contract_version: audit_scope_readiness.v1
state: QUOTE_READY
repository:
  url: https://vartovii.com/samples/accepted-documentation-pr/?revision=55effcaaa01a7569d7cd483ca18b5e6b50392b9b
  pinned_commit: 55effcaaa01a7569d7cd483ca18b5e6b50392b9b
  chain: Base
  nsloc: 38
review:
  target: Independent smart contract audit
  deadline: 2026-08-14
scope:
  in_scope:
    - src/NorthstarVault.sol
    - src/NorthstarAccess.sol
  out_of_scope:
    - script/
    - deployment operations
commands:
  build: forge build
  test: forge test
evidence:
  - category: repository_identity
    status: EVIDENCED
    source:
      url: https://vartovii.com/samples/accepted-documentation-pr/?revision=55effcaaa01a7569d7cd483ca18b5e6b50392b9b
    checked_at: 2026-08-01T08:00:00Z
    note:
      Repository identity, chain, commit, and in-scope source paths are
      explicit; the revision is not a Git commit.
  - category: privileged_roles_and_upgrades
    status: PARTIAL
    source:
      artifact_reference: src/NorthstarAccess.sol
      url: https://vartovii.com/samples/accepted-documentation-pr/src/NorthstarAccess.sol?revision=55effcaaa01a7569d7cd483ca18b5e6b50392b9b
    checked_at: 2026-08-01T08:04:00Z
    note:
      Roles are visible, but deployed admin addresses and upgrade ownership
      evidence are absent.
  - category: incident_and_disclosure_readiness
    status: MISSING
    source:
      url: https://vartovii.com/samples/accepted-documentation-pr/?revision=55effcaaa01a7569d7cd483ca18b5e6b50392b9b
    checked_at: 2026-08-01T08:08:00Z
    note:
      No SECURITY.md or private disclosure path was found in the synthetic
      fixture.
gaps:
  - priority: P1
    owner: Protocol team
    required_artifact: Deployed proxy and admin addresses
    audit_scoping_impact:
      The auditor cannot reconcile privileged actors with the proposed scope.
  - priority: P1
    owner: Protocol team
    required_artifact: Upgrade and emergency-action owner map
    audit_scoping_impact:
      Quote questions remain open around upgradeable components and response
      authority.
  - priority: P2
    owner: Protocol team
    required_artifact: SECURITY.md and disclosure contact
    audit_scoping_impact: The handoff lacks an incident and disclosure path.
  - priority: P2
    owner: Lead engineer
    required_artifact: Dependency exception notes
    audit_scoping_impact:
      The auditor must rediscover why selected packages are pinned.
  - priority: P2
    owner: Lead engineer
    required_artifact: Deployment manifest by chain
    audit_scoping_impact:
      The review target cannot be matched cleanly to deployed instances.
prepared_by: Vartovii scope analyst
disclaimer:
  This synthetic artifact prepares audit scope and supporting evidence. It is
  not a smart contract audit, vulnerability assessment, or security assurance.
