fix(scenarios): make Synapse source runs consumer-equivalent

.github/workflows/ci_run.yml

@@ -122,7 +122,7 @@ jobs:
         rm -rf target/
         df -h
 
-    # Dependency profile resolution queries npm release metadata.
+    # Dependency profile resolution queries Git refs and npm release metadata.
     - name: "EXEC: {Setup Node.js}, independent"
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:

ci/README.md

@@ -47,8 +47,8 @@ exist unless added there.
 Top-level component fields:
 
 - `repository`: Git repository URL.
-- `npm_package`: npm package name, for components that are resolved through npm
-  metadata.
+- `npm_package`: npm package name, for components resolved through npm metadata
+  or pkg.pr.new previews.
 - `default`, `stability`, `frontier`: component profile selections.
 
 Profile selections always have a `strategy`. Some strategies require additional
@@ -166,6 +166,23 @@ For `synapse-sdk`, npm resolution also records exact compatible versions of
 `@filoz/synapse-core` and the `viem` peer dependency. The scenario installs that
 set into a temporary consumer project.
 
+### `pkg_pr_new`
+
+Resolve a branch head to an immutable commit, then install the packages built
+for that commit by pkg.pr.new:
+
+```json
+{
+  "strategy": "pkg_pr_new",
+  "branch": "master"
+}
+```
+
+This strategy is used for Synapse frontier runs. The resolver records the exact
+commit and constructs commit-pinned preview URLs for `@filoz/synapse-sdk` and
+`@filoz/synapse-core`. The scenario installs those built packages in the same
+temporary npm consumer used for released versions.
+
 ## Overrides
 
 Some profile selections can include an optional `overrides` object. Each entry
@@ -192,7 +209,7 @@ override is applied. The resolver does not infer overrides from package metadata
 
 Overrides are currently allowed only for npm-installed `synapse-sdk` and
 `filecoin-pin` selections. They are written to the temporary consumer
-`package.json`; source profiles use the checkout's committed lockfile.
+`package.json`.
 
 Current consumers write npm overrides to the temporary `package.json` used by
 their scenario.
@@ -206,7 +223,7 @@ Installation currently lives in three places (which consume the resolved
 metadata):
 
 - `foc-devnet init`: Lotus, Curio, filecoin-services, and optionally PDP.
-- `scenarios/synapse_runtime.py`: published or source Synapse scenario runtime.
+- `scenarios/synapse_runtime.py`: released or preview Synapse packages.
 - `scenarios/test_multi_copy_upload.py`: filecoin-pin scenario dependency.
 
 This split is intentional, but it is not necessarily the final shape. Resolution

ci/dependency-profiles.json

@@ -106,7 +106,7 @@
         "version": "latest"
       },
       "frontier": {
-        "strategy": "git_branch",
+        "strategy": "pkg_pr_new",
         "branch": "master"
       }
     },

contracts/MockUSDFC/src/MockUSDFC.sol

@@ -2,19 +2,20 @@
 pragma solidity ^0.8.20;
 
 import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
+import "@openzeppelin/contracts/token/ERC20/extensions/ERC20Permit.sol";
 
 /**
  * @title MockUSDFC
  * @dev Mock USDC token for testing FOC warm storage services
  */
-contract MockUSDFC is ERC20 {
+contract MockUSDFC is ERC20, ERC20Permit {
     uint8 private _decimals;
 
     /**
      * @dev Constructor that gives msg.sender all of initial supply.
      * @param initialSupply The initial supply of tokens (in wei, accounting for decimals)
      */
-    constructor(uint256 initialSupply) ERC20("Mock USDC", "USDFC") {
+    constructor(uint256 initialSupply) ERC20("Mock USDC", "USDFC") ERC20Permit("Mock USDC") {
         _decimals = 18;
         _mint(msg.sender, initialSupply);
     }
@@ -26,6 +27,10 @@ contract MockUSDFC is ERC20 {
         return _decimals;
     }
 
+    function version() external pure returns (string memory) {
+        return "1";
+    }
+
     /**
      * @dev Mint new tokens (for testing purposes)
      * @param to Address to receive the tokens

contracts/MockUSDFC/test/MockUSDFC.t.sol

@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import "forge-std/Test.sol";
+import "../src/MockUSDFC.sol";
+
+contract MockUSDFCTest is Test {
+    bytes32 private constant PERMIT_TYPEHASH =
+        keccak256("Permit(address owner,address spender,uint256 value,uint256 nonce,uint256 deadline)");
+
+    MockUSDFC private token;
+    uint256 private ownerKey;
+    address private owner;
+
+    function setUp() public {
+        token = new MockUSDFC(0);
+        ownerKey = 0xA11CE;
+        owner = vm.addr(ownerKey);
+        token.mint(owner, 100 ether);
+    }
+
+    function testPermit() public {
+        address spender = makeAddr("spender");
+        uint256 value = 25 ether;
+        uint256 deadline = block.timestamp + 1 hours;
+        bytes32 structHash = keccak256(abi.encode(PERMIT_TYPEHASH, owner, spender, value, 0, deadline));
+        bytes32 digest = keccak256(abi.encodePacked("\x19\x01", token.DOMAIN_SEPARATOR(), structHash));
+        (uint8 v, bytes32 r, bytes32 s) = vm.sign(ownerKey, digest);
+
+        token.permit(owner, spender, value, deadline, v, r, s);
+
+        assertEq(token.allowance(owner, spender), value);
+        assertEq(token.nonces(owner), 1);
+        assertEq(token.version(), "1");
+    }
+}