Smart Contract Audit Readiness Bundle

The external audit readiness bundle is the single machine-readable evidence file for production smart-contract review. It combines repository identity, runtime provenance, activation and preflight status, launch-gate output, monitoring evidence, registry/release state, test evidence paths, documentation links, known boundaries, and the open risk register.

Generate The Bundle

Set the operator token for the node being reviewed:

$env:NOOS_OPERATOR_TOKEN="<operator-token>"

Generate the bundle:

npm run noos -- contracts audit-bundle --profile mainnet --include-test-results --out smart-contract-audit-bundle.json

Run the release candidate gate and incident drills first so the bundle can reference fresh evidence:

npm run contracts:rc-gate -- --profile mainnet --json --out test-results/contracts/rc-gate-report.json
npm run contracts:incident-drills -- --continue-on-failure --json --out test-results/contracts/incident-drills-report.json
npm run noos -- contracts package-policy inspect --package contract-packages/report-store-0.2.0 --policy package-policy.json --out test-results/contracts/package-policy-report.json --json

Use --docs-base-url when auditors should receive hosted documentation links:

npm run noos -- contracts audit-bundle --profile mainnet --docs-base-url "https://docs.example.com" --include-test-results --out smart-contract-audit-bundle.json

Use --risk-register to point at a deployment-specific risk register:

npm run noos -- contracts audit-bundle --risk-register launch-risk-register.json --out smart-contract-audit-bundle.json

What Auditors Should Inspect First

1. repository: commit, branch, package version, and dirty worktree status.
2. runtimeProvenance: Wasmtime sidecar path, hash, protocol profile, and protocol-pinned requirements.
3. runtimePreflight: sidecar capability handshake and fuel/memory limits.
4. launchGate: hard gates, warnings, and operator-review items.
5. registryAndReleases: approved packages, audit metadata, release status, rollback targets, and migration references.
6. testMatrix: required commands and attached report paths.
7. riskRegister: open risks, owners, mitigations, and waivers.

Evidence Semantics

Every live node section has a status:

• available: the CLI collected the section successfully.
• failed: the node call failed; the error is included.
• missing: the local evidence file was not present.

Missing test report files do not crash bundle generation. They appear as evidence_missing so auditors can distinguish absent attachments from failed runtime checks.

Known Boundary

The bundle is not a governance approval. It is evidence for auditors and launch reviewers. Per-contract business-logic audits, operator key custody, and alert-manager routing still need deployment-specific acceptance.