refactor(accounting): inline bridge/lock/history modules into Accounting

Sapphire's 64 KiB runtime limit removes the need for the size-driven
delegatecall split, so all bridge, lock, and history logic now lives in a
single resident Accounting contract. Removes the fallback selector dispatcher,
the mirrored storage prefix, module pointers, and cross-contract delegatecall;
BridgeLib remains a separately-deployed linked library.

History append helpers become internal so history cannot be forged by an
external caller. Solidity tests call selectors directly and add
selector-completeness and history-append-absence guards. Off-chain ABI
collapses to Accounting + BridgeLib and drops module resolution and the
bridgeModule startup check. Accounting NatSpec normalized to block style with
full @param/@return coverage.

Author: rube-de

.github/workflows/ci.yml

@@ -87,14 +87,6 @@ jobs:
         run: |
           test -f solidity/artifacts/contracts/Accounting.sol/Accounting.json || (echo "Solidity artifacts not found!" && exit 1)
 
-      - name: Storage layout invariants (delegatecall safety)
-        # Pre-flight the Accounting<->module delegatecall invariants (storage
-        # layout, fallback dispatcher, signer/secret isolation) with --bail, so a
-        # slot mismatch fails fast instead of being masked by the full suite below.
-        run: cd solidity && bun run test:hardhat -- --bail --grep "storage|fallback dispatcher|setBridgeModule|signer isolation"
-        env:
-          BASE_SEPOLIA_RPC_URL: ${{ secrets.BASE_SEPOLIA_RPC_URL }}
-
       - name: Run Solidity tests
         run: make solidity-test
 

Makefile

@@ -51,12 +51,11 @@ solidity-test:
 	cd solidity && bun run test
 
 # Mirrors the solidity job in .github/workflows/ci.yml: clean compile,
-# size gate, upgrade-safety, targeted storage-layout pre-flight, full suite.
+# size gate, upgrade-safety, full suite.
 # Run before pushing if you want CI-equivalent verification locally.
 solidity-ci: solidity-clean solidity-build
 	cd solidity && bun run check:size
 	cd solidity && npx hardhat run scripts/validate-upgrade.ts
-	cd solidity && bun run test -- --bail --grep "storage|fallback dispatcher|setBridgeModule|signer isolation"
 	cd solidity && bun run test
 
 solidity-clean:

README.md

@@ -10,7 +10,7 @@ A reusable library for apps running in ROFL that enables:
 
 | Path | What's there |
 |------|--------------|
-| [`solidity/`](solidity/README.md) | On-chain contracts (Accounting, AccountingHistoryModule, EVMSignerAndVerifier, AccountingSiweAuth), deployment & Hardhat tasks. |
+| [`solidity/`](solidity/README.md) | On-chain contracts (Accounting, BridgeLib, EVMSignerAndVerifier, AccountingSiweAuth), deployment & Hardhat tasks. |
 | [`src/`](src/README.md) | Python service that runs in the ROFL TEE — deposit verification, sweep state machine, withdrawal resolution. |
 | [`docs/api-reference.md`](docs/api-reference.md) | HTTP API reference: request/response shapes, auth, error codes. |
 

solidity/README.md

@@ -6,8 +6,8 @@ A cross-chain accounting system on Oasis Sapphire. Confidential balance manageme
 
 The Accounting module consists of these main components:
 
-- **Accounting.sol** — Core accounting contract (UUPS upgradeable). Manages balances, deposits, locks, transfers, withdrawals, and emergency withdraws.
-- **AccountingHistoryModule.sol** — non-upgradeable delegated history module. Accounting owns the history storage; the module supplies history read/write code via `delegatecall`.
+- **Accounting.sol** — Core accounting contract (UUPS upgradeable). Manages balances, deposits, locks, transfers, withdrawals, emergency withdraws, per-user history, and the ROSE bridge.
+- **BridgeLib.sol** — delegatecall-linked library holding the bridge-withdrawal validation and signing helpers used by `Accounting`.
 - **EVMSignerAndVerifier.sol** — Sapphire-confidential EVM keypair management; signs sweep, gas-funding, and withdrawal transactions for source chains using the `EIP155Signer` precompile.
 - **EIP712SignatureVerifier.sol** — Verifies user-authored EIP-712 signatures for transfer / lock / withdrawal operations.
 - **auth/AccountingSiweAuth.sol** — SIWE-based authentication for confidential Sapphire view calls.
@@ -127,8 +127,8 @@ bun run coverage
 
 ## Deployment
 
-The `deploy` task provisions the SIWE auth helper, Accounting proxy/implementation,
-AccountingHistoryModule, and links Accounting to the module in the same deploy task.
+The `deploy` task provisions the SIWE auth helper, the `BridgeLib` library, and the
+Accounting proxy/implementation (with `BridgeLib` linked) in a single deploy task.
 
 ### Deploy to Sapphire Localnet
 
@@ -142,8 +142,8 @@ npx hardhat deploy --network sapphire-localnet --roflappid <rofl1…>
 npx hardhat deploy --network sapphire-testnet --roflappid <rofl1…>
 ```
 
-Outputs: SIWE-auth address, Accounting proxy/implementation address,
-AccountingHistoryModule address, EVM signing address, owner.
+Outputs: SIWE-auth address, BridgeLib address, Accounting proxy/implementation
+address, EVM signing address, owner.
 
 ### Standalone subtasks
 
@@ -183,22 +183,10 @@ If the task cannot resolve `siweAuth()` from the existing proxy, pass it explici
 npx hardhat upgrade --network sapphire-testnet --proxy <proxy-address> --siweauth <siwe-auth-address>
 ```
 
-If an AccountingHistoryModule was deployed separately, attach it during upgrade:
-```shell
-npx hardhat upgrade --network sapphire-testnet --proxy <proxy-address> --history <history-module-address>
-```
-
-The upgrade task validates the module marker and contract code. When upgrading from a
-pre-AccountingHistoryModule deployment, the task deploys or validates the module before upgrading
-Accounting, then links it with `upgradeToAndCall` so the upgraded proxy is never left without
-history code.
-
-Existing history entries stored inside the old Accounting proxy remain in Accounting storage and
-are read by the delegated module after upgrade.
-
-`getHistory` is exposed on Accounting and delegates to `AccountingHistoryModule` at the proxy
-address. `Accounting.historyModule()` returns the module code address, not a storage-owning
-history contract.
+The `upgrade` task links `BridgeLib` into the new implementation automatically. `getHistory`
+is a resident `Accounting` view — history is stored and read directly in the Accounting proxy's
+own storage (the append paths are internal-only, so there is no external surface to forge
+entries).
 
 #### 3. Update the README
 
@@ -282,7 +270,7 @@ User-driven escape hatch from a per-user deposit address, with no ROFL involveme
 
 | Task | Purpose |
 |------|---------|
-| `deploy` | Deploy Accounting + AccountingHistoryModule + SIWE auth |
+| `deploy` | Deploy BridgeLib + Accounting (BridgeLib linked) + SIWE auth |
 | `deploy-siwe-auth` | Deploy `AccountingSiweAuth` standalone |
 | `force-import` | Import an existing proxy into hardhat-upgrades |
 | `upgrade` | UUPS upgrade Accounting implementation |
@@ -308,7 +296,7 @@ Run `npx hardhat <task> --help` for parameter details.
 | AccountingSiweAuth | `0xFc97d47F0bc8f4E50333D34c281705E0666D3fD7` |
 | Accounting (Proxy) | `0xad3C76e4E621C0cfF7540479Ee9B0A945723A642` |
 | Accounting (Implementation) | `0x12fb6720c445aa2d38009eb64e191e26C30b4CAA` (refresh after each upgrade) |
-| AccountingHistoryModule | TBD after deployment |
+| BridgeLib | TBD after deployment |
 
 **ROFL App ID:** `rofl1qrmnjkx47f4tcfvfclnrtj2rad82akeum5jcpe8y`
 
@@ -326,15 +314,15 @@ Run `npx hardhat <task> --help` for parameter details.
 | AccountingSiweAuth | TBD |
 | Accounting (Proxy) | TBD |
 | Accounting (Implementation) | TBD |
-| AccountingHistoryModule | TBD |
+| BridgeLib | TBD |
 
 ## Security Considerations
 
 - **Trust anchor for deposits:** ROFL TEE attestation. `creditDeposit` is gated by `roflEnsureAuthorizedOrigin(roflAppID)` — no on-chain transaction proof is verified
 - **Confidential signing:** Sapphire's `EIP155Signer` + `SIGN_DIGEST` precompile keeps the contract-held EVM private key inside the secure environment; signed transactions are returned only to authorized callers
 - **EIP-712:** All user-authored balance operations require typed-data signatures, validated by `EIP712SignatureVerifier`
 - **Signed view-call auth:** `onlyROFLQuery` matches `msg.sender` against the ROFL-published `roflSignerAddress`. `roflEnsureAuthorizedOrigin` is unavailable inside `eth_call`, so signed-query reads use this alternative gate
-- **History module:** Accounting stores history in its own proxy storage and delegates history code to `AccountingHistoryModule`. Only the owner can update the module pointer; deployment tasks validate the module marker before linking.
+- **History:** Accounting stores and reads per-user history in its own storage via resident, internal-only append paths — there is no external history-append selector, so entries cannot be forged.
 - **1-block delays** on `resolveWithdrawal` and `executeEmergencyWithdraw` mitigate same-block read-then-act simulation attacks
 
 ## Development
@@ -344,7 +332,7 @@ Run `npx hardhat <task> --help` for parameter details.
 ```
 contracts/
 ├── Accounting.sol              # Main accounting contract (UUPS proxy)
-├── AccountingHistoryModule.sol # Delegated history read/write code
+├── BridgeLib.sol               # Bridge validation/signing library (delegatecall-linked)
 ├── EVMSignerAndVerifier.sol    # EVM keypairs + tx signing
 ├── EIP712SignatureVerifier.sol # User auth via EIP-712
 ├── Types.sol                   # Shared structs and enums