Offboard Sc Dev

---
name: offboard-sc-dev
description: Orchestrates a full smart-contract-team offboarding end-to-end — swaps the departing person out of the multisig and rotates every shared SC-owned wallet they held (deployer, dev, pauser) to freshly generated replacements. v1 is EXECUTE-ONLY: it assumes the Linear ticket tree already exists (modeled on EXSC-558) and runs the rotations; it does NOT create the tickets (that is a fast-follow). Use when the user says "offboard <SC dev>", "run the SC-dev offboarding", or "replace <person> as multisig signer and rotate the shared wallets". NOT for non-SC offboarding, and it never reimplements a rotation — it drives `rotate-deployer-wallet`, `rotate-dev-wallet`, `rotate-pauser-wallet`, and `multisig-rollout` for the signer swap, gating on `check-rotation-status`. Requires Foundry, gh, VPN (MongoDB), the Slack MCP server, and a human at the keyboard for key generation and Ledger signing. Never self-signs; never rotates CTO-owned wallets.
usage: /offboard-sc-dev --person <name> --removed-signer 0x --new-signer 0x [--linear EXSC-XXX]
---

# Offboard SC Dev (LI.FI Contracts)

Drives the smart-contract half of offboarding a departing SC team member: remove them as a Safe multisig signer, add their replacement, and rotate every **shared** wallet they had custody of to a freshly generated one. This is the orchestrator — it **calls** the per-role rotate-* skills and `multisig-rollout`; it does not reimplement any rotation.

**v1 scope — EXECUTE-ONLY.** This skill assumes the offboarding **Linear ticket tree already exists** (created by hand, modeled on EXSC-558) and its job is to *execute* that plan. It does **not** generate the ticket tree. Auto-creating the tickets is a deliberate **fast-follow** — call it out at the start so the user knows to have the tree ready, and don't silently skip a step because a ticket is missing.

Why an orchestrator and not one big script: each role has a different rotation mechanism (Safe owner swap, staging owner transfer, immutable-facet redeploy), and each is independently useful and independently tested. This skill sequences them by dependency and holds the custody guard across all of them.

## When to use / when NOT

| Situation | Skill |
|---|---|
| Full SC-dev offboarding (signer swap + all shared wallets) | **this skill** |
| Just the deployer wallet | `rotate-deployer-wallet` |
| Just the staging owner (Dev wallet) | `rotate-dev-wallet` |
| Just the emergency pauser | `rotate-pauser-wallet` |
| A single production rollout / signer swap on its own | `multisig-rollout` |

NOT for non-SC offboarding (HR/IT deprovisioning is out of scope) and NOT for rotating a CTO-owned wallet (refund / feeCollector / withdraw — see custody guard).

## Inputs

- `--person <name>` — the departing SC dev, resolved from the offboarding Linear tree (EXSC-558-style).
- `--removed-signer 0x` — the departing person's personal multisig signer seat to remove (human-supplied / ticket-sourced).
- `--new-signer 0x` — the replacement personal multisig signer to add (human-supplied / ticket-sourced).
- `--linear EXSC-XXX` — the parent offboarding ticket (the pre-existing tree this run executes). If absent, ask for it — do not invent a tree.
- New wallet addresses for **deployer, dev, pauser** — securely generated by a human (the blocking first step, below). Old addresses are **derived from keys / on-chain state, never from `config/global.json`** (it can be mid-rotation-inconsistent).

## Guardrails

- **Custody guard.** Rotate only the SC-owned shared wallets (**deployer, dev, pauser**) plus swap the departing person's **personal multisig signer** seat. NEVER rotate the CTO-owned refund / feeCollector / withdraw — if the ticket tree implies touching one, stop and escalate.
- **Never self-sign.** New-key generation is a human step. Every Safe proposal (signer swap, deployer's Safe-owner / CANCELLER moves, pauser diamond cuts) is human Ledger-signed via `multisig-rollout` → `script/deploy/safe/confirm-safe-tx.ts`; this skill and the ones it calls hand off and WAIT — none run the signer.
- **Never bypass Safe/timelock** (rule 002-architecture). All owner/role/pauser on-chain changes go through `multisig-rollout` — no direct cuts, no `SEND_PROPOSALS_DIRECTLY_TO_DIAMOND=true`.
- **Secrets hygiene.** Never print a private key or full RPC URL. Derive every old address from its key or on-chain state, never from `config/global.json`.
- **Exit-code convention** for sub-skills / scripts: `0` success; `1` real error (report, stop, no retry); `2` recoverable misconfig (name the missing env/credential). A failing network in one rotation must not silently abort the others — surface it and let the operator decide.
- Scripting is TypeScript (`bunx tsx`) or Bash only, never Python. Foundry/bun may need `export PATH="$HOME/.foundry/bin:$HOME/.bun/bin:$PATH"`.

## Workflow

Ordered by dependency. The new keys must exist and be funded before anything on-chain can move, so key generation is the **blocking first human step**; the signer swap and deployer rotation come next because they change who can sign; dev and pauser follow; secret rotation and the completeness gate close it out.

### Phase 0 — Preflight & scope confirmation

Run from the repo root. Confirm and report (don't fix silently):

- The Linear offboarding tree (`--linear`, EXSC-558-style) exists and is the plan being executed. State the EXECUTE-ONLY scope note: ticket-tree creation is a fast-follow, not done here.
- Departing person, their replacement signer, and which of the three shared wallets they held (all should be rotated regardless — the departing person loses access to all shared keys).
- `.env` present, `PRODUCTION` correct, `SEND_PROPOSALS_DIRECTLY_TO_DIAMOND` not `true`; Foundry, `gh auth status`, VPN (MongoDB), Slack MCP all available (Slack + VPN needed by `multisig-rollout`).
- Set the interaction model up front: this is **semi-automated** — it will pause for the human to (a) generate keys and (b) sign proposals on a Ledger, then resume. Tell the user the pauses are coming so they don't complete signing steps by hand.

### Phase 1 — Generate + fund the new wallets (BLOCKING human step)

Nothing on-chain can proceed until the replacement keys exist. The human securely generates the new **deployer, dev, and pauser** keys and their replacement personal signer, and provides the addresses (never the keys, never via `global.json`). Fund the new deployer/dev/pauser enough to broadcast where each rotation needs gas — the individual rotate-* skills sweep the bulk from the old wallets, but the new deployer needs bootstrap gas *before* it can broadcast. Wait for the addresses before continuing.

> **HyperEVM big blocks.** The new **deployer** and **dev** EOAs each need big blocks enabled on `hyperevm` before they can deploy there — an L1, per-address setting that does not carry over on rotation. `rotate-deployer-wallet` and `rotate-dev-wallet` each flag this in their funding phase; follow the runbook: `docs/HyperEVMBigBlocks.md`. (The **pauser** does not deploy, so it is exempt.)

### Phase 2 — Swap the multisig signer (remove departing, add replacement)

Change the Safe ownership set on every production chain: remove the departing person's personal signer, add the replacement. This is a Safe owner change, so it runs through the production rollout lifecycle:

```text
/multisig-rollout
```

driven for the owner-swap (add replacement + remove departing signer) across all chains — proposals → PR → **human Ledger signing (hand off, wait)** → verify `signatureCount >= 2` → post `#dev-sc-multisig-proposals`. Do not run `confirm-safe-tx.ts` yourself. Wait for the user to confirm signing before treating the swap as landed.

### Phase 3 — Rotate the deployer wallet

Heaviest governance role (`safeOwners[0]` + Timelock `CANCELLER_ROLE` + prod timelock executor), so it goes before the lighter roles:

```text
/rotate-deployer-wallet --new-address <NEW_DEPLOYER>
```

It sweeps old→new first (bootstrap gas), swaps the Safe owner + moves `CANCELLER_ROLE` via `multisig-rollout` (human signs), handles Tron ownership + delegation, updates config, and decommissions the old key. Let it own its own signing hand-offs; wait for it to report complete.

### Phase 4 — Rotate the dev wallet

Staging diamond owner — lowest-stakes, the reference rotation:

```text
/rotate-dev-wallet --new-address <NEW_DEV>
```

It funds the new dev by sweeping the old, transfers staging diamond ownership old→new, moves the Tron delegation, updates config, and self-verifies.

### Phase 5 — Rotate the pauser wallet

Immutable pauser → redeploy `EmergencyPauseFacet` with the new pauser and cut it into every diamond:

```text
/rotate-pauser-wallet --new-address <NEW_PAUSER>
```

It repoints (via `deploy-contract` / `multisig-rollout`, incl. Tron), sweeps the old pauser, runs the CI funding check, rotates the CI pauser secret + re-verifies `verifyEmergencyPauseReadiness.yml` (coordinated, partly outside this repo), and updates config.

### Phase 6 — Shared-secret rotation checklist

Beyond the on-chain wallets, the departing person had access to shared secrets that must be rotated so their leaving revokes access. Work the checklist modeled on **EXSC-567** (RPC keys, API tokens, CI secrets, any shared credential store). These live largely **outside** `contracts` — coordinate with the secret owners and record what was rotated. Do NOT mark a secret rotated that this session cannot actually reach; surface it as a human/operational follow-up.

### Phase 7 — Completeness gate

The single source of truth that the offboarding actually took effect everywhere, per rotated role:

```text
/check-rotation-status --old-address <OLD_ADDR> --new-address <NEW_ADDR> --role <deployer|dev|pauser> --removed-signer <DEPARTING_SIGNER> --production
```

Run it once per rotated role. Each invocation verifies only the checks that apply to that role: **deployer** — Safe-owner membership (departing removed / replacement added; old deployer removed / new added), Timelock `CANCELLER_ROLE` (old removed / new granted), whitelist role, and wallet funding; **dev** — staging-diamond `owner()` and wallet funding; **pauser** — wallet funding and CI pauser config. Read-only. The offboarding is **not** complete until every role passes on every network. Any red row → go back to the owning rotate-* skill for that role and network.

## Verification

Offboarding is complete only when ALL hold:

- **Signer swap:** departing personal signer removed and replacement added on every production Safe (`check-rotation-status` green; proposals signed and executed via the timelock pipeline).
- **Deployer:** `safeOwners[0]` is the new deployer, `CANCELLER_ROLE` moved, Tron ownership + delegation moved, old deployer key decommissioned.
- **Dev:** staging diamond `owner()` is the new dev on every chain (incl. Tron staging), delegation moved.
- **Pauser:** every diamond routes `EmergencyPauseFacet` to the facet carrying the new pauser; CI secret rotated + pause-flow re-verified (or logged as coordination follow-up).
- **Secrets:** EXSC-567-style checklist worked; anything outside reach logged as a follow-up, not faked.
- **Config:** the per-role `update-wallet-config` PRs are open (EVM + `tronWallets.*`); Notion registry follow-ups noted.
- **Fast-follow logged:** the ticket-tree auto-creation gap (v1 execute-only) recorded for a later version.

## Reuse map

| Step | Calls |
|---|---|
| Multisig signer swap (remove departing, add replacement) | `/multisig-rollout` |
| Rotate deployer (`safeOwners[0]` + CANCELLER) | `/rotate-deployer-wallet` |
| Rotate dev (staging owner) | `/rotate-dev-wallet` |
| Rotate pauser (immutable → redeploy `EmergencyPauseFacet`) | `/rotate-pauser-wallet` |
| Completeness gate (signer swap + all roles, all networks) | `/check-rotation-status --old-address <OLD> --new-address <NEW> --role <role> --removed-signer <DEPARTING_SIGNER> --production` |
| Config PRs per role (called *inside* each rotate-* skill) | `/update-wallet-config` |
| Fund sweeps per role (called *inside* each rotate-* skill) | `/sweep-wallet-funds` |

Shared-secret rotation (EXSC-567) and Linear ticket-tree creation live outside this skill — coordinated / fast-follow, not owned here.