Restore the Protofire reports as inherited audit records (reverses #1)

README.md

@@ -26,3 +26,21 @@ Nothing publishes on merge, so `[package].version` and the frozen
 `src/generated/<tag>/` snapshot it names only ever move together.
 
 See rainlanguage/rain.factory#46 for the split rationale.
+
+## Audit
+
+This repo has never been audited under its own name. It carries three
+**inherited** Protofire reports: audits of `rain.factory`, performed before the
+split, of the source that built the snapshots pinned here. They are prefixed
+`inherited.` and their provenance and per-snapshot coverage are recorded in
+[`audit/protofire/inherited.json`](audit/protofire/inherited.json) — read that
+file, not this section, for what each report covers.
+
+Every snapshot in `src/generated/` is covered by exactly one of them:
+`src/generated/0_1_3/` and `src/generated/0_1_4/` (the `ICloneableFactoryV2`
+bytecode) by r2.0, and `src/generated/0_1_5/` (the `ICloneableFactoryV3` rewrite
+that `LibCloneFactoryDeploy` currently aliases and that is live on every
+supported chain) by r3.0, which audited `rain.factory` at tag `sol-v0.1.5` with
+zero findings at every severity. Coverage is never inferred from a filename: it
+is asserted per snapshot directory in the manifest, so a future snapshot appears
+as uncovered until a report is inherited for it.

audit/protofire/inherited.json

@@ -0,0 +1,51 @@
+{
+  "schema": 1,
+  "records": [
+    {
+      "pdf": "inherited.rain.factory.sol-v0.1.5-r3.0.jul-2026.pdf",
+      "sha256": "71fc0b5c99a0630977c510a892b407d7141495d5d2cbd78c0e929b9795d3947e",
+      "report": "r3.0",
+      "reportDate": "2026-07-30",
+      "source": { "org": "rainlanguage", "repo": "rain.factory", "ref": "sol-v0.1.5" },
+      "covers": [
+        {
+          "snapshot": "src/generated/0_1_5",
+          "bytecodeHash": "0x3ec02e2f27d73f603f5b37a7dc228956004e9154c6d1f9c5335bd60036379d00"
+        }
+      ],
+      "basis": "The report's Reviews table records 30/07/26 against rain.factory commit c29d5827309d2f10a6e68c76bc2ea385e0a4e701, tag sol-v0.1.5, and its Scope lists src/concrete/CloneFactory.sol, src/interface/ICloneableFactoryV2.sol, src/interface/ICloneableFactoryV3.sol, src/interface/ICloneableV2.sol and src/lib/LibCloneFactoryDeploy.sol. Zero findings at every severity. Coverage of src/generated/0_1_5 is an identity, not a rebuild: src/generated/0_1_5/CloneFactory.pointers.sol at that audited commit is byte-identical to this repo's copy (sha256 d3def164d01d2b50ebf7175a4efaaa76bfc020f992a9ed73e67203d3a54ed902), so the audited tree and this snapshot pin the same address 0x7053c1D000192f1FeC1fbe20350139F3300dBBaD and the same codehash. It does NOT cover src/generated/0_1_3 or src/generated/0_1_4: those hold ICloneableFactoryV2 bytecode that the audited c29d5827 source no longer builds, which is why r3.0 does not supersede r2.0."
+    },
+    {
+      "pdf": "inherited.rain.factory.v0.1.1-r2.0.may-2026.pdf",
+      "sha256": "6c4ecf9f47ebf96cda58a856901ccd25dd83b3a8b0e8524a00adb60f149894ca",
+      "report": "r2.0",
+      "reportDate": "2026-05-27",
+      "source": { "org": "rainlanguage", "repo": "rain.factory", "ref": "v0.1.1" },
+      "covers": [
+        {
+          "snapshot": "src/generated/0_1_3",
+          "bytecodeHash": "0xf21b813c7075a1621285df3a8369d0652c31ea80cb807be1aaadafeecd134475"
+        },
+        {
+          "snapshot": "src/generated/0_1_4",
+          "bytecodeHash": "0xf21b813c7075a1621285df3a8369d0652c31ea80cb807be1aaadafeecd134475"
+        }
+      ],
+      "basis": "rain.factory v0.1.1 src/concrete/CloneFactory.sol (blob acbbcf7e7b7cd06eb7646e1ff889ddec8cf7b131) rebuilt under rainix 53e96a7d sol-shell (solc 0.8.25, 100000 runs, cancun, bytecode_hash=none, OZ 5.6.1) reproduces both snapshots' CREATION_CODE and RUNTIME_CODE byte-for-byte. The address 0x444acC29d63fa643E8adCC35FD9aa6DE111dCb39 and codehash are themselves constants inside the audited src/lib/LibCloneFactoryDeploy.sol, a named scope item of the report."
+    },
+    {
+      "pdf": "inherited.rain.factory.1a92a86.feb-2026.pdf",
+      "sha256": "ffb52e9f5d84eaa66c35b760aaf4b8d1ebcd6ac10b2da1ab601cc1f3f272ec61",
+      "report": "r1.0",
+      "reportDate": "2026-02-11",
+      "source": {
+        "org": "rainlanguage",
+        "repo": "rain.factory",
+        "ref": "1a92a8688249aa5a8f4e82d5ed584604515f1ea0"
+      },
+      "covers": [],
+      "supersededBy": "inherited.rain.factory.v0.1.1-r2.0.may-2026.pdf",
+      "basis": "Audits an earlier state of the same ICloneableFactoryV2 source (blob 3299755d9db2bf268581b9e80c455d3b85dbb0ad) compiled against OpenZeppelin 5.5.0 (git submodule), not the 5.6.1 soldeer pin the snapshots build from. No snapshot in this repo builds from it. r2.0's Reviews table re-lists this 11/02/26 pass, so r2.0 subsumes it. Retained as audit history."
+    }
+  ]
+}