feat: open-salt deterministic clone variant (ICloneableFactoryV4)

The deploy half of rainlanguage/rain.factory#51, which was written against the
pre-split rain.factory tree. Five of that PR's eight files targeted paths
rain.factory#47 deleted; they land here instead.

CloneFactory gains a second deterministic entry point whose CREATE2 salt is the
caller-supplied salt verbatim, so the clone address is
CREATE2(factory, salt, EIP1167(impl)) with no identity in the derivation:

  cloneDeterministicOpenSalt(address implementation, bytes data, bytes32 salt)
  predictDeterministicAddressOpenSalt(address implementation, bytes32 salt)

cloneDeterministic and predictDeterministicAddress are untouched: their
msg.sender namespacing is a guarantee other consumers rely on, so this is purely
additive and the two derivations are provably disjoint (a fuzz test asserts no
(implementation, salt, deployer) maps to the same address under both).
_requireImplementationCode and _initializeClone are reused as-is, so
clone-and-initialize stays atomic and the open variant's failure modes are
identical to the existing one.

The rain-factory Soldeer pin moves 0.1.5 -> 0.1.7 and every versioned import
prefix moves with it, because ICloneableFactoryV4 only exists from 0.1.7. That
version is not published until rain.factory#51 merges, so this branch cannot
resolve its dependencies until then.

No hand-authored src/generated/0_1_6/ dir is carried over. Under the rolling
candidate model this branch is stacked on, the snapshot that describes current
source is src/generated/candidate/, regenerated by BuildPointers; a numbered dir
is frozen only by script/cut-release.sh at tag time. candidate/ is regenerated
here and lands on the same address 0x19272bCcFcb032eaC545E74ADFa168fDeD3e8d83
and codehash 0x1a16009998834f07d5ccab032c39377f6528870eec5abd47817f9467187b4012
that #51's hand-authored 0_1_6 dir recorded.

The frozen-snapshot dirs 0_1_3, 0_1_4 and 0_1_5 are untouched.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: claude

.gas-snapshot

@@ -1,19 +1,31 @@
-CloneFactoryCloneDeterministicTest:testCloneDeterministicEvent(bytes32,bytes) (runs: 2048, μ: 421457, ~: 371564)
-CloneFactoryCloneDeterministicTest:testCloneDeterministicInitializeFailureFails(bytes32,bytes32) (runs: 2048, μ: 161266, ~: 161266)
-CloneFactoryCloneDeterministicTest:testCloneDeterministicManyClonesPerImpl(bytes32,bytes32,bytes) (runs: 2048, μ: 569724, ~: 482275)
-CloneFactoryCloneDeterministicTest:testCloneDeterministicMatchesPredict(bytes32,bytes) (runs: 2048, μ: 423089, ~: 372826)
-CloneFactoryCloneDeterministicTest:testCloneDeterministicSaltIsAbiEncodeHash(address,bytes32,address) (runs: 2048, μ: 4686, ~: 4686)
-CloneFactoryCloneDeterministicTest:testCloneDeterministicSenderScoped(bytes32,bytes,address,address) (runs: 2048, μ: 585442, ~: 485815)
-CloneFactoryCloneDeterministicTest:testCloneDeterministicZeroImplementationCodeSize(address,bytes,bytes32) (runs: 2048, μ: 10699, ~: 10678)
-LibCloneFactoryDeployCandidateTest:testCandidateCreationDeploysToPinnedAddress() (gas: 316633)
+CloneFactoryCloneDeterministicOpenSaltTest:testCloneDeterministicOpenSaltCallerIndependent(bytes32,bytes,address,address) (runs: 2048, μ: 582462, ~: 439968)
+CloneFactoryCloneDeterministicOpenSaltTest:testCloneDeterministicOpenSaltDiffersFromSenderNamespaced(address,bytes32,address) (runs: 2048, μ: 5400, ~: 5400)
+CloneFactoryCloneDeterministicOpenSaltTest:testCloneDeterministicOpenSaltDoesNotConsumeNamespacedSalt(bytes32,bytes) (runs: 2048, μ: 574640, ~: 436159)
+CloneFactoryCloneDeterministicOpenSaltTest:testCloneDeterministicOpenSaltEvent(bytes32,bytes) (runs: 2048, μ: 418423, ~: 349063)
+CloneFactoryCloneDeterministicOpenSaltTest:testCloneDeterministicOpenSaltInitializeFailureFails(bytes32,bytes32) (runs: 2048, μ: 164888, ~: 164888)
+CloneFactoryCloneDeterministicOpenSaltTest:testCloneDeterministicOpenSaltManyClonesPerImpl(bytes32,bytes32,bytes) (runs: 2048, μ: 568887, ~: 437277)
+CloneFactoryCloneDeterministicOpenSaltTest:testCloneDeterministicOpenSaltMatchesPredict(bytes32,bytes) (runs: 2048, μ: 419757, ~: 349902)
+CloneFactoryCloneDeterministicOpenSaltTest:testCloneDeterministicOpenSaltPredictCallerIndependent(address,bytes32,address,address) (runs: 2048, μ: 8766, ~: 8766)
+CloneFactoryCloneDeterministicOpenSaltTest:testCloneDeterministicOpenSaltSaltIsVerbatim(address,bytes32) (runs: 2048, μ: 4262, ~: 4262)
+CloneFactoryCloneDeterministicOpenSaltTest:testCloneDeterministicOpenSaltSecondDeployReverts(bytes32,bytes,bytes,address,address) (runs: 2048, μ: 1040442091, ~: 1040442127)
+CloneFactoryCloneDeterministicOpenSaltTest:testCloneDeterministicOpenSaltZeroImplementationCodeSize(address,bytes,bytes32) (runs: 2048, μ: 10701, ~: 10678)
+CloneFactoryCloneDeterministicTest:testCloneDeterministicEvent(bytes32,bytes) (runs: 2048, μ: 418483, ~: 349123)
+CloneFactoryCloneDeterministicTest:testCloneDeterministicInitializeFailureFails(bytes32,bytes32) (runs: 2048, μ: 161288, ~: 161288)
+CloneFactoryCloneDeterministicTest:testCloneDeterministicManyClonesPerImpl(bytes32,bytes32,bytes) (runs: 2048, μ: 569073, ~: 437463)
+CloneFactoryCloneDeterministicTest:testCloneDeterministicMatchesPredict(bytes32,bytes) (runs: 2048, μ: 420117, ~: 350262)
+CloneFactoryCloneDeterministicTest:testCloneDeterministicSaltIsAbiEncodeHash(address,bytes32,address) (runs: 2048, μ: 4708, ~: 4708)
+CloneFactoryCloneDeterministicTest:testCloneDeterministicSenderScoped(bytes32,bytes,address,address) (runs: 2048, μ: 583541, ~: 441047)
+CloneFactoryCloneDeterministicTest:testCloneDeterministicZeroImplementationCodeSize(address,bytes,bytes32) (runs: 2048, μ: 10717, ~: 10700)
+LibCloneFactoryDeployCandidateTest:testCandidateCreationDeploysToPinnedAddress() (gas: 339992)
+LibCloneFactoryDeployCandidateTest:testCandidateDeployedBytecodeServesBothEntryPoints() (gas: 733209)
 LibCloneFactoryDeployCandidateTest:testCandidateIsTheAliasedSnapshot() (gas: 3708)
-LibCloneFactoryDeployCandidateTest:testCandidateRuntimeHashesToBytecodeHash() (gas: 879)
-LibCloneFactoryDeployCandidateTest:testCandidateSelfConsistent() (gas: 4706)
+LibCloneFactoryDeployCandidateTest:testCandidateRuntimeHashesToBytecodeHash() (gas: 928)
+LibCloneFactoryDeployCandidateTest:testCandidateSelfConsistent() (gas: 4791)
 LibCloneFactoryDeployTaggedConstantsTest:testCloneFactory_0_1_3_CreationDeploysToPinnedAddress() (gas: 240145)
 LibCloneFactoryDeployTaggedConstantsTest:testCloneFactory_0_1_3_RuntimeHashesToBytecodeHash() (gas: 755)
 LibCloneFactoryDeployTaggedConstantsTest:testCloneFactory_0_1_4_CreationDeploysToPinnedAddress() (gas: 240146)
 LibCloneFactoryDeployTaggedConstantsTest:testCloneFactory_0_1_4_RuntimeHashesToBytecodeHash() (gas: 755)
 LibCloneFactoryDeployTaggedConstantsTest:testCloneFactory_0_1_5_CreationDeploysToPinnedAddress() (gas: 316590)
 LibCloneFactoryDeployTaggedConstantsTest:testCloneFactory_0_1_5_RuntimeHashesToBytecodeHash() (gas: 922)
-LibCloneFactoryDeployTest:testDeployAddress() (gas: 315988)
-LibCloneFactoryDeployTest:testExpectedCodeHash() (gas: 311566)
+LibCloneFactoryDeployTest:testDeployAddress() (gas: 339275)
+LibCloneFactoryDeployTest:testExpectedCodeHash() (gas: 334816)

CLAUDE.md

@@ -68,8 +68,23 @@ as the `rain-factory` Soldeer dependency, so they are read under
 `dependencies/rain-factory-<version>/src/interface/`.
 
 - `src/concrete/CloneFactory.sol` — The single concrete implementation of
-  `ICloneableFactoryV3`. Uses OpenZeppelin `Clones.cloneDeterministic()`; there
-  is no plain `clone()`.
+  `ICloneableFactoryV4`. Uses OpenZeppelin `Clones.cloneDeterministic()` for
+  both deterministic entry points; there is no plain `clone()`. The two entry
+  points differ ONLY in the salt they pass to `Clones`:
+  - `cloneDeterministic` / `predictDeterministicAddress` (declared on
+    `ICloneableFactoryV3`, which V4 extends) namespace the caller-supplied salt
+    by `msg.sender` via `_effectiveSalt`, so a caller's `(implementation, salt)`
+    address cannot be reached by another account.
+  - `cloneDeterministicOpenSalt` / `predictDeterministicAddressOpenSalt` pass
+    the caller-supplied salt verbatim, so the address carries no identity and
+    anyone can deploy it. Only safe for implementations whose `initialize`
+    takes no caller-controlled authority — the NatSpec on
+    `ICloneableFactoryV4.cloneDeterministicOpenSalt` is the spec for that
+    condition, and it lives in rain.factory, not here.
+
+  Both share `_requireImplementationCode` and `_initializeClone`, so
+  clone-and-initialize is atomic and the failure modes are identical across the
+  two.
 - `src/lib/LibCloneFactoryDeploy.sol` — Deterministic deployment address and
   codehash constants (generated; aliases the rolling `src/generated/candidate/`
   snapshot).

README.md

@@ -10,6 +10,31 @@ here as the `rain-factory` Soldeer package. Consumers that need only the
 interfaces depend on `rain-factory`; consumers that need the deployed
 address/codehash pins depend on `rain-factory-deploy`.
 
+## Entry points
+
+`CloneFactory` implements `ICloneableFactoryV4`, letting any compatible
+`ICloneableV2` contract be cloned as an EIP1167 proxy and initialized
+atomically. It offers two deterministic (`CREATE2`) entry points that differ
+only in how the salt is derived:
+
+- `cloneDeterministic` namespaces the caller-supplied salt by `msg.sender`, so
+  nobody else can reach the caller's address — but the deploying account is
+  baked into that address forever.
+- `cloneDeterministicOpenSalt` uses the caller-supplied salt verbatim, so the
+  address is a function of `(implementation, salt)` and the factory alone: every
+  account reaches the same address, and so can anyone. That also makes it the
+  same address across chains, but only where both the factory and the
+  implementation are themselves at the same address on each chain — `CREATE2`
+  hashes the factory, and the EIP1167 creation code it hashes contains the
+  implementation.
+
+Open-salt is ONLY safe for implementations whose `initialize` takes no
+caller-controlled authority: clone-and-initialize is atomic and runs once, so
+the first deployer's `data` sets the clone's authority permanently, with no
+recovery. Read the NatSpec on
+`ICloneableFactoryV4.cloneDeterministicOpenSalt` (in `rain.factory`) before
+using it — the qualifying condition is stated there, not here.
+
 ## Snapshots
 
 `src/generated/` holds two kinds of deploy-pin snapshot, both with the same file

foundry.toml

@@ -40,7 +40,7 @@ forge-std = "1.16.1"
 "rain-extrospection" = "0.1.1"
 "rain-deploy" = "0.1.3"
 "rain-sol-codegen" = "0.1.0"
-"rain-factory" = "0.1.5"
+"rain-factory" = "0.1.7"
 
 [soldeer]
 recursive_deps = false

src/concrete/CloneFactory.sol

@@ -2,8 +2,12 @@
 // SPDX-FileCopyrightText: Copyright (c) 2020 Rain Open Source Software Ltd
 pragma solidity =0.8.25;
 
-import {ICloneableV2, ICLONEABLE_V2_SUCCESS} from "rain-factory-0.1.5/src/interface/ICloneableV2.sol";
-import {ICloneableFactoryV3} from "rain-factory-0.1.5/src/interface/ICloneableFactoryV3.sol";
+import {ICloneableV2, ICLONEABLE_V2_SUCCESS} from "rain-factory-0.1.7/src/interface/ICloneableV2.sol";
+// `ICloneableFactoryV3` is imported for the `@inheritdoc` references on the
+// functions it declares; `ICloneableFactoryV4` inherits rather than redeclares
+// them, so the tag must name V3 and V3 must be in scope here.
+import {ICloneableFactoryV3} from "rain-factory-0.1.7/src/interface/ICloneableFactoryV3.sol";
+import {ICloneableFactoryV4} from "rain-factory-0.1.7/src/interface/ICloneableFactoryV4.sol";
 import {Clones} from "@openzeppelin-contracts-5.6.1/proxy/Clones.sol";
 
 /// Thrown when an implementation has zero code size which is always a mistake.
@@ -13,15 +17,21 @@ error ZeroImplementationCodeSize();
 error InitializationFailed();
 
 /// @title CloneFactory
-/// @notice A fairly minimal implementation of `ICloneableFactoryV3` that uses
+/// @notice A fairly minimal implementation of `ICloneableFactoryV4` that uses
 /// Open Zeppelin `Clones` to create EIP1167 clones of a reference bytecode. The
 /// reference bytecode MUST implement `ICloneableV2`.
 ///
-/// `cloneDeterministic` deploys via `CREATE2` at a pre-computable address
-/// (`predictDeterministicAddress`), namespacing the caller-supplied salt by
-/// `msg.sender` so a caller's `(implementation, salt)` address cannot be squatted
-/// by another account.
-contract CloneFactory is ICloneableFactoryV3 {
+/// Two deterministic entry points, both `CREATE2`, differing only in the salt:
+///
+/// - `cloneDeterministic` / `predictDeterministicAddress` namespace the
+///   caller-supplied salt by `msg.sender` (see `_effectiveSalt`) so a caller's
+///   `(implementation, salt)` address cannot be squatted by another account.
+/// - `cloneDeterministicOpenSalt` / `predictDeterministicAddressOpenSalt` use
+///   the caller-supplied salt verbatim, so the address carries no identity and
+///   anyone can deploy it. This is only safe for implementations whose
+///   `initialize` takes no caller-controlled authority — read the warning on
+///   `ICloneableFactoryV4.cloneDeterministicOpenSalt` before using it.
+contract CloneFactory is ICloneableFactoryV4 {
     /// @inheritdoc ICloneableFactoryV3
     function cloneDeterministic(address implementation, bytes calldata data, bytes32 salt) external returns (address) {
         _requireImplementationCode(implementation);
@@ -39,6 +49,24 @@ contract CloneFactory is ICloneableFactoryV3 {
         return Clones.predictDeterministicAddress(implementation, _effectiveSalt(deployer, salt), address(this));
     }
 
+    /// @inheritdoc ICloneableFactoryV4
+    function cloneDeterministicOpenSalt(address implementation, bytes calldata data, bytes32 salt)
+        external
+        returns (address)
+    {
+        _requireImplementationCode(implementation);
+        // CREATE2 clone at the caller-supplied salt verbatim: no `_effectiveSalt`
+        // namespacing, so the address is the same for every caller and there is
+        // no identity in the derivation.
+        address child = Clones.cloneDeterministic(implementation, salt);
+        return _initializeClone(implementation, child, data, salt);
+    }
+
+    /// @inheritdoc ICloneableFactoryV4
+    function predictDeterministicAddressOpenSalt(address implementation, bytes32 salt) external view returns (address) {
+        return Clones.predictDeterministicAddress(implementation, salt, address(this));
+    }
+
     /// @dev The CREATE2 salt actually used: the caller-supplied `salt` namespaced
     /// by the deploying account. Prevents a caller's `(implementation, salt)`
     /// address being front-run/squatted by another account, while still letting a
@@ -69,7 +97,7 @@ contract CloneFactory is ICloneableFactoryV3 {
     {
         emit NewClone(msg.sender, implementation, child, salt, data);
         // Checking the return value of initialize is mandatory as per
-        // ICloneableFactoryV3.
+        // ICloneableFactoryV3 and ICloneableFactoryV4.
         if (ICloneableV2(child).initialize(data) != ICLONEABLE_V2_SUCCESS) {
             revert InitializationFailed();
         }