refactor+docs+schema: OAV context injection and address patterns

[ajag408]

Summary

• Document that callers should always pass project OAVs in context (additive; baked vault-registry.json is not the freshness gate) and that context is trusted control-plane data, never from the user or the tx.
• Document that allocatorVaultInputTokenAddress is required for injected-OAV APPROVAL.
• Tighten Ajv pattern: '^0x[0-9a-fA-F]{40}$' on allocatorVaultAddress and allocatorVaultInputTokenAddress; handler tests accept valid hex and reject not-an-address with SCHEMA_VALIDATION_ERROR.

QA Proof

What Needs to Be QA'd in Staging

• CLI/JSON validate with valid context.feeConfiguration[].allocatorVaultAddress + allocatorVaultInputTokenAddress still succeeds (schema layer)
• allocatorVaultAddress: "not-an-address" returns SCHEMA_VALIDATION_ERROR (does not run the yield validator)
• Injected-OAV APPROVAL / SUPPLY / WITHDRAW behavior unchanged from base PR (token required only for approval)
• README: no instruction to use GitHub main vault-registry.json as the OAV allowlist

QA Team Notification

• QA team has been notified to test in staging

---

Note

Medium Risk
Tightening context address patterns can reject previously schema-valid garbage strings; incorrect caller handling of trusted context still expands the OAV whitelist and bypasses Shield.

Overview
Documents runtime OAV injection via context.feeConfiguration: callers should pass project OAVs on every validate call (additive to the embedded vault-registry.json snapshot), with allocatorVaultInputTokenAddress required for injected-OAV APPROVAL only. The README clarifies that the baked registry is not the freshness gate for allowed OAVs and that context must be trusted server-side control-plane data, never user- or tx-supplied.

JSON schema now requires 0x + 40 hex digits for allocatorVaultAddress and allocatorVaultInputTokenAddress; invalid strings fail at the schema layer with SCHEMA_VALIDATION_ERROR before yield validation runs.

Handler tests hoist shared Lido fixtures and add coverage for valid/mixed-case hex, optional input token, and rejected non-address values.

^{Reviewed by Cursor Bugbot for commit d343a44. Configure here.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[raiseerco]

lgtm

[cursor]

Risk: medium. Left a non-blocking comment; Bugbot and Security Agent completed without findings that need human review, but the schema change on allocator vault address validation is above the low-risk approval threshold. Reviewers were not assigned because two or more are already requested.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}