[izzetemredemir]

Why

The docs contract-registry check (wraith-protocol/docs#182) reads the governance section of audit-prep/DEPLOYMENT_MANIFEST.md at a pinned commit. stealth-splitter and stealth-batch-sender have no entry there. The check only warned, and the docs registry kept listing both as upgradeable.

What the source says (develop 66273f2)

• stealth-splitter
  • Entry points: init, create_split, fund_split, get_split.
  • No admin, no pause, and nothing calls update_current_contract_wasm.
  • init stores the announcer once; a second call returns AlreadyInitialized.
• stealth-batch-sender has no upgrade entry point.
  • init(admin, announcer, asset_policy) stores the pause admin once. Nothing writes DataKey::Admin afterwards.
  • pause and unpause only affect batch_send.
  • init_multisig(signers, threshold) sets a signer set that can only rotate itself (multisig.rs):
    • a current signer proposes;
    • a quorum of current signers approves;
    • a signer executes after ROTATION_TIMELOCK_SECS (7 days, ledger timestamp);
    • any signer can cancel.
  • This matches the batch-sender rows in AUTHORIZATION_MATRIX.md.

Changes

• DEPLOYMENT_MANIFEST.md
  • stealth-splitter goes under "Frozen Contracts (No Admin)".
  • stealth-batch-sender gets a new "Non-Upgradeable Contracts (Pause Admin)" section. It has a pause admin, so it does not fit the frozen definition the audit docs use ("no upgrade, pause, or admin paths" in 02-threat-model.md), and it is not upgradeable either.
  • Batch sender deploy steps:
    • add the missing --admin argument;
    • add the init_multisig call;
    • note that neither call checks the caller, as AUTHORIZATION_MATRIX.md already records, so both run right after deploy.
  • Incident response: pause every affected contract that has a pause function, not "if upgradeable". The batch sender pause admin cannot be replaced, so if that key is compromised the batch sender has to be redeployed.
  • Rollback plan: both contracts are listed with the frozen ones.
• README.md, 06-deployment-manifest.md and stellar/MIGRATION_V0_TO_V1.md described both contracts as upgradeable (the migration table even says 3-of-5 multisig and pausable for the splitter). They now match the source.

The docs PR pins this commit. Once this merges, I'll re-pin it to the merge commit on develop. The docs check has to learn the new section name, and that change is part of the docs PR.

Noticed, not changed

• The manifest lists stealth-sender and wraith-names as upgradeable (multisig + timelock), but no contract under stellar/*/src calls update_current_contract_wasm on develop; AUTHORIZATION_MATRIX.md says the same. The manifest also says wraith-names has no pause, but it has pause/unpause. These need a decision on the intended model, so they belong in a separate issue.
• The stealth-sender init example is out of date. init now takes announcer, asset_policy, fee_recipient, fee_basis_points, admin.

Refs wraith-protocol/docs#182

[drips-wave]

Hey @izzetemredemir! 👋 It looks like this PR isn't linked to any issue.

If this PR is for one of the issues assigned to you as part of a Wave, please link it to ensure your contribution is tracked properly. You can do this by adding a keyword to the PR description (e.g., Closes #123), or by clicking a button below:

Issue	Title
#233	[Wave 10][Carryover] Generate deployable subgraph configuration from the deployment manifest	Link to this issue

ℹ️ Learn more about linking PRs to issues

[truthixify]

Governance documentation matches the current splitter and batch sender implementations. Approved.