Summary
scripts/check-migration.sh is documented in AGENTS.md (steps referencing "must print 'Safe to publish.'" and "preflight check-migration.sh runs automatically") as part of the publish procedure, but it is not actually invoked by any CI workflow:
$ grep -rn "check-migration" .github/
(no output)
CI's own "Delegate migration safety" job (.github/workflows/ci.yml) does something narrower: it rebuilds each WASM from source and compares against the committed file (catching "you forgot to run sync-wasm.sh"), but it never checks whether a predecessor hash was recorded in legacy_contracts.toml / legacy_delegates.toml. That stricter check exists only in scripts/check-migration.sh, which nothing runs automatically.
Separately, Makefile.toml has its own [tasks.check-migration], which is differently scoped from scripts/check-migration.sh: the Makefile task only checks the delegate (not the contract at all), via inline bash that doesn't call the script file. So there are two things named "check-migration" in this repo with different logic and different (non-CI) invocation paths, which is itself confusing.
Why this matters
A PR that changes contract/common source, rebuilds the WASM correctly (so the "Delegate migration safety" CI job passes), but forgets to add a legacy_contracts.toml entry, currently ships green. That is the exact failure mode behind issues #3, #12, and #33 (per the referring PR's review discussion, delta#43).
Suggested fix
Add a step to the "Delegate migration safety" CI job (or a new job) that runs ./scripts/check-migration.sh and fails the build on its non-zero exit. Given the script does its own fresh rebuild internally, this may be redundant with the existing "Verify contract/delegate WASM matches source" steps — worth reviewing whether to keep both or consolidate. Also worth resolving the naming collision with Makefile.toml's [tasks.check-migration] (rename one, or make the Makefile task call the script instead of duplicating narrower logic).
Related: #45 (the delegate side of check-migration.sh's own gating is asymmetric with the contract side — a different but adjacent finding from the same audit).
Found while investigating delta#43 (self-delta / deletion-propagation / apply_delta convergence fix).
[AI-assisted - Claude]
Summary
scripts/check-migration.shis documented inAGENTS.md(steps referencing "must print 'Safe to publish.'" and "preflight check-migration.sh runs automatically") as part of the publish procedure, but it is not actually invoked by any CI workflow:CI's own "Delegate migration safety" job (
.github/workflows/ci.yml) does something narrower: it rebuilds each WASM from source and compares against the committed file (catching "you forgot to runsync-wasm.sh"), but it never checks whether a predecessor hash was recorded inlegacy_contracts.toml/legacy_delegates.toml. That stricter check exists only inscripts/check-migration.sh, which nothing runs automatically.Separately,
Makefile.tomlhas its own[tasks.check-migration], which is differently scoped fromscripts/check-migration.sh: the Makefile task only checks the delegate (not the contract at all), via inline bash that doesn't call the script file. So there are two things named "check-migration" in this repo with different logic and different (non-CI) invocation paths, which is itself confusing.Why this matters
A PR that changes contract/common source, rebuilds the WASM correctly (so the "Delegate migration safety" CI job passes), but forgets to add a
legacy_contracts.tomlentry, currently ships green. That is the exact failure mode behind issues #3, #12, and #33 (per the referring PR's review discussion, delta#43).Suggested fix
Add a step to the "Delegate migration safety" CI job (or a new job) that runs
./scripts/check-migration.shand fails the build on its non-zero exit. Given the script does its own fresh rebuild internally, this may be redundant with the existing "Verify contract/delegate WASM matches source" steps — worth reviewing whether to keep both or consolidate. Also worth resolving the naming collision withMakefile.toml's[tasks.check-migration](rename one, or make the Makefile task call the script instead of duplicating narrower logic).Related: #45 (the delegate side of
check-migration.sh's own gating is asymmetric with the contract side — a different but adjacent finding from the same audit).Found while investigating delta#43 (self-delta / deletion-propagation / apply_delta convergence fix).
[AI-assisted - Claude]