feat: add reusable active EVM task workflows

.github/workflows/validate-common-scripts.yml

@@ -41,6 +41,9 @@ jobs:
         with:
           experimental: true
 
+      - name: Check active EVM Make dispatcher
+        run: bash active/evm/make/check-dispatch.sh
+
       # ── Dependencies ─────────────────────────────────────────────────
       # Install Foundry deps into the shared active/evm project. PROJECT_DIR
       # points forge install at active/evm; BASE_CONTRACTS_COMMIT is supplied

.gitignore

@@ -27,3 +27,7 @@ yarn-error.log
 
 .DS_Store
 signer-tool/
+
+# Active EVM task-local Forge outputs
+active/evm/tasks/**/run-latest.json
+active/evm/tasks/**/dry-run/

active/evm/Makefile

@@ -0,0 +1,79 @@
+EVM_ROOT := $(abspath $(dir $(lastword $(MAKEFILE_LIST))))
+
+include $(EVM_ROOT)/../../Makefile
+include $(EVM_ROOT)/../../Multisig.mk
+
+.DEFAULT_GOAL := help
+
+.PHONY: help
+help:
+	@echo "Usage: make -C active/evm TASK_ID=<task-id> TASK_NETWORK=<network> <target>"
+
+# Help does not need a task. Every operational target does.
+REQUESTED_GOALS := $(if $(MAKECMDGOALS),$(MAKECMDGOALS),help)
+ifneq ($(strip $(filter-out help,$(REQUESTED_GOALS))),)
+ifeq ($(strip $(TASK_ID)),)
+$(error TASK_ID is required)
+endif
+
+TASKS_DIR := $(realpath $(EVM_ROOT)/tasks)
+TASK_DIR := $(realpath $(TASKS_DIR)/$(TASK_ID))
+ifeq ($(TASK_DIR),)
+$(error Task does not exist: tasks/$(TASK_ID))
+endif
+ifneq ($(abspath $(dir $(TASK_DIR))),$(TASKS_DIR))
+$(error TASK_ID must name one direct child of active/evm/tasks)
+endif
+
+TASK_MK := $(TASK_DIR)/Task.mk
+ifeq ($(wildcard $(TASK_MK)),)
+$(error Missing $(TASK_MK))
+endif
+include $(TASK_MK)
+
+ifeq ($(strip $(TASK_NETWORK)),)
+$(error TASK_NETWORK is required, either on the command line or in Task.mk)
+endif
+
+CONFIG_ROOT := $(realpath $(TASK_DIR)/config)
+CONFIG_DIR := $(realpath $(CONFIG_ROOT)/$(TASK_NETWORK))
+ifeq ($(CONFIG_DIR),)
+$(error Task network does not exist: tasks/$(TASK_ID)/config/$(TASK_NETWORK))
+endif
+ifneq ($(abspath $(dir $(CONFIG_DIR))),$(CONFIG_ROOT))
+$(error TASK_NETWORK must name one direct child of the task config directory)
+endif
+
+TASK_DIR_REL := tasks/$(TASK_ID)
+CONFIG_DIR_REL := $(TASK_DIR_REL)/config/$(TASK_NETWORK)
+export FOUNDRY_BROADCAST := $(TASK_DIR_REL)
+
+include $(CONFIG_DIR)/network.env
+include $(CONFIG_DIR)/.env
+
+SUPPORTED_OPERATIONS := funding gas safe-management bridge-threshold pause-bridge superchain-pause custom
+ifneq ($(words $(OPERATION)),1)
+$(error OPERATION must contain exactly one operation name)
+endif
+ifeq ($(filter $(SUPPORTED_OPERATIONS),$(OPERATION)),)
+$(error Unsupported OPERATION "$(OPERATION)"; expected one of: $(SUPPORTED_OPERATIONS))
+endif
+
+PROJECT_DIR := $(EVM_ROOT)
+SIGNER_TOOL_PATH := $(REPO_ROOT)/signer-tool
+VALIDATIONS_DIR := $(EVM_ROOT)/$(CONFIG_DIR_REL)/validations
+TASK_ORIGIN_DIR := $(EVM_ROOT)/$(CONFIG_DIR_REL)
+SIGNATURE_DIR := $(EVM_ROOT)/$(TASK_DIR_REL)/signatures/$(TASK_NETWORK)
+RPC_URL ?= $(L1_RPC_URL)
+
+ifneq ($(OPERATION),custom)
+include $(EVM_ROOT)/make/$(OPERATION).mk
+endif
+
+.PHONY: show-config
+show-config:
+	@echo "OPERATION=$(OPERATION)"
+	@echo "SCRIPT_NAME=$(SCRIPT_NAME)"
+	@echo "CONFIG_DIR=$(CONFIG_DIR_REL)"
+	@echo "FOUNDRY_BROADCAST=$(FOUNDRY_BROADCAST)"
+endif

active/evm/make/bridge-threshold.mk

@@ -0,0 +1,22 @@
+SCRIPT_NAME ?= script/common/bridge/SetThreshold.s.sol:SetThreshold
+OWNER_SAFE ?= $(INCIDENT_MULTISIG)
+L1_PORTAL ?= $(OPTIMISM_PORTAL)
+BRIDGE_THRESHOLD_ENV = OWNER_SAFE=$(OWNER_SAFE) L1_PORTAL=$(L1_PORTAL) L2_BRIDGE_VALIDATOR=$(L2_BRIDGE_VALIDATOR) NEW_THRESHOLD=$(NEW_THRESHOLD) RECORD_STATE_DIFF=$(RECORD_STATE_DIFF)
+
+.PHONY: validate-config
+validate-config:
+	@test -n "$(BASE_CONTRACTS_COMMIT)" -a "$(BASE_CONTRACTS_COMMIT)" != "TODO" || (echo "BASE_CONTRACTS_COMMIT required" && exit 1)
+	@test -n "$(OWNER_SAFE)" || (echo "OWNER_SAFE required" && exit 1)
+	@test -n "$(L1_PORTAL)" || (echo "L1_PORTAL required" && exit 1)
+	@test -n "$(L2_BRIDGE_VALIDATOR)" || (echo "L2_BRIDGE_VALIDATOR required" && exit 1)
+	@test -n "$(NEW_THRESHOLD)" || (echo "NEW_THRESHOLD required" && exit 1)
+	@test -n "$(SENDER)" -a "$(SENDER)" != "TODO" || (echo "SENDER required" && exit 1)
+	@test "$(RECORD_STATE_DIFF)" = "true" || (echo "RECORD_STATE_DIFF=true required" && exit 1)
+
+.PHONY: gen-validation
+gen-validation: validate-config deps-signer-tool
+	$(call GEN_VALIDATION,$(SCRIPT_NAME),,$(SENDER),base-signer.json,$(BRIDGE_THRESHOLD_ENV))
+
+.PHONY: execute
+execute: validate-config
+	$(BRIDGE_THRESHOLD_ENV) $(call MULTISIG_EXECUTE,$(SIGNATURES))

active/evm/make/check-dispatch.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+evm_root=$(cd "$(dirname "$0")/.." && pwd)
+task_id=".make-check-$$"
+task_dir="$evm_root/tasks/$task_id"
+trap 'rm -rf "$task_dir"' EXIT
+
+mkdir -p "$task_dir/config/testnet"
+cat > "$task_dir/config/testnet/network.env" <<'EOF'
+L1_RPC_URL=http://127.0.0.1:8545
+L2_RPC_URL=http://127.0.0.1:9545
+LEDGER_ACCOUNT=0
+EOF
+cat > "$task_dir/config/testnet/.env" <<'EOF'
+BASE_CONTRACTS_COMMIT=test
+RECORD_STATE_DIFF=true
+EOF
+
+check() {
+  local operation=$1 mode=${2:-} expected=$3
+  {
+    echo "OPERATION := $operation"
+    echo "TASK_NETWORK ?= testnet"
+    [[ -z "$mode" ]] || echo "GAS_MODE := $mode"
+  } > "$task_dir/Task.mk"
+
+  output=$(make -s -C "$evm_root" TASK_ID="$task_id" show-config)
+  grep -Fq "SCRIPT_NAME=$expected" <<< "$output"
+}
+
+check funding "" script/common/funding/Fund.s.sol:FundScript
+check gas gas-only script/common/gas/SetGasLimit.s.sol:SetGasLimit
+check gas combined script/common/gas/IncreaseEip1559ElasticityAndIncreaseGasLimit.s.sol:IncreaseEip1559ElasticityAndIncreaseGasLimitScript
+check safe-management "" script/common/safe/UpdateSigners.s.sol:UpdateSigners
+check bridge-threshold "" script/common/bridge/SetThreshold.s.sol:SetThreshold
+check pause-bridge "" script/common/bridge/PauseBridge.s.sol:PauseBridge
+check superchain-pause "" script/common/superchain/PauseSuperchainConfig.s.sol:PauseSuperchainConfig
+
+cat > "$task_dir/Task.mk" <<'EOF'
+OPERATION := custom
+TASK_NETWORK ?= testnet
+SCRIPT_NAME := script/common/ownership/TransferSystemConfigOwnership.s.sol:TransferSystemConfigOwnership
+EOF
+output=$(make -s -C "$evm_root" TASK_ID="$task_id" show-config)
+grep -Fq "SCRIPT_NAME=script/common/ownership/TransferSystemConfigOwnership.s.sol:TransferSystemConfigOwnership" <<< "$output"
+grep -Fq "FOUNDRY_BROADCAST=tasks/$task_id" <<< "$output"
+
+echo "active/evm Make dispatcher checks passed"

active/evm/make/funding.mk

@@ -0,0 +1,19 @@
+SCRIPT_NAME ?= script/common/funding/Fund.s.sol:FundScript
+FUNDING_JSON ?= $(CONFIG_DIR_REL)/funding.json
+FUNDING_ENV = OWNER_SAFE=$(OWNER_SAFE) FUNDING_JSON=$(FUNDING_JSON) RECORD_STATE_DIFF=$(RECORD_STATE_DIFF)
+
+.PHONY: validate-config
+validate-config:
+	@test -n "$(BASE_CONTRACTS_COMMIT)" -a "$(BASE_CONTRACTS_COMMIT)" != "TODO" || (echo "BASE_CONTRACTS_COMMIT required" && exit 1)
+	@test -n "$(OWNER_SAFE)" -a "$(OWNER_SAFE)" != "TODO" || (echo "OWNER_SAFE required" && exit 1)
+	@test -n "$(SENDER)" -a "$(SENDER)" != "TODO" || (echo "SENDER required" && exit 1)
+	@test "$(RECORD_STATE_DIFF)" = "true" || (echo "RECORD_STATE_DIFF=true required" && exit 1)
+	@test -f "$(FUNDING_JSON)" || (echo "Missing $(FUNDING_JSON)" && exit 1)
+
+.PHONY: gen-validation
+gen-validation: validate-config deps-signer-tool
+	$(call GEN_VALIDATION,$(SCRIPT_NAME),,$(SENDER),base-signer.json,$(FUNDING_ENV))
+
+.PHONY: execute
+execute: validate-config
+	$(FUNDING_ENV) $(call MULTISIG_EXECUTE,$(SIGNATURES))

active/evm/make/gas.mk

@@ -0,0 +1,81 @@
+GAS_MODE ?= combined
+ROLLBACK_NONCE_OFFSET ?= 1
+
+ifeq ($(GAS_MODE),gas-only)
+SCRIPT_NAME ?= script/common/gas/SetGasLimit.s.sol:SetGasLimit
+GAS_UPGRADE_ENV = OWNER_SAFE=$(OWNER_SAFE) SYSTEM_CONFIG=$(SYSTEM_CONFIG) OLD_GAS_LIMIT=$(OLD_GAS_LIMIT) NEW_GAS_LIMIT=$(NEW_GAS_LIMIT) RECORD_STATE_DIFF=$(RECORD_STATE_DIFF)
+GAS_ROLLBACK_ENV = OWNER_SAFE=$(OWNER_SAFE) SYSTEM_CONFIG=$(SYSTEM_CONFIG) OLD_GAS_LIMIT=$(NEW_GAS_LIMIT) NEW_GAS_LIMIT=$(OLD_GAS_LIMIT) SAFE_NONCE=$(ROLLBACK_SAFE_NONCE) RECORD_STATE_DIFF=$(RECORD_STATE_DIFF)
+else ifeq ($(GAS_MODE),combined)
+SCRIPT_NAME ?= script/common/gas/IncreaseEip1559ElasticityAndIncreaseGasLimit.s.sol:IncreaseEip1559ElasticityAndIncreaseGasLimitScript
+GAS_UPGRADE_ENV = OWNER_SAFE=$(OWNER_SAFE) SYSTEM_CONFIG=$(SYSTEM_CONFIG) OLD_GAS_LIMIT=$(OLD_GAS_LIMIT) NEW_GAS_LIMIT=$(NEW_GAS_LIMIT) OLD_ELASTICITY=$(OLD_ELASTICITY) NEW_ELASTICITY=$(NEW_ELASTICITY) OLD_DA_FOOTPRINT_GAS_SCALAR=$(OLD_DA_FOOTPRINT_GAS_SCALAR) NEW_DA_FOOTPRINT_GAS_SCALAR=$(NEW_DA_FOOTPRINT_GAS_SCALAR) RECORD_STATE_DIFF=$(RECORD_STATE_DIFF)
+GAS_ROLLBACK_ENV = OWNER_SAFE=$(OWNER_SAFE) SYSTEM_CONFIG=$(SYSTEM_CONFIG) OLD_GAS_LIMIT=$(NEW_GAS_LIMIT) NEW_GAS_LIMIT=$(OLD_GAS_LIMIT) OLD_ELASTICITY=$(NEW_ELASTICITY) NEW_ELASTICITY=$(OLD_ELASTICITY) OLD_DA_FOOTPRINT_GAS_SCALAR=$(NEW_DA_FOOTPRINT_GAS_SCALAR) NEW_DA_FOOTPRINT_GAS_SCALAR=$(OLD_DA_FOOTPRINT_GAS_SCALAR) SAFE_NONCE=$(ROLLBACK_SAFE_NONCE) RECORD_STATE_DIFF=$(RECORD_STATE_DIFF)
+else
+$(error GAS_MODE must be gas-only or combined)
+endif
+
+ROLLBACK_SAFE_NONCE ?= $(shell expr $(call GET_NONCE,$(OWNER_SAFE)) + $(ROLLBACK_NONCE_OFFSET))
+
+.PHONY: validate-config
+validate-config:
+	@test -n "$(BASE_CONTRACTS_COMMIT)" -a "$(BASE_CONTRACTS_COMMIT)" != "TODO" || (echo "BASE_CONTRACTS_COMMIT required" && exit 1)
+	@test -n "$(OWNER_SAFE)" -a "$(OWNER_SAFE)" != "TODO" || (echo "OWNER_SAFE required" && exit 1)
+	@test -n "$(SYSTEM_CONFIG)" -a "$(SYSTEM_CONFIG)" != "TODO" || (echo "SYSTEM_CONFIG required" && exit 1)
+	@test -n "$(SENDER)" -a "$(SENDER)" != "TODO" || (echo "SENDER required" && exit 1)
+	@test -n "$(OLD_GAS_LIMIT)" -a "$(OLD_GAS_LIMIT)" != "TODO" || (echo "OLD_GAS_LIMIT required" && exit 1)
+	@test -n "$(NEW_GAS_LIMIT)" -a "$(NEW_GAS_LIMIT)" != "TODO" || (echo "NEW_GAS_LIMIT required" && exit 1)
+	@test "$(RECORD_STATE_DIFF)" = "true" || (echo "RECORD_STATE_DIFF=true required" && exit 1)
+ifeq ($(GAS_MODE),combined)
+	@test -n "$(OLD_ELASTICITY)" -a "$(OLD_ELASTICITY)" != "TODO" || (echo "OLD_ELASTICITY required" && exit 1)
+	@test -n "$(NEW_ELASTICITY)" -a "$(NEW_ELASTICITY)" != "TODO" || (echo "NEW_ELASTICITY required" && exit 1)
+	@test -n "$(OLD_DA_FOOTPRINT_GAS_SCALAR)" -a "$(OLD_DA_FOOTPRINT_GAS_SCALAR)" != "TODO" || (echo "OLD_DA_FOOTPRINT_GAS_SCALAR required" && exit 1)
+	@test -n "$(NEW_DA_FOOTPRINT_GAS_SCALAR)" -a "$(NEW_DA_FOOTPRINT_GAS_SCALAR)" != "TODO" || (echo "NEW_DA_FOOTPRINT_GAS_SCALAR required" && exit 1)
+endif
+
+.PHONY: gen-validation
+gen-validation: validate-config deps-signer-tool
+	$(call GEN_VALIDATION,$(SCRIPT_NAME),,$(SENDER),base-signer.json,$(GAS_UPGRADE_ENV))
+
+.PHONY: gen-validation-rollback
+gen-validation-rollback: validate-config deps-signer-tool
+	$(call GEN_VALIDATION,$(SCRIPT_NAME),,$(SENDER),base-signer-rollback.json,$(GAS_ROLLBACK_ENV))
+
+.PHONY: sign-upgrade
+sign-upgrade: validate-config
+	$(GAS_UPGRADE_ENV) $(GOPATH)/bin/eip712sign --ledger --hd-paths $(LEDGER_HD_PATH) -- \
+		$(MISE_EXEC) forge script --rpc-url $(RPC_URL) $(SCRIPT_NAME) --sig "sign(address[])" "[]"
+
+.PHONY: sign-rollback
+sign-rollback: validate-config
+	$(GAS_ROLLBACK_ENV) $(GOPATH)/bin/eip712sign --ledger --hd-paths $(LEDGER_HD_PATH) -- \
+		$(MISE_EXEC) forge script --rpc-url $(RPC_URL) $(SCRIPT_NAME) --sig "sign(address[])" "[]"
+
+.PHONY: execute execute-upgrade execute-rollback
+execute: validate-config
+	$(GAS_UPGRADE_ENV) $(call MULTISIG_EXECUTE,$(SIGNATURES))
+
+execute-upgrade: execute
+
+execute-rollback: validate-config
+	$(GAS_ROLLBACK_ENV) $(call MULTISIG_EXECUTE,$(SIGNATURES))
+
+ifeq ($(GAS_MODE),combined)
+BUILDER_HARD_CAP ?= TODO
+
+.PHONY: da-scalar
+da-scalar:
+ifndef TARGET_BLOB_COUNT
+	$(error TARGET_BLOB_COUNT is required)
+endif
+	@scalar=$$(( $(NEW_GAS_LIMIT) / ($(NEW_ELASTICITY) * $(TARGET_BLOB_COUNT) * 32000) )); \
+	soft_cap=$$(( $(TARGET_BLOB_COUNT) * 32000 )); \
+	echo "NEW_DA_FOOTPRINT_GAS_SCALAR=$$scalar"; \
+	echo; \
+	echo "| Field | Value |"; \
+	echo "|-------|-------|"; \
+	echo "| Gas limit | \`$(NEW_GAS_LIMIT)\` |"; \
+	echo "| Elasticity | \`$(NEW_ELASTICITY)\` |"; \
+	echo "| DA soft-cap blob count | \`$(TARGET_BLOB_COUNT)\` |"; \
+	echo "| Calculated scalar | \`$$scalar\` |"; \
+	echo "| Implied soft cap | \`$$soft_cap\` estimated DA bytes per L2 block |"; \
+	echo "| Builder hard cap | \`$(BUILDER_HARD_CAP)\` estimated DA bytes per L2 block |"
+endif

active/evm/make/pause-bridge.mk

@@ -0,0 +1,81 @@
+SCRIPT_NAME ?= script/common/bridge/PauseBridge.s.sol:PauseBridge
+OWNER_SAFE ?= $(INCIDENT_MULTISIG)
+L1_PORTAL ?= $(OPTIMISM_PORTAL)
+SAFE_NONCE ?= $(call GET_NONCE,$(OWNER_SAFE))
+
+ZERO_ADDRESS := 0x0000000000000000000000000000000000000000
+SAFE_TX_TYPEHASH := 0xbb8310d486368db6bd6f849402fdd73ad53d316b5a4b2644ad6efe0f941286d8
+SAFE_TX_ABI := f(bytes32,address,uint256,bytes32,uint8,uint256,uint256,uint256,address,address,uint256)
+PAUSE_SIGNATURES_FILE ?= $(CONFIG_DIR_REL)/signatures-pause.txt
+UNPAUSE_SIGNATURES_FILE ?= $(CONFIG_DIR_REL)/signatures-unpause.txt
+PAUSE_BRIDGE_ENV = OWNER_SAFE=$(OWNER_SAFE) L1_PORTAL=$(L1_PORTAL) L2_BRIDGE=$(L2_BRIDGE) RECORD_STATE_DIFF=$(RECORD_STATE_DIFF)
+
+.PHONY: validate-config
+validate-config:
+	@test -n "$(BASE_CONTRACTS_COMMIT)" -a "$(BASE_CONTRACTS_COMMIT)" != "TODO" || (echo "BASE_CONTRACTS_COMMIT required" && exit 1)
+	@test -n "$(OWNER_SAFE)" || (echo "OWNER_SAFE required" && exit 1)
+	@test -n "$(L1_PORTAL)" || (echo "L1_PORTAL required" && exit 1)
+	@test -n "$(L2_BRIDGE)" || (echo "L2_BRIDGE required" && exit 1)
+	@test -n "$(SENDER)" -a "$(SENDER)" != "TODO" || (echo "SENDER required" && exit 1)
+	@test "$(RECORD_STATE_DIFF)" = "true" || (echo "RECORD_STATE_DIFF=true required" && exit 1)
+
+.PHONY: gen-validation
+gen-validation: validate-config deps-signer-tool
+	$(call GEN_VALIDATION,$(SCRIPT_NAME),,$(SENDER),base-signer.json,$(PAUSE_BRIDGE_ENV) IS_PAUSED=true)
+
+.PHONY: sign-pause
+sign-pause: validate-config
+	@rm -f "$(PAUSE_SIGNATURES_FILE)"
+	@mkdir -p "$(dir $(PAUSE_SIGNATURES_FILE))"
+	@set -e; \
+	domain_separator=$$($(MISE_EXEC) cast call $(OWNER_SAFE) "domainSeparator()(bytes32)" --rpc-url $(L1_RPC_URL)); \
+	bridge_data=$$($(MISE_EXEC) cast calldata "setPaused(bool)" true); \
+	portal_data=$$($(MISE_EXEC) cast calldata "depositTransaction(address,uint256,uint64,bool,bytes)" $(L2_BRIDGE) 0 100000 false $$bridge_data); \
+	portal_data_hash=$$($(MISE_EXEC) cast keccak "$$portal_data"); \
+	for i in $$(seq 0 19); do \
+		nonce=$$(($(SAFE_NONCE) + $$i)); \
+		echo "Signing pause with nonce $$nonce"; \
+		safe_tx=$$($(MISE_EXEC) cast abi-encode '$(SAFE_TX_ABI)' $(SAFE_TX_TYPEHASH) $(L1_PORTAL) 0 $$portal_data_hash 0 0 0 0 $(ZERO_ADDRESS) $(ZERO_ADDRESS) $$nonce); \
+		message_hash=$$($(MISE_EXEC) cast keccak "$$safe_tx"); \
+		signing_data="0x1901$${domain_separator#0x}$${message_hash#0x}"; \
+		$(GOPATH)/bin/eip712sign --ledger --hd-paths $(LEDGER_HD_PATH) -data "$$signing_data" > sign_output.tmp; \
+		cat sign_output.tmp; \
+		echo "Nonce: $$nonce" >> "$(PAUSE_SIGNATURES_FILE)"; \
+		grep -E "^Data:|^Signer:|^Signature:" sign_output.tmp >> "$(PAUSE_SIGNATURES_FILE)" || true; \
+		echo >> "$(PAUSE_SIGNATURES_FILE)"; \
+		rm -f sign_output.tmp; \
+	done
+
+.PHONY: sign-unpause
+sign-unpause: validate-config
+	@rm -f "$(UNPAUSE_SIGNATURES_FILE)"
+	@mkdir -p "$(dir $(UNPAUSE_SIGNATURES_FILE))"
+	@set -e; \
+	domain_separator=$$($(MISE_EXEC) cast call $(OWNER_SAFE) "domainSeparator()(bytes32)" --rpc-url $(L1_RPC_URL)); \
+	bridge_data=$$($(MISE_EXEC) cast calldata "setPaused(bool)" false); \
+	portal_data=$$($(MISE_EXEC) cast calldata "depositTransaction(address,uint256,uint64,bool,bytes)" $(L2_BRIDGE) 0 100000 false $$bridge_data); \
+	portal_data_hash=$$($(MISE_EXEC) cast keccak "$$portal_data"); \
+	for i in $$(seq 0 19); do \
+		nonce=$$(($(SAFE_NONCE) + $$i)); \
+		echo "Signing unpause with nonce $$nonce"; \
+		safe_tx=$$($(MISE_EXEC) cast abi-encode '$(SAFE_TX_ABI)' $(SAFE_TX_TYPEHASH) $(L1_PORTAL) 0 $$portal_data_hash 0 0 0 0 $(ZERO_ADDRESS) $(ZERO_ADDRESS) $$nonce); \
+		message_hash=$$($(MISE_EXEC) cast keccak "$$safe_tx"); \
+		signing_data="0x1901$${domain_separator#0x}$${message_hash#0x}"; \
+		$(GOPATH)/bin/eip712sign --ledger --hd-paths $(LEDGER_HD_PATH) -data "$$signing_data" > sign_output.tmp; \
+		cat sign_output.tmp; \
+		echo "Nonce: $$nonce" >> "$(UNPAUSE_SIGNATURES_FILE)"; \
+		grep -E "^Data:|^Signer:|^Signature:" sign_output.tmp >> "$(UNPAUSE_SIGNATURES_FILE)" || true; \
+		echo >> "$(UNPAUSE_SIGNATURES_FILE)"; \
+		rm -f sign_output.tmp; \
+	done
+
+.PHONY: execute-pause execute-unpause
+execute-pause: validate-config
+	$(PAUSE_BRIDGE_ENV) IS_PAUSED=true $(call MULTISIG_EXECUTE,$(SIGNATURES))
+
+execute-unpause: validate-config
+	$(PAUSE_BRIDGE_ENV) IS_PAUSED=false $(call MULTISIG_EXECUTE,$(SIGNATURES))
+
+.PHONY: check-status
+check-status:
+	$(MISE_EXEC) cast call $(L2_BRIDGE) "paused()(bool)" --rpc-url $(L2_RPC_URL)

active/evm/make/safe-management.mk

@@ -0,0 +1,19 @@
+SCRIPT_NAME ?= script/common/safe/UpdateSigners.s.sol:UpdateSigners
+OWNER_DIFF_JSON ?= $(CONFIG_DIR_REL)/OwnerDiff.json
+SAFE_MANAGEMENT_ENV = OWNER_SAFE=$(OWNER_SAFE) OWNER_DIFF_JSON=$(OWNER_DIFF_JSON) RECORD_STATE_DIFF=$(RECORD_STATE_DIFF)
+
+.PHONY: validate-config
+validate-config:
+	@test -n "$(BASE_CONTRACTS_COMMIT)" -a "$(BASE_CONTRACTS_COMMIT)" != "TODO" || (echo "BASE_CONTRACTS_COMMIT required" && exit 1)
+	@test -n "$(OWNER_SAFE)" -a "$(OWNER_SAFE)" != "TODO" || (echo "OWNER_SAFE required" && exit 1)
+	@test -n "$(SENDER)" -a "$(SENDER)" != "TODO" || (echo "SENDER required" && exit 1)
+	@test "$(RECORD_STATE_DIFF)" = "true" || (echo "RECORD_STATE_DIFF=true required" && exit 1)
+	@test -f "$(OWNER_DIFF_JSON)" || (echo "Missing $(OWNER_DIFF_JSON)" && exit 1)
+
+.PHONY: gen-validation
+gen-validation: validate-config deps-signer-tool
+	$(call GEN_VALIDATION,$(SCRIPT_NAME),,$(SENDER),base-signer.json,$(SAFE_MANAGEMENT_ENV))
+
+.PHONY: execute
+execute: validate-config
+	$(SAFE_MANAGEMENT_ENV) $(call MULTISIG_EXECUTE,$(SIGNATURES))