(feat) (openai/gpt-5.5, reviewed T, tested T) add proof-of-merge task vault

Author: paoloanzn

contracts/script/DeployTaskVault.s.sol

@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.24;
+
+import {Script} from "forge-std/Script.sol";
+import {IERC721} from "@openzeppelin/contracts/token/ERC721/IERC721.sol";
+import {IJwtVerifier} from "../src/IJwtVerifier.sol";
+import {TaskVault} from "../src/TaskVault.sol";
+
+contract DeployTaskVault is Script {
+    /**
+     * @notice Deploys TaskVault with configured RIK/JWT verifier addresses.
+     *
+     * Requirements:
+     *
+     * - `PRIVATE_KEY`, `RIK_ADDRESS`, and `JWT_VERIFIER_ADDRESS` must be set.
+     */
+    function run() external returns (TaskVault vault) {
+        uint256 deployerPrivateKey = vm.envUint("PRIVATE_KEY");
+        address rikAddress = vm.envAddress("RIK_ADDRESS");
+        address jwtVerifierAddress = vm.envAddress("JWT_VERIFIER_ADDRESS");
+
+        vm.startBroadcast(deployerPrivateKey);
+        vault = new TaskVault(IERC721(rikAddress), IJwtVerifier(jwtVerifierAddress));
+        vm.stopBroadcast();
+    }
+}

contracts/src/IJwtVerifier.sol

@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: Apache-2.0
+pragma solidity ^0.8.24;
+
+/**
+ * @title IJwtVerifier
+ * @notice Minimal verifier boundary for GitHub Actions OIDC JWTs.
+ */
+interface IJwtVerifier {
+    /**
+     * @notice Verifies a GitHub OIDC JWT and returns the decoded payload.
+     *
+     * @dev Implementations are expected to revert when `kid` is inactive, the RSA signature is invalid,
+     *      the issuer is wrong, or the JWT is outside its active time window.
+     *
+     * Requirements:
+     *
+     * - `kid` must identify an active GitHub Actions signing key.
+     * - `signature` must be valid for `headerB64.payloadB64`.
+     * - The decoded payload must be a currently valid GitHub Actions OIDC payload.
+     */
+    function verifyGithubOidc(
+        bytes32 kid,
+        bytes calldata headerB64,
+        bytes calldata payloadB64,
+        bytes calldata signature
+    ) external view returns (bytes memory payload);
+}