docs: address the second round of EDF docs review

[chasingrainbows]

Summary

Follow-up to #962. Fixes the items from the post-merge review (#962 (review)) that should land before the LIP-37 vote, plus a few related pages that would be stale after the vote. The changed text is written for the state after LIP-37 is enacted, without "before / after the vote" wording.

Linear: STC-924.

Changes

EDF operator guide (docs/guides/edf/edf-operator-guide.md)

• New "Minimum software versions" table: lido-oracle 8.1.0, lido-council-daemon 4.1.2, depositor-bot 5.7.0, validator-ejector 2.2.0.
• 2.2: replaced the stale oracle log line with the 8.1.0 text and noted that the oracle keeps running in dry mode and re-checks the config every cycle.
• 3.1 / 3.2: real council daemon behaviour - an empty DELEGATION_CONTRACT_ADDRESS passes startup validation on DSM v4; the check to look for is EDF preflight passed / EDF setup is not ready; on DSM v5 a daemon with a wrong config logs Guardian cycle processing error every cycle and signs nothing, a restart exits with code 1.
• 1.4: alerts on execute() targets and non-zero msg.value need trace-level monitoring (no events); added polling of the delegate account code.
• 2.1 / 3.1: funding the delegate EOA is marked as required.
• 0.1: the 48 h cooldown is stated as the policy minimum.
• Reference material: links to the new contract pages.

Custody policy (docs/guides/edf/key-custody-policy-for-edf-operators.md)

• §3.6: MUST-level minimum cooldown of 48 hours (172800 s).
• §4.5 / §4.6: the delegate MUST be a plain EOA with empty code and MUST never sign an EIP-7702 authorization.
• §7: trace-level monitoring note and delegate code polling.

Validator ejector (docs/guides/validator-ejector-guide.md, docs/guides/curated-module/exits/tooling-setup.md, docs/guides/edf/edf-rotation-and-incidents.md)

• ORACLE_ADDRESSES_ALLOWLIST must hold the oracle delegate EOAs, not the DelegationContracts returned by getMembers(); after a rotation keep the previous delegate for about 7 days (BLOCKS_PRELOAD 50000); validator-ejector 2.2.0 or newer is required.
• The Etherscan links now point at the HashConsensus of the Validators Exit Bus Oracle (mainnet and Hoodi).

Contract reference (docs/contracts/)

• New pages delegation-factory.md and delegation-contract.md, added to the sidebar after Deposit Security Module. Written from the sources in lidofinance/execution-delegation-framework. Deployed instances are marked as proposed.
• deposit-security-module.md: added a proposed link to the DSM v5 deployed contract. The page content stays on v4 until the vote.

Other pages

• Oracle operator manual, TL;DR step 9: deploy the DelegationContract and configure the daemon before proposing the address.
• Deposit security manual: DSM v5 signed message (prefix, guardian, blockNumber, blockHash, depositRoot, stakingModuleId, nonce) and the direct call path for pause and unvet where the DelegationContract is the sender.
• Protocol levers: the DSM address was a v3 one (0xfFA9...), replaced with the current v4 address and the proposed v5 one.
• Tooling: council daemon 4.0.4 -> 4.1.2, depositor bot 5.6.0 -> 5.7.0, validator ejector 2.1.0 -> 2.2.0.

Not changed

• Review item 11 (dedicated multisig rule vs. deployed seats) is left for a separate decision.
• Review item 12: the vote script does revoke TOP_UP_ROLE from the old depositor bot EOA and grants it to the DelegationContract, so the deployed contracts page is correct as is.
• Post-vote cleanup (proposed markers, DSM contract page for v5, HashConsensus note) will go in a separate PR after the vote.

Testing

npm run build passes with onBrokenLinks and onBrokenAnchors set to throw. Log strings were checked against lido-council-daemon 4.1.2 and lido-oracle 8.1.0 sources; the DSM address was checked on-chain; the new contract pages were checked against the EDF sources.

[Copilot]

🟡 Changes recommended

Operational version guidance and several contract and monitoring descriptions remain contradictory or inaccurate.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates EDF documentation for LIP-37 deployment, operation, custody, rotation, and DSM v5 integration.

Changes:

• Adds DelegationFactory and DelegationContract references.
• Updates EDF operator procedures and minimum software versions.
• Revises DSM, validator-ejector, and related operational guidance.

File summaries

File	Description
sidebars.js	Adds EDF contract pages.
docs/contracts/delegation-contract.md	Documents DelegationContract behavior and API.
docs/contracts/delegation-factory.md	Documents factory deployment API.
docs/contracts/deposit-security-module.md	Updates reference for DSM v5.
docs/guides/curated-module/exits/tooling-setup.md	Corrects oracle allowlist guidance.
docs/guides/deposit-security-manual.md	Documents EDF guardian behavior.
docs/guides/edf/edf-operator-guide.md	Updates setup, monitoring, and daemon guidance.
docs/guides/edf/edf-rotation-and-incidents.md	Adds ejector rotation guidance.
docs/guides/edf/key-custody-policy-for-edf-operators.md	Strengthens cooldown and delegate requirements.
docs/guides/oracle-operator-manual.md	Adds EDF onboarding instructions.
docs/guides/protocol-levers.md	Updates DSM role-holder addresses.
docs/guides/tooling.md	Updates council daemon and depositor bot versions.
docs/guides/validator-ejector-guide.md	Documents EDF-compatible allowlisting.

Review details

Suppressed comments (1)

docs/contracts/delegation-contract.md:76

• This parameter can also contain the signature format accepted by an ERC-1271 contract delegate, not only an ECDSA signature. Keeping the ECDSA-only description here would still contradict the function's supported behavior after the prose above is corrected.

| `signature` | `bytes`   | ECDSA signature              |

• Files reviewed: 13/13 changed files
• Comments generated: 6
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[TheDZhon]

LGTM 🎬