- services/treasury/propose.py: SafeProposeClient with EIP-712 safeTxHash
  computation, verified against a REAL executed transaction on the Core Team
  SAFE (Gnosis, nonce 6 — safeTxHash 0x776c65...). Manual abi.encode
  approach (domain separator must use abi.encode, NOT encodePacked).
- propose(): builds Safe tx, signs safeTxHash with delegate key via
  unsafe_sign_hash (raw ECDSA, no EIP-191 prefix), POSTs to SAFE Transaction
  Service API. Agent holds delegate key (propose-only); humans confirm.
- register_delegate(), list_delegates(), build_tx() helpers.
- tests/test_treasury_propose.py: 7 tests including the real on-chain vector,
  mocked HTTP propose, nonce/address determinism.
- 20 treasury tests now green (13 existing + 7 new).

Refs KI-14 · iteration v1.2

- services/attestation/safe_flow.py: propose_attestation() builds the EAS
  attest() call data, wraps it in a Safe tx, and proposes it to the Core
  Team SAFE on Celo (delegate key = propose-only). process_pending_requests_via_safe()
  batch entry point; reconcile_attestation_executions() polls the SAFE
  Transaction Service and marks requests executed once humans confirm.
- services/attestation/eas_client.py: refactor attest() -> build_attest_call()
  (encode-only, no send) — the SAFE integration seam.
- schemas/postgres/355: attestation_request gains safe_tx_hash, proposal_status,
  safe_chain (proposed→executed lifecycle).
- tests/test_attestation_safe.py: 3 tests (propose, reconcile executed,
  reconcile pending) — mock EASClient/SafeProposeClient/SafeReadClient.

Security: ATTESTER_PRIVATE_KEY becomes propose-only (delegate key). Even a
full key leak can only propose, never execute — human confirmation on the
SAFE (Celo 1-of-3) gates execution.

Refs KI-14 · iteration v1.2

- services/credit_class/safe_settlement.py: propose_settlement() builds a
  KokonutCreditToken transferFrom call (seller→buyer + fee→treasury) as a
  SAFE transaction and proposes it to the Core Team SAFE (2-of-3, Gnosis).
  propose_farm_op() shared helper for value moves.
- schemas/postgres/356: credit_sell_order/credit_buy_order gain
  safe_settlement_tx_hash + settlement_status (pending→proposed→executed).
- tests/test_safe_settlement.py: 3 tests (credit transfer ABI encoding,
  default SAFE, farm op proposal).

Order book stays in DB (source of truth); value moves now require 2-of-3
human confirmation via SAFE instead of raw DB updates.

Refs KI-14 · iteration v1.2

- services/treasury/ops.py: propose_farm_op() — agent proposes payroll,
  inputs, expenses on a deployed farm SAFE. Address/chain resolve from the
  safe_account provisioning record (Phase C) or explicit params.
- services/treasury/cli.py: kokonut treasury ops-propose command.
- tests/test_treasury_ops.py: 4 tests (explicit address, DB resolve,
  unknown safe, decimal value).
- docs/treasury.md: write-path section with D2/D3/D4 flows + security invariant.

All 30 treasury + attestation + settlement tests pass, 7 CLI commands registered.

Refs KI-14 · iteration v1.2

The test was setting sys.modules entries directly to fake modules, which
leaked into the rest of the test suite. When test_data_stream ran after
my test, it imported the fake 'services.attestation.schemas' (returning
1 field) instead of the real one (returning 9 fields), causing
'assert 1 == 9' in CI. Fixed with monkeypatch.setitem which auto-restores
the original sys.modules entry after the test.