# AfriPrime contract deployment review — 28 October 2026

No contract in the current package is cleared for production deployment. No live addresses have been verified. Do not deploy non-proxy checkpoint contracts expecting to upgrade them later in place.

| Module | Current architecture | Required next work |
|---|---|---|
| CruciblePassMarketplace | UUPS candidate; implementation initialization locked | Shared-owner governance, upgrade timelock, recovery integration, real pool tests and storage compatibility verification |
| EducationSalesRouter | Non-proxy; immutable token/pass/sponsor references | Proxy-safe initializer and storage design, governance authorization, fourth-partner slot, upgrade and accounting tests |
| AutomationFuel | Non-proxy with immutable token | Proxy-safe initializer, two-owner control, operator recipient confirmation and renewal/access integration |
| AutomationAccessGate | Non-proxy immutable references | Review proxy or proxy-compatible configuration architecture, maintain exit/withdrawal safety |
| AdminSalesVault / PartnerSalesVault | Non-proxy replacement candidates | Proxy-safe ownership and accounting migration; preserve existing fund ownership |
| RankRewardsPatched | Non-proxy narrow bug fix | Upgradeable redesign, frozen entitlement migration, complete compensation policy and shared governance |
| Product registry / owner governance / recovery | Not built | On-chain product lifecycle, joint approvals and 24-hour financial delay; one-guardian seven-day owner recovery |
| Card checkout / rank volume / pools | Incomplete integration | Sponsor registration, exact-once volume and liability-backed distribution |

## Ownership policy to implement
SuperAdmin: 0x83C3a8cbce61f83F540Af52795adA9cC2374525c
Partner Admin: 0x8A702A9218ce2a1240E39325CD31A6a7373b2EE3
Designated guardian: 0x2214Cb6771698728ddDDC988626611D2e13E799a

Both owners approve live financial/product changes, partner suspensions and contract upgrades, followed by 24 hours. Either owner can request an emergency purchase pause. Neither can unilaterally redirect the other's share. Recovery requires the remaining owner and guardian, seven days, then explicit replacement acceptance. Recovery preserves economics. Guardian must accept after both owners approve its configuration. No active recovery or approvals are represented by this frontend. Both owners losing access is not covered.

## Proxy implementation requirements
Use a reviewed UUPS or transparent proxy pattern consistently. Constructor-bound contract state must move to protected initializers and appropriate storage; changing a filename does not make a contract upgradeable. Lock implementation initializers. Use proxy addresses in apps and cross-contract allowlists. Verify storage layouts and test upgrades from the actual predecessor, including balances, liabilities, roles, paid access and pending operations. Prevent upgrades from bypassing the shared-owner approval/delay policy. Never change an already-deployed non-proxy contract in place; plan a reviewed migration instead.

## Evidence and remaining gaps
Prior contract checkpoint: 131 passing tests, one PostgreSQL-only skip, plus a separate passing guarded checkout end-to-end test. Those tests do not verify the new two-owner/guardian system or a fourth-partner split, which are not implemented on-chain. Real BTC data-to-report path ran; real AI and forex feed verification remain incomplete. Public v72/v73 Forge content is a preview without protected paid access.

## Frontend status
v73 is an owner drafting interface. Wallet recognition is UI gating, not cryptographic authorization. Public source reveals configured addresses and controls. No signatures, transactions, governance RPC or mainnet deployment. Products and proposals are local drafts; exported JSON does not prove approval. Do not treat the proposed fourth partner 5% as an active allocation. Its wallet and final approvals are outstanding.