fix: TrustGateHook — selector mismatch, caller auth, admin events

[JhiNResH]

Fixes the blocking issues raised in review of PR #9.

Changes

CRITICAL fix — FUND_SEL selector

The original hook computed keccak256("fund(uint256,bytes)") but AgenticCommerce.fund is fund(uint256,uint256,bytes). The selector never matched, so client trust was never checked at the fund stage.

Fix: Inherit BaseERC8183Hook instead of raw IACPHook. This gives correct selector constants for free (they live in BaseERC8183Hook and match AgenticCommerce). The hook now overrides _preFund/_preSubmit/_postComplete/_postReject virtual functions — no manual selector dispatch needed.

HIGH fix — caller authentication

BaseERC8183Hook provides the onlyERC8183(jobId) modifier, which validates that msg.sender is the ERC-8183 core or the job's registered hook. Inheriting it adds this guard automatically. No extra code required.

MEDIUM fixes

• agentId == 0 collision — added mapping(address => bool) public registered to track existence separately from the agentId value. Wallets with agentId = 0 can now be registered correctly.
• Admin events — setAgentId, setAgentIds, setThreshold, and setOracle now emit AgentIdSet, ThresholdUpdated, and OracleUpdated respectively.
• Oracle zero-address guard — require(oracle_ != address(0)) in constructor and setOracle.

LOW fixes

• README: link now points to TrustGateHook.sol (was RNWYTrustGateHook.sol).

Constructor change (breaking)

The constructor gains a new first parameter:

// Before
constructor(address oracle_, uint8 threshold_, uint256 chainId_, string memory registry_)

// After
constructor(address erc8183Contract_, address oracle_, uint8 threshold_, uint256 chainId_, string memory registry_)

erc8183Contract_ is required by BaseERC8183Hook and stored as immutable. This is the AgenticCommerce core address (or MultiHookRouter address if used behind a router).

[JhiNResH]

Differential Security Review — APPROVED

Reviewer: JhiNResH / Claude (claude-sonnet-4-6)
Date: 2026-04-18
Scope: +249, -3 — TrustGateHook rewrite + BaseERC8183Hook auth hardening

---

Verdict: ✅ APPROVE — 0 new vulnerabilities introduced

All CRITICAL and HIGH findings from the PR #9 review are correctly resolved. Two additional findings from the 8-agent solidity audit are also fixed.

Fixes verified

Finding	Severity	Verified
FUND_SEL wrong selector	CRITICAL	✅ Eliminated — BaseERC8183Hook inheritance removes manual selectors entirely
No onlyERC8183 caller auth	HIGH	✅ Inherited modifier + _isAuthorizedRouter gate (default false)
agentId=0 sentinel collision	MEDIUM	✅ registered bool mapping tracks existence separately
Admin mutations emit no events	MEDIUM	✅ AgentIdSet, ThresholdUpdated, OracleUpdated on all mutations
setOracle zero-address	LOW	✅ require(oracle_ != address(0)) in constructor and setter
README broken link	LOW	✅ TrustGateHook.sol
Zero-budget client trust bypass	HIGH (audit F1)	✅ _preSubmit reads job.status and checks client when Open
Cross-hook invocation via job.hook	HIGH (audit F3)	✅ _isAuthorizedRouter gate — secure by default, opt-in for routers

BaseERC8183Hook modifier change analysis

The onlyERC8183 tightening is correct. BEFORE: any address equal to job[jobId].hook could call beforeAction/afterAction on any hook, enabling cross-hook invocation. AFTER: the fallback path requires _isAuthorizedRouter() to return true first — which defaults to false. Only the erc8183Contract itself can call hooks unless a hook explicitly opts into router support. Blast radius = 1 inheritor (TrustGateHook), which correctly takes the default.

Zero-budget path correctness

_preSubmit calls getJob(jobId) while the job is still in pre-transition state (inside beforeAction). If status == Open, both provider AND client trust are checked. For the funded path (status == Funded), client was already gated in _preFund. All paths covered. ✅

Residual items (pre-existing, not blocking merge)

1. [MEDIUM] No timelock on setOracle — zero-address guard added, delay still absent. Consider TimelockController before mainnet.
2. [LOW] threshold = 0 silently disables the gate — no minimum validation. Document or add require(threshold_ > 0).
3. [HIGH risk factor] Zero test coverage on all new production code. Recommend adding Foundry tests before production deployment.

Full report: DIFFERENTIAL_REVIEW_PR32.md in reviewer worktree.