[SaulBuilds]

What

Adds citrate_sdk.verify, which verifies Solidity source on CitrateScan (chain 40204) through the explorer's Etherscan-compatible API (https://explorer.citrate.ai/api). It mirrors @citratelabs/sdk (CitrateNetwork/citrate-sdk-js#40).

• verify_contract(chain_id=, address=, contract=, build_info= | standard_json_input=, constructor_args=, explorer_url=, api_key=, ...) builds the standard JSON input from a forge or hardhat build-info, POSTs verifysourcecode, and polls checkverifystatus. It returns a VerifyResult dataclass.
  • It sends only the sources in the contract's metadata, as forge and hardhat-verify do.
  • The compiler version is read from the metadata, because forge 1.5.1 writes solcLongVersion without the commit.
• deploy_and_verify(client=, chain_id=, build_info=, contract=, args=[...]):
  • deploys through the new CitrateClient.deploy_contract, which signs with the client's key after the same genesis and chain-id checks as every transaction, and estimates gas unless gas_limit is given;
  • then verifies with the creation tx hash, retrying while the explorer has not indexed the contract.
• _send_transaction now signs through a shared _sign_and_send. deploy_contract uses it with to=None, and existing callers behave as before.
• Typed errors, all VerificationError(CitrateError):
  • BuildInfoError
  • VerificationFailedError
  • VerificationRejectedError
  • VerificationRateLimitedError
  • VerificationTimeoutError
  • ExplorerResponseError
• load_build_info(path) follows a hardhat artifact's .dbg.json.
• A README section with chain 40204 examples. It includes two notes from the explorer docs: forge needs --verifier custom, and hardhat-verify needs a per-network apiKey.

Data source: CitrateScan GET|POST /api?module=contract&action=verifysourcecode|checkverifystatus. The envelope is Etherscan's {status, message, result}.

How it was tested

• tests/test_verify.py: 26 tests against a local HTTP recorder. The recorder is a test-only fake.
  • The fixtures come from real tools: forge 1.5.1 and hardhat 2.29.1 build-infos, plus the requests forge --verifier custom and hardhat-verify 2.1.3 sent to a recording server. See tests/fixtures/verify/README.md.
  • The tests check that our form equals forge's request, and hardhat-verify's request plus chainid and the corrected spelling. They also cover constructorArguements, polling and terminal states, refusals, rate-limit retry, timeout and bad input.
• tests/test_verify_deploy_anvil.py is marked integration and env-gated (CITRATE_VERIFY_ANVIL_RPC, CITRATE_VERIFY_ANVIL_KEY). On a local anvil --chain-id 40204 it deploys through CitrateClient, then checks that the creation tx input is exactly the creation code plus the encoded args, and that the submission names that tx. It passed locally.
• Red: c476233 (module missing). Green: 78a4ba2. pytest: 883 → 909 passed (49 → 50 skipped, the gated anvil test). ruff check . and mypy . are clean.

Not verified: the live explorer. Verification v2 is not deployed yet, so nothing here has run against explorer.citrate.ai.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FPJzHN7kVR6UzVEJDEY9Yc

[BerryManifold]

Automated Codex static review of 78a4ba2d277255943d81f902c026a905a04da6a0 is complete. Result: blockers; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.

[Matr0xshka]

Automated Codex static review of 78a4ba2d277255943d81f902c026a905a04da6a0 is complete. Result: blockers; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.

[BerryManifold]

Automated Codex static review of 51a8dbce75f445f51627ee9870d69ea60837aaac is complete. Result: blockers; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.

[Matr0xshka]

Automated Codex static review of 51a8dbce75f445f51627ee9870d69ea60837aaac is complete. Result: blockers; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.

[Matr0xshka]

MAC independent reviewer agent (rounds 1 and 2), not Codex, not DGX, not a human reviewer.

Reviewed head 51a8dbc. No P1/P2.

• Python 3.12: 868 passed, 50 skipped (economics simulation deselected); CI full suite 920 passed, 50 skipped.
• Revert checks: disabling the transient retry fails 4 tests; reverting the key scrub fails the key regression test.
• Round-1 P2s resolved: chain_id is optional; transient retry with capped backoff; not-indexed interval; the API key is redacted from str, repr, details and traceback (raised from None); DEPLOY_FAILED is tested on the real status-0 path.
• P3: backoff exponent overflow when poll_interval and transient_backoff_max are both 0; context still carries the URL for tooling that ignores the suppress flag.