports/audits/corrections-hb384.md + IPFS QmZT2753rrakq4NysAQsqE9e8N9ERTLJwe6AK2FigMNvmi"
+    }
+  ],
+  "categoryLegend": {
+    "A": "Inline-modifier governance — OZ Ownable, OZ AccessControl, Compound Bravo, OZ Governor. Probe-reliable; scores directly comparable within category.",
+    "B": "External-authority governance — ds-auth, Aragon kernel ACL. Probe-limited; scores carry methodology footnote. Not comparable across to Category A.",
+    "C": "veToken / staking governance — Curve family, veToken forks. Probe-limited (Vyper parameter ordering). Not comparable across to other categories.",
+    "D": "Bespoke / proprietary — Aave V2/V3, MakerDAO spells. Case-by-case interpretation. May use inline modifiers (real signal) or bespoke patterns (limited signal)."
+  },
+  "schemaVersion": 1,
+  "meta": {
+    "totalEntries": 17,
+    "rankedEntries": 16,
+    "unrankedEntries": 1,
+    "categoryA": 7,
+    "categoryB": 2,
+    "categoryC": 6,
+    "categoryD": 2,
+    "corrections": 1,
+    "lastSweepHB": 386,
+    "lastSweepResult": "clean (0 mismatches beyond the documented correction)",
+    "lastAuditHB": 297,
+    "lastAuditProject": "Gitcoin GovernorAlpha re-audit (restored to Category A at rank 3, score 90)"
+  },
+  "pending": [
+    {
+      "project": "_placeholder",
+      "label": "Sprint 14 P1 complete — all 4 veToken targets audited",
+      "address": null,
+      "chainId": 0,
+      "expectedOnChainName": null,
+      "category": null,
+      "notes": [
+        "Sprint 14 P1 (execute pending[] veToken audits) is now complete: Balancer HB#293, Frax HB#294, Velodrome + Aerodrome HB#296. This placeholder entry is kept so downstream consumers can detect the transition (pending.length > 0 vs 0) gracefully.",
+        "Next candidates for the queue (NOT yet verified on-chain): Aura (AURA), Beethoven X (veBEETS on Fantom), Convex vlCVX, Yearn yCRV, Thena (veTHE on BNB Chain). Add as concrete pending[] entries after live name() verification like HB#291."
+      ]
+    }
+  ]
+}