add sections for safeharbor adoption

Author: 0xBasset

spell/spell-crafter-mainnet-workflow.md

@@ -125,6 +125,14 @@ Repo: https://github.com/makerdao/spells-mainnet
     * [ ] Changes are tested via `testNewOrUpdatedChainlogValues`
   * [ ] Adjust system values, collateral values inside `config.sol`
   * [ ] Ensure every spell variable is declared as public/internal
+  * Bug Bounty Registry Updates
+    * [ ] Run `make update-bug-bounty` command in the `spells-mainnet` repo to check for bug bounty updates
+    * [ ] IF the command outputs hex encoded calls:
+      * [ ] Add ALL output calls to the spell using low-level Solidity calls
+      * [ ] Each call MUST use the pattern: `(bool succ, bytes memory err) = AGREEMENT.call(<encodedDATA>);`
+      * [ ] Ensure proper error handling after each call (e.g., `require(succ, "Bug bounty update failed");`)
+      * [ ] Add comment above the bug bounty section: `// ----- Bug Bounty Registry Updates -----`
+      * [ ] Include note: `// Note: Updates to bug bounty registry identified by make generate command`
 * Add specific tests in `DssSpell.t.sol` to have sufficient test coverage for every spell action
   * [ ] Test new collaterals
   * [ ] Test new ilk registry values
@@ -139,6 +147,9 @@ Repo: https://github.com/makerdao/spells-mainnet
     * [ ] Sanity checks of the constructor arguments
     * [ ] Sanity checks of all values added/updated by the spell function
     * [ ] End-to-end "happy path" interaction with the module
+  * IF bug bounty updates are present
+    * [ ] Test that all bug bounty registry calls execute successfully
+    * [ ] Verify `make update-bug-bounty` returns empty diff in test environment after spell execution
   * [ ] Tests PASS via `make test`
 * [ ] Ensure `DssExecLib` address used in current spell (`DssExecLib.address`) matches `dss-exec-lib` [Latest Release Tag](https://github.com/makerdao/dss-exec-lib/releases/latest)
 * [ ] Push committed content to already opened PR

spell/spell-reviewer-mainnet-checklist.md

@@ -272,6 +272,13 @@
   * [ ] Target contract is not upgradable
   * [ ] Target Contract is included in the ChainLog
   * [ ] Test Coverage is comprehensive
+* IF bug bounty registry updates are present
+  * [ ] Run `make update-bug-bounty` command independently to verify required updates
+  * [ ] Ensure ALL hex encoded calls from the command output are present in the spell
+  * [ ] Verify each call uses the correct pattern: `(bool succ, bytes memory err) = AGREEMENT.call(<encodedDATA>);`
+  * [ ] Cross-check that each `<encodedDATA>` exactly matches the script output
+  * [ ] Confirm proper error handling is implemented for each call
+  * [ ] Verify the bug bounty section has appropriate comments/documentation
 * IF spell interacts with ChainLog
   * [ ] ChainLog version is incremented based on update type
     * Major -> New Vat (++.0.0)
@@ -383,6 +390,7 @@ _Insert your local test logs here_
   * [ ] All actions are executed in the transaction trace
   * [ ] No reverts are present that block execution
   * [ ] No out-of-gas errors are present
+  * [ ] Confirm `make update-bug-bounty` returns empty
 * Archive checks
   * [ ] `make diff-archive-spell` for current date or `make diff-archive-spell date="YYYY-MM-DD"`
   * [ ] Ensure date corresponds to target Exec Doc date