chore: remove submodule-era residue — dead foundry.lock, .gitmodules and lib/ references

[thedavidmeister]

Closes#29

This repo has no submodules. There is no .gitmodules, no lib/, and git ls-files --stage | grep ^160000 is empty. Dependencies come from soldeer — foundry.toml sets libs = ["dependencies"] and soldeer.lock is the live lockfile for @openzeppelin-contracts 5.6.1, forge-std 1.16.1 and rain-solmem 0.1.3.

What is removed

foundry.lock — Foundry's git-submodule lockfile. Its 2 pins both name a lib/ path that does not exist, and both contradict what the build actually uses: fcbae539 is openzeppelin-contracts v5.5.0 against soldeer's 5.6.1, and 2e47e41 is not any tagged rain.solmem release (v0.1.3 is ce03de80) against soldeer's rain-solmem 0.1.3. It also has no forge-std entry at all. Nothing reconciles any of it.

REUSE.toml — drops three annotation path entries that match nothing in the tree: "foundry.lock", ".gitmodules", ".vscode/**/". A REUSE annotation describes files that exist, so a path absent from the tree is residue.

.soldeerignore — drops .gitmodules, /lib and /foundry.lock, and corrects .coderabbitai.yaml to .coderabbit.yaml in place. The misspelling made that line a no-op; a real .coderabbit.yaml added later would have been published to soldeer rather than ignored.

Submodules cannot come back: rainix CI's no-submodules check fails on a root .gitmodules or any committed gitlink. That is what makes those three entries dead rather than dormant.

What is deliberately left alone

Every other .soldeerignore entry, whether or not its path exists today — CLAUDE.md, .DS_Store, .vscode, .pre-commit-config.yaml, /target and the rest of the build/publish outputs (/out, /cache, /dependencies, /result, /meta, /docs, /deployments, /audit).

.soldeerignore is a publish filter, not a description of the tree. An entry naming a file that is absent today is a forward-looking rule, not residue: deleting it means that file gets published into the soldeer package if anyone adds it later. So absence from a clean checkout is not evidence an entry is dead — some of these are OS junk or local developer files, some are artifacts generated at forge soldeer install / forge build time and therefore present exactly when soldeer push runs, and some simply have not been added yet. The only entries that can be removed safely are ones whose file can never come back, which is why the submodule-era three go and nothing else does.

This is also why the misspelled CodeRabbit entry is corrected rather than dropped — dropping it would remove the protection.

Scope is rain.string only, per the issue. The same residue in the sibling repos, and the repos that legitimately still use submodules (flow, rain.tier.interface), are untouched.

Verification

Run in the pinned rainix#sol-shell (53e96a7), on this branch:

check	result
forge build	no Dependency '...' not found at expected path warning (was 2 — reconfirmed on this branch by restoring the file, which brings both back)
reuse lint (legal)	compliant, 25/25 files, 0 missing licenses
forge test -vvv	20 passed, 0 failed, 0 skipped
slither .	4 contracts, 98 detectors, 0 results
forge fmt --check	clean
rainix-sol-single-contract	clean
rainix-static no-submodules .	clean

grep -rn over the tree confirms no remaining .gitmodules, foundry.lock or submodule-lib/ reference outside dependencies/. The only lib/ hits left are Solidity source paths (src/lib/..., rain-solmem-0.1.3/src/lib/...).

QA

• Discriminating tests: n/a — the diff contains no Solidity and no test code. It deletes a dead lockfile and lines that match no path in the tree. The one behavioural claim it makes (forge build stops warning) is verified by direct A/B on this branch rather than by a test, because forge warnings are not assertable from forge test.
• Mutations applied: the removal run in reverse is the mutant. git show main:foundry.lock > foundry.lock on this branch, then forge build in the pinned rainix#sol-shell — both Warning: Dependency 'lib/rain.solmem' not found at expected path and Warning: Dependency 'lib/openzeppelin-contracts' not found at expected path come back; delete it again and both are gone. Killed by observed build output, so the deletion is what silences the warnings, not a cosmetic change. The REUSE.toml and .soldeerignore lines have no mutant that any check can kill — reuse lint tolerates annotation paths that do not exist and a .soldeerignore line for an absent path is a no-op, which is exactly why the issue says none of them blocks its own deletion. That absence of a killing check is what makes over-deletion in .soldeerignore the real hazard here, and it is bounded by the "file can never come back" rule rather than by CI.
• Oracle: independent of this repo. foundry.lock is Foundry's git-submodule lockfile, meaningful only where deps are vendored under lib/; this repo's live dependency source is foundry.toml + soldeer.lock. Pin identity checked against upstream, not against the issue text: gh api repos/OpenZeppelin/openzeppelin-contracts/git/ref/tags/v5.5.0 returns exactly fcbae5394ae8ad52d8e580a3477db99814b9d565 (soldeer resolves 5.6.1), and rain.solmem v0.1.3 dereferences to ce03de807b5766ccd2f03547ffe9f1576581b450, not the pinned 2e47e41 (which is a real commit — the 2026-01-26-audit merge — but no release). Absence of submodules checked from git itself: git ls-files --stage | grep ^160000 is empty, and rainix-static no-submodules . reports clean.
• Category check: the issue asks for (a) foundry.lock deleted, (b) every listed REUSE.toml entry removed, (c) every listed .soldeerignore line removed or corrected, (d) no Dependency '...' not found at expected path from forge build, (e) no .gitmodules / lib/ / foundry.lock reference anywhere outside dependencies/, (f) CI green on test / static / legal. Covered a, b, c, d, e, f. On (c), CLAUDE.md is corrected to stay: the issue listed it as dangling, but .soldeerignore is a filter rather than a description of the tree, so an entry for a file that does not exist yet is a forward-looking rule and removing it would publish that file if it were ever added. The .coderabbitai.yaml misspelling is fixed in place for the same reason instead of taking the issue's "or drop the line" option. The scope-out list is untouched, and the sibling repos the issue names as also carrying this residue are left to their own issues.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 84627340-462c-4215-9785-277a163d91c6

📥 Commits

Reviewing files that changed from the base of the PR and between 66c1ac1 and 2968c7a.

⛔ Files ignored due to path filters (1)

• foundry.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• .soldeerignore
• REUSE.toml

💤 Files with no reviewable changes (1)

• REUSE.toml

---

Walkthrough

The change updates .soldeerignore and REUSE.toml. It corrects the CodeRabbit configuration filename and removes obsolete submodule-related paths from ignore and REUSE annotation rules.

Changes

Repository metadata cleanup

Layer / File(s)	Summary
Ignore and annotation rule updates .soldeerignore, REUSE.toml	.soldeerignore now uses .coderabbit.yaml and removes obsolete .gitmodules, CLAUDE.md, foundry.lock, and /lib entries. REUSE.toml no longer excludes .vscode/**/, .gitmodules, or foundry.lock; .gitignore remains excluded.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk:⚪ Minimal · up to 2968c

This PR removes obsolete dependency-lock and metadata entries without changing Solidity behavior; the supplied validation is green, and no actionable merge-blocking risk remains after normal checks and review.

Possibly related issues

• rain.string issue 29 — The changes remove the stale .gitmodules, foundry.lock, and /lib references and correct the .coderabbit.yaml ignore entry.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The PR includes unrelated changes to the CodeRabbit filename, .vscode/**/ annotations, and CLAUDE.md.	Keep only cleanup required by issue #262 and move the CodeRabbit rename, .vscode/**/ change, and CLAUDE.md removal to a separate PR.
Linked Issues check	❓ Inconclusive	The REUSE.toml cleanup is present, but the no-reference requirement cannot be verified because foundry.lock is excluded by !**/*.lock.	Provide reviewable evidence that no .gitmodules, lib/, or foundry.lock references remain outside dependencies/, or remove the exclusion.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change by identifying the removal of obsolete submodule-era references and related files.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 29-remove-submodule-residue

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}