[Slokh]

pnpm earn deposit --broadcast signs an approval and deposit against the addresses in the profile's deployment record, but it never ran the checks verify runs on that record: live provenance (runtime code hashes and receipts), source verification, and the stack the reviewed factories predict. A broadcast deposit now runs verifyEarnProfile first, refuses to sign for a record that fails it, and funds the stack verifyEarnProfile returns.

• A preview (without --broadcast) is unchanged. It signs nothing and can still quote a record whose source verification is pending, as the deployment runbook documents.
• deposit now accepts each module's --skip-<live check> flag (--skip-zone), so a broadcast can skip an external chain's live check the same way verify does.
• The deployment runbook describes the new check.

Tests: deployments/core/cli-deposit.test.ts covers three cases: a broadcast refuses to fund a record that fails verification, a broadcast funds only the verified record, and a preview skips verification. The first two fail without this change. pnpm verify:typescript passes.

[tempoxyz-bot]

✅ Cyclops Security Review: safe to merge

✅ Reviewed 83fe43c (latest) · Coverage: full · no open findings · report

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

[claude]

I re-reviewed after the latest commit and found no new bugs. Both earlier nits are fixed: a preview now rejects --skip-*, and the runbook and the missing-Zone-RPC hint now name deposit --broadcast. This change gates signing on the deposit funding path, so a human look is still worthwhile.

What was reviewed:

• The cli.ts deposit branch. A broadcast funds only the record that verifyEarnProfile returns, and a verification error propagates before depositEarnProfile is called.
• The parseArguments skip gate. It now allows --skip-* only for verify and for deposit --broadcast. The per-profile "does not apply" check in deploy.ts still runs on broadcast.
• The cli-deposit.test.ts cases, the updated cli.test.ts assertion, and the doc and hint text. I did not run the tests or pnpm verify:typescript.

Extended reasoning...

The change touches the pnpm earn deposit CLI path in deployments/core/cli.ts, one error hint in zone-router/outputs.ts, a new test file and the deployment runbook. The security-sensitive part is the pre-signing gate: a broadcast deposit now runs the full verify checks (provenance, source verification, predicted stack) before it signs. The only weakening the operator can choose is the existing --skip-zone live-check skip. When a skip is used, verifyEarnProfile's unverified labels are dropped on the deposit path rather than reported. That is minor because the operator passed the skip explicitly. I deferred rather than approved because this is a funds-signing path whose behavior external deployment repositories depend on.