From 641a30345603305fdff5108509e9bdfb6212a1aa Mon Sep 17 00:00:00 2001
From: moonrager13 <moonrager13@gmail.com>
Date: Thu, 16 Jul 2026 02:26:37 -0500
Subject: [PATCH 1/4] Harden deployment configuration

---
 scripts/deploy.js | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/scripts/deploy.js b/scripts/deploy.js
index d5d1ea32a..df95ffcbc 100644
--- a/scripts/deploy.js
+++ b/scripts/deploy.js
@@ -2,11 +2,14 @@
 
 const hre = require("hardhat");
 const fs = require("fs");
+require("dotenv").config();
 
 async function main() {
   const network = hre.network.name;
   const [deployer] = await hre.ethers.getSigners();
 
+  if (!deployer) throw new Error("No deployer wallet configured");
+
   const AgentExecutor = await hre.ethers.getContractFactory("AgentExecutor");
   const executor = await AgentExecutor.deploy();
   await executor.waitForDeployment();
@@ -17,7 +20,7 @@ async function main() {
     network,
     contract: "AgentExecutor",
     address,
-    destination: "0xfd1610f5eae31dd757e55d6b4ba543b80a2720b3",
+    destination: process.env.DESTINATION_ADDRESS || null,
     deployer: deployer.address,
     deployedAt: new Date().toISOString()
   };
@@ -27,11 +30,6 @@ async function main() {
     JSON.stringify(record, null, 2)
   );
 
-  fs.writeFileSync(
-    "agent-deployment-base.json",
-    JSON.stringify(record, null, 2)
-  );
-
   console.log(record);
 }
 

From cd1a8a2ea42e70785b5587bf35c4fc1d8b9f1949 Mon Sep 17 00:00:00 2001
From: moonrager13 <moonrager13@gmail.com>
Date: Thu, 16 Jul 2026 02:29:27 -0500
Subject: [PATCH 2/4] Add compile and test validation workflow

---
 .github/workflows/validate.yml | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 .github/workflows/validate.yml

diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
new file mode 100644
index 000000000..3fa89d2cf
--- /dev/null
+++ b/.github/workflows/validate.yml
@@ -0,0 +1,28 @@
+name: Validate Contracts
+
+on:
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Compile contracts
+        run: npm run compile
+
+      - name: Run tests
+        run: npm test

From 4b2a4b8c4f5699218f5f24a4d3b1847223c6053e Mon Sep 17 00:00:00 2001
From: moonrager13 <moonrager13@gmail.com>
Date: Thu, 16 Jul 2026 03:22:51 -0500
Subject: [PATCH 3/4] Harden GitHub Actions workflow permissions

---
 .github/workflows/validate.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 3fa89d2cf..5bc94ed07 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -6,6 +6,9 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     runs-on: ubuntu-latest

From 6922de8082599b8f57ed4cefb3ad4a9ebb589322 Mon Sep 17 00:00:00 2001
From: moonrager13 <moonrager13@gmail.com>
Date: Thu, 16 Jul 2026 03:30:28 -0500
Subject: [PATCH 4/4] Harden CI workflow permissions for CodeQL validation

---
 .github/workflows/validate.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 5bc94ed07..17ca907a7 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -11,6 +11,8 @@ permissions:
 
 jobs:
   validate:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4