managed-oracle: add UUPS upgradeability to SignedProposer

[chrismaree]

What Changed

• Stacks onto managed-oracle: add Permit2 SignedProposer relay with partial-success batching #77 (chrismaree/signed-proposer); the diff contains only SignedProposer upgradeability and its deployment, documentation, and test updates.
• Uses OpenZeppelin UUPS/ERC1967, matching the mechanism used by Managed OO and OOReporter. The existing DEFAULT_ADMIN_ROLE authorizes upgrades, with no new owner, upgrade role, or ProxyAdmin contract.
• Replaces constructor configuration with a one-time initializer, locks the implementation, uses upgradeable access-control/multicall/reentrancy bases, and stores Permit2 in proxy storage.
• Deploys an implementation plus an atomically initialized proxy, logs both addresses, and updates all SignedProposer test deployments to use proxies.
• Adds focused coverage for initialization restrictions, unauthorized/non-UUPS upgrades, retained state and batching after an upgrade, and Permit2 batches signed before an upgrade.

Why

• SignedProposer needs the same upgrade mechanism as the other system contracts while preserving the address used by relayers, Permit2 signatures, and owned whitelists.
• Reusing the existing default admin keeps the authorization model minimal.

Impact

• New deployments use the proxy address for relay calls, Permit2 spender signatures, and whitelist membership/ownership.
• Compatible upgrades retain Permit2 configuration, roles, token balances, and the relay address. The default admin gains authority to replace relay logic.
• The proposal ABI, witness format, and TryMulticall implementation are unchanged. Proxy delegation adds execution overhead.
• Previously deployed direct instances cannot be upgraded in place; integrations must adopt a new proxy address for this deployment model.

High risk Sections to review with detail

• Initialization and authority: implementation initialization is disabled; the proxy initializes atomically; zero Permit2/admin addresses are rejected; only the existing default admin can authorize an upgrade.
• Storage and identity: Permit2 now lives in proxy storage alongside the inherited TryMulticall lock. Future upgrades must preserve this layout and the upgradeable bases' storage. Whitelists and Permit2 signatures must reference the proxy.
• Batch gas behavior: self-delegatecalls now pass through the proxy. Existing EIP-150 starvation and Polygon capacity tests use proxy fixtures but have not been rerun locally; their gas-sensitive expectations require validation before merging.
• Admin trust: an upgrade can change proposal execution behavior, including treatment of outstanding signatures. No separate upgrade delay or authority is introduced.

Validation

• Passed Foundry 1.3.6 forge fmt --check for all changed Solidity files.
• Passed git diff --check and manually reviewed deployment references and the stacked diff.
• Root dependencies initialized with recursive submodules and yarn install --frozen-lockfile.
• Builds and tests were not run locally, per repository instructions. New coverage is authored, not claimed passing. CI has not been awaited.

TL;DR: Adds minimal admin-authorized UUPS upgradeability to SignedProposer, stacked directly onto #77, with proxy deployment and updated documentation/coverage.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T16:51:57.119102Z	eb3e7c4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.