docs(chain): generated precompile addresses + chain-sync tripwire for the 40204 re-roll

.github/workflows/chain-sync-check.yml

@@ -0,0 +1,55 @@
+name: chain-sync-check
+
+# Tripwire: the contract-address page and the precompile address page are generated from citrate-chain
+# (contracts/addresses/40204.json, verification/address-code.snapshot.json,
+# core/execution/src/precompiles/mod.rs, core/execution/src/agent_fork.rs). This job checks out the chain at
+# CHAIN_REF and regenerates both pages in memory; it fails when either committed page has drifted from the
+# chain, or when the chain and the docs-owned precompile description map disagree.
+#
+# CHAIN_REF: the workflow_dispatch input, else the repo variable CITRATE_CHAIN_REF, else `main`. After a
+# re-roll, set CITRATE_CHAIN_REF to the genesis commit until it is on chain main. To fix a failure, run the
+# sync in README.md ("Chain-generated pages").
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "17 6 * * *"
+  workflow_dispatch:
+    inputs:
+      chain_ref:
+        description: "citrate-chain ref to check against (branch, tag or commit)"
+        required: false
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  # Named `chain-sync`, not `check`: merge-gate's `ci` aggregate groups check runs by name and judges
+  # only the latest run per name, so sharing `check` with the content-lint job let a pass there mask
+  # a drift failure here (or the reverse), depending on which finished last.
+  chain-sync:
+    name: chain-sync
+    runs-on: ubuntu-latest
+    env:
+      CHAIN_REF: ${{ inputs.chain_ref || vars.CITRATE_CHAIN_REF || 'main' }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Check out citrate-chain
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          repository: CitrateNetwork/citrate-chain
+          ref: ${{ env.CHAIN_REF }}
+          path: .chain-src
+          # Full history: the pages cite the last commit that touched each input.
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22
+      - name: Contract addresses (gen-addresses --check)
+        run: node scripts/gen-addresses.mjs --chain .chain-src --check
+      - name: Precompile addresses (gen-precompiles --check)
+        if: success() || failure()
+        run: node scripts/gen-precompiles.mjs --chain .chain-src --check

README.md

@@ -104,6 +104,32 @@ Copy `.env.example` → `.env.local`. Key variables (full annotated list in `.en
 `.env.example` documents the fail-closed defaults for auth, the MCP key hashing, and the
 optional live knowledge-graph (`MEM_*`) wiring.
 
+## Chain-generated pages
+Two pages are generated from a `citrate-chain` checkout and committed (Vercel builds without the chain):
+
+| Page | Generator | Chain inputs |
+|------|-----------|--------------|
+| `content/chain/_generated/addresses.md` (`/chain/addresses`) | `npm run docs:addresses` | `contracts/addresses/40204.json`, `verification/address-code.snapshot.json` |
+| `content/chain/_generated/precompiles.md` (`/chain/precompile-addresses`) | `npm run docs:precompiles` | `core/execution/src/precompiles/mod.rs`, `core/execution/src/agent_fork.rs`, the book's `precompiles` block |
+
+The only hand-written precompile input is the description map in `scripts/lib/precompile-descriptions.mjs`.
+The generator fails if the chain or the book has a precompile the map lacks, or the other way round.
+Both generators take `--chain <dir>` (default `../citrate-chain`) and `--check` (fail on drift, write
+nothing). The `chain-sync-check` workflow runs both checks against `CitrateNetwork/citrate-chain` at the
+repo variable `CITRATE_CHAIN_REF` (default `main`), on every PR and daily.
+
+Post-reroll sync, once the new `40204.json`, its getCode snapshot (chain side:
+`verification/check_address_code.py --probe`) and the genesis commit are in the chain checkout:
+
+```bash
+git -C ../citrate-chain fetch origin && git -C ../citrate-chain checkout <genesis-commit-or-main>
+npm run docs:addresses -- --chain ../citrate-chain
+npm run docs:precompiles -- --chain ../citrate-chain
+npm run content                                   # rebuild content/_generated/content.ts
+npm run docs:chain-check                          # both --check gates, expect green
+git add content/chain/_generated/addresses.md content/chain/_generated/precompiles.md content/_generated/content.ts
+```
+
 ## Links
 - Docs: <https://docs.citrate.ai>
 - Depends on: [citrate-identity](https://github.com/CitrateNetwork/citrate-identity) · [citrate-inference-gateway](https://github.com/CitrateNetwork/citrate-inference-gateway) · [citrate-chain](https://github.com/CitrateNetwork/citrate-chain)