diff --git a/.github/workflows/_ci.yml b/.github/workflows/_ci.yml
index 1cc4817..145b2b4 100644
--- a/.github/workflows/_ci.yml
+++ b/.github/workflows/_ci.yml
@@ -1,5 +1,5 @@
 # Reusable CI workflow for Foundry projects
-# Usage: jobs.<job>.uses: ./.github/workflows/_ci.yml
+# Usage: jobs.<job>.uses: BreadchainCoop/etherform/.github/workflows/_ci.yml@main
 name: CI (Reusable)
 
 on:
@@ -57,6 +57,10 @@ on:
         description: 'Run Halmos symbolic execution'
         type: boolean
         default: false
+      etherform-ref:
+        description: 'Git ref for etherform scripts checkout (default: main)'
+        type: string
+        default: 'main'
     secrets:
       RPC_URL:
         description: 'RPC endpoint for fork-based tests'
@@ -155,6 +159,14 @@ jobs:
         with:
           submodules: recursive
 
+      - name: Checkout etherform scripts
+        uses: actions/checkout@v4
+        with:
+          repository: BreadchainCoop/etherform
+          ref: ${{ inputs.etherform-ref }}
+          path: .etherform
+          sparse-checkout: scripts
+
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
 
@@ -189,66 +201,9 @@ jobs:
 
       - name: Extract summary table
         id: summary
-        run: |
-          # Extract the final summary table (box-drawing characters)
-          awk '/^╭/,/^╰/' coverage-raw.txt > coverage-table.txt
-
-          # Filter to only source files and compute totals from raw counts
-          grep '^|' coverage-table.txt | grep '${{ inputs.coverage-source-filter }}' > src-rows.txt || true
-
-          # Sum up hit/total for each metric across source files
-          total_lines_hit=0; total_lines_all=0
-          total_stmts_hit=0; total_stmts_all=0
-          total_branch_hit=0; total_branch_all=0
-          total_funcs_hit=0; total_funcs_all=0
-
-          while IFS='|' read -r _ file lines stmts branches funcs _; do
-            extract() { echo "$1" | grep -oP '\(\K[0-9]+/[0-9]+' | tr '/' ' '; }
-            read lh lt <<< "$(extract "$lines")"
-            read sh st <<< "$(extract "$stmts")"
-            read bh bt <<< "$(extract "$branches")"
-            read fh ft <<< "$(extract "$funcs")"
-            total_lines_hit=$((total_lines_hit + lh)); total_lines_all=$((total_lines_all + lt))
-            total_stmts_hit=$((total_stmts_hit + sh)); total_stmts_all=$((total_stmts_all + st))
-            total_branch_hit=$((total_branch_hit + bh)); total_branch_all=$((total_branch_all + bt))
-            total_funcs_hit=$((total_funcs_hit + fh)); total_funcs_all=$((total_funcs_all + ft))
-          done < src-rows.txt
-
-          pct() { [ "$2" -eq 0 ] && echo "100.00% (0/0)" || printf "%.2f%% (%d/%d)" "$(echo "scale=4; $1 * 100 / $2" | bc)" "$1" "$2"; }
-
-          # Compute numeric percentages for threshold checking
-          num_pct() { [ "$2" -eq 0 ] && echo "100.00" || echo "scale=2; $1 * 100 / $2" | bc; }
-          echo "lines_pct=$(num_pct $total_lines_hit $total_lines_all)" >> $GITHUB_OUTPUT
-          echo "stmts_pct=$(num_pct $total_stmts_hit $total_stmts_all)" >> $GITHUB_OUTPUT
-          echo "branch_pct=$(num_pct $total_branch_hit $total_branch_all)" >> $GITHUB_OUTPUT
-          echo "funcs_pct=$(num_pct $total_funcs_hit $total_funcs_all)" >> $GITHUB_OUTPUT
-
-          # Build the markdown comment
-          {
-            echo "## Coverage Report"
-            echo ""
-            echo "| Metric | Coverage |"
-            echo "|--------|----------|"
-            echo "| Lines | $(pct $total_lines_hit $total_lines_all) |"
-            echo "| Statements | $(pct $total_stmts_hit $total_stmts_all) |"
-            echo "| Branches | $(pct $total_branch_hit $total_branch_all) |"
-            echo "| Functions | $(pct $total_funcs_hit $total_funcs_all) |"
-            echo ""
-            echo "<details><summary>Coverage by file</summary>"
-            echo ""
-            echo "| File | Lines | Statements | Branches | Functions |"
-            echo "|------|-------|------------|----------|-----------|"
-            while IFS='|' read -r _ file lines stmts branches funcs _; do
-              file=$(echo "$file" | xargs)
-              lines=$(echo "$lines" | xargs)
-              stmts=$(echo "$stmts" | xargs)
-              branches=$(echo "$branches" | xargs)
-              funcs=$(echo "$funcs" | xargs)
-              echo "| \`$file\` | $lines | $stmts | $branches | $funcs |"
-            done < src-rows.txt
-            echo ""
-            echo "</details>"
-          } > coverage-comment.md
+        env:
+          COVERAGE_SOURCE_FILTER: ${{ inputs.coverage-source-filter }}
+        run: bash .etherform/scripts/coverage/extract-summary.sh
 
       - name: Post coverage comment
         if: inputs.coverage-post-comment && github.event_name == 'pull_request'
@@ -258,24 +213,13 @@ jobs:
 
       - name: Check coverage threshold
         if: inputs.coverage-min-threshold > 0
-        run: |
-          THRESHOLD=${{ inputs.coverage-min-threshold }}
-          FAILED=0
-          for metric in "Lines:${{ steps.summary.outputs.lines_pct }}" \
-                        "Statements:${{ steps.summary.outputs.stmts_pct }}" \
-                        "Branches:${{ steps.summary.outputs.branch_pct }}" \
-                        "Functions:${{ steps.summary.outputs.funcs_pct }}"; do
-            NAME="${metric%%:*}"
-            VALUE="${metric#*:}"
-            if (( $(echo "$VALUE < $THRESHOLD" | bc -l) )); then
-              echo "::error::$NAME coverage ($VALUE%) is below threshold ($THRESHOLD%)"
-              FAILED=1
-            fi
-          done
-          if [[ $FAILED -eq 1 ]]; then
-            exit 1
-          fi
-          echo "All coverage metrics meet the $THRESHOLD% threshold"
+        env:
+          THRESHOLD: ${{ inputs.coverage-min-threshold }}
+          LINES_PCT: ${{ steps.summary.outputs.lines_pct }}
+          STMTS_PCT: ${{ steps.summary.outputs.stmts_pct }}
+          BRANCH_PCT: ${{ steps.summary.outputs.branch_pct }}
+          FUNCS_PCT: ${{ steps.summary.outputs.funcs_pct }}
+        run: bash .etherform/scripts/coverage/check-threshold.sh
 
   halmos:
     name: Symbolic Execution
@@ -318,4 +262,3 @@ jobs:
         env:
           RPC_URL: ${{ secrets.RPC_URL }}
         run: halmos
-
diff --git a/.github/workflows/_deploy-testnet.yml b/.github/workflows/_deploy-testnet.yml
index 282115b..5277012 100644
--- a/.github/workflows/_deploy-testnet.yml
+++ b/.github/workflows/_deploy-testnet.yml
@@ -1,5 +1,5 @@
 # Reusable testnet deployment workflow
-# Usage: jobs.<job>.uses: ./.github/workflows/_deploy-testnet.yml
+# Usage: jobs.<job>.uses: BreadchainCoop/etherform/.github/workflows/_deploy-testnet.yml@main
 name: Deploy Testnet (Reusable)
 
 on:
@@ -33,6 +33,10 @@ on:
         description: 'Node.js version for package installation'
         type: string
         default: '20'
+      etherform-ref:
+        description: 'Git ref for etherform scripts checkout (default: main)'
+        type: string
+        default: 'main'
     secrets:
       PRIVATE_KEY:
         required: true
@@ -55,6 +59,14 @@ jobs:
         with:
           submodules: recursive
 
+      - name: Checkout etherform scripts
+        uses: actions/checkout@v4
+        with:
+          repository: BreadchainCoop/etherform
+          ref: ${{ inputs.etherform-ref }}
+          path: .etherform
+          sparse-checkout: scripts
+
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
 
@@ -88,19 +100,7 @@ jobs:
           RPC_URL: ${{ secrets.RPC_URL }}
           DEPLOY_ENV_VARS: ${{ secrets.DEPLOY_ENV_VARS }}
         run: |
-          # Ensure PRIVATE_KEY has 0x prefix
-          if [[ "$PRIVATE_KEY" != 0x* ]]; then
-            export PRIVATE_KEY="0x$PRIVATE_KEY"
-          fi
-
-          # Export user-provided environment variables
-          if [[ -n "$DEPLOY_ENV_VARS" ]]; then
-            while IFS= read -r line; do
-              [[ -z "$line" || "$line" == \#* ]] && continue
-              export "$line"
-            done <<< "$DEPLOY_ENV_VARS"
-          fi
-
+          source .etherform/scripts/deploy/prepare-env.sh
           forge script ${{ inputs.deploy-script }} \
             --rpc-url "$RPC_URL" \
             --broadcast \
@@ -112,24 +112,12 @@ jobs:
 
       - name: Parse deployment addresses
         id: parse
-        run: |
-          # Find the latest broadcast file
-          BROADCAST_FILE=$(find broadcast -name "run-latest.json" -type f | head -1)
-          if [[ -z "$BROADCAST_FILE" ]]; then
-            echo "No broadcast file found"
-            exit 1
-          fi
-          echo "broadcast_file=$BROADCAST_FILE" >> $GITHUB_OUTPUT
-
-          # Extract deployed contract addresses
-          jq -r '.transactions[] | select(.transactionType == "CREATE") | "\(.contractName): \(.contractAddress)"' "$BROADCAST_FILE" | tee deployment-summary.txt
+        run: bash .etherform/scripts/deploy/parse-broadcast.sh
 
       - name: Save deployment artifacts
         run: |
           mkdir -p deployments/${{ steps.network.outputs.network_name }}
           BROADCAST_FILE="${{ steps.parse.outputs.broadcast_file }}"
-
-          # Extract contracts with proper sourcePathAndName format
           jq '{contracts: [.transactions[] | select(.transactionType == "CREATE") | {sourcePathAndName: "src/\(.contractName).sol:\(.contractName)", address: .contractAddress}]}' "$BROADCAST_FILE" \
             > deployments/${{ steps.network.outputs.network_name }}/deployment.json
 
@@ -142,79 +130,13 @@ jobs:
       - name: Create deployment summary
         env:
           BLOCKSCOUT_URL: ${{ steps.network.outputs.blockscout_url }}
-          ETH_RPC_URL: ${{ secrets.RPC_URL }}
-        run: |
-          echo "## Testnet Deployment Summary" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "| Contract | Address | Explorer |" >> $GITHUB_STEP_SUMMARY
-          echo "|----------|---------|----------|" >> $GITHUB_STEP_SUMMARY
-
-          while read -r line; do
-            CONTRACT=$(echo "$line" | cut -d: -f1)
-            ADDRESS=$(echo "$line" | cut -d: -f2 | tr -d ' ')
-            echo "| $CONTRACT | \`$ADDRESS\` | [View](${BLOCKSCOUT_URL}/address/$ADDRESS) |" >> $GITHUB_STEP_SUMMARY
-          done < deployment-summary.txt
+          SUMMARY_TITLE: Testnet Deployment Summary
+        run: bash .etherform/scripts/deploy/deployment-summary.sh
 
       - name: Verify contracts on Blockscout
         if: inputs.verify-contracts
         env:
           BLOCKSCOUT_URL: ${{ steps.network.outputs.blockscout_url }}
           ETH_RPC_URL: ${{ secrets.RPC_URL }}
-        run: |
-          # Validate Blockscout URL format (fail fast on bad URL)
-          if [[ -z "$BLOCKSCOUT_URL" || "$BLOCKSCOUT_URL" == "null" ]]; then
-            echo "::error::BLOCKSCOUT_URL is empty or not configured. Check deploy-networks.json."
-            exit 1
-          fi
-          if [[ ! "$BLOCKSCOUT_URL" =~ ^https?:// ]]; then
-            echo "::error::BLOCKSCOUT_URL has invalid format (got: '$BLOCKSCOUT_URL'). Must start with http:// or https://."
-            exit 1
-          fi
-
-          BROADCAST_FILE="${{ steps.parse.outputs.broadcast_file }}"
-          VERIFY_FAILED=0
-
-          # Use process substitution (not pipe) so variables propagate to this shell
-          while read -r tx; do
-            CONTRACT_NAME=$(echo "$tx" | jq -r '.contractName')
-            CONTRACT_ADDR=$(echo "$tx" | jq -r '.contractAddress')
-
-            echo "Verifying $CONTRACT_NAME at $CONTRACT_ADDR..."
-            VERIFIED=0
-
-            for attempt in 1 2 3; do
-              # Capture output to check for actual success (exit code alone is unreliable)
-              # Use timeout to prevent hanging on unreachable URLs
-              VERIFY_OUTPUT=$(timeout 120 forge verify-contract "$CONTRACT_ADDR" "$CONTRACT_NAME" \
-                --verifier blockscout \
-                --verifier-url "${BLOCKSCOUT_URL}/api" \
-                --guess-constructor-args \
-                --watch 2>&1) || true
-              echo "$VERIFY_OUTPUT"
-
-              if echo "$VERIFY_OUTPUT" | grep -qi "Contract successfully verified\|Pass - Verified"; then
-                echo "✓ Verified $CONTRACT_NAME"
-                VERIFIED=1
-                break
-              elif echo "$VERIFY_OUTPUT" | grep -qi "Already Verified"; then
-                echo "✓ $CONTRACT_NAME already verified"
-                VERIFIED=1
-                break
-              else
-                if [[ $attempt -lt 3 ]]; then
-                  echo "Attempt $attempt failed, retrying in $((attempt * 30))s..."
-                  sleep $((attempt * 30))
-                fi
-              fi
-            done
-
-            if [[ $VERIFIED -eq 0 ]]; then
-              echo "::error::Verification failed for $CONTRACT_NAME after 3 attempts"
-              VERIFY_FAILED=1
-            fi
-          done < <(jq -c '.transactions[] | select(.transactionType == "CREATE")' "$BROADCAST_FILE")
-
-          if [[ $VERIFY_FAILED -eq 1 ]]; then
-            echo "::error::One or more contracts failed verification"
-            exit 1
-          fi
+          BROADCAST_FILE: ${{ steps.parse.outputs.broadcast_file }}
+        run: bash .etherform/scripts/deploy/verify-blockscout.sh
diff --git a/.github/workflows/_foundry-cicd.yml b/.github/workflows/_foundry-cicd.yml
index 726083c..22724de 100644
--- a/.github/workflows/_foundry-cicd.yml
+++ b/.github/workflows/_foundry-cicd.yml
@@ -78,10 +78,6 @@ on:
         default: 0
 
       # Upgrade Safety Options
-      run-upgrade-safety:
-        description: 'Run upgrade safety validation'
-        type: boolean
-        default: true
       upgrades-config:
         description: 'Path to upgrade safety configuration (upgrades.json)'
         type: string
@@ -118,6 +114,12 @@ on:
         type: boolean
         default: false
 
+      # Etherform Options
+      etherform-ref:
+        description: 'Git ref for etherform scripts checkout (default: main)'
+        type: string
+        default: 'main'
+
     secrets:
       PRIVATE_KEY:
         description: 'Deployer wallet private key'
@@ -273,6 +275,14 @@ jobs:
         with:
           submodules: recursive
 
+      - name: Checkout etherform scripts
+        uses: actions/checkout@v4
+        with:
+          repository: BreadchainCoop/etherform
+          ref: ${{ inputs.etherform-ref }}
+          path: .etherform
+          sparse-checkout: scripts
+
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
 
@@ -307,66 +317,9 @@ jobs:
 
       - name: Extract summary table
         id: summary
-        run: |
-          # Extract the final summary table (box-drawing characters)
-          awk '/^╭/,/^╰/' coverage-raw.txt > coverage-table.txt
-
-          # Filter to only source files and compute totals from raw counts
-          grep '^|' coverage-table.txt | grep '${{ inputs.coverage-source-filter }}' > src-rows.txt || true
-
-          # Sum up hit/total for each metric across source files
-          total_lines_hit=0; total_lines_all=0
-          total_stmts_hit=0; total_stmts_all=0
-          total_branch_hit=0; total_branch_all=0
-          total_funcs_hit=0; total_funcs_all=0
-
-          while IFS='|' read -r _ file lines stmts branches funcs _; do
-            extract() { echo "$1" | grep -oP '\(\K[0-9]+/[0-9]+' | tr '/' ' '; }
-            read lh lt <<< "$(extract "$lines")"
-            read sh st <<< "$(extract "$stmts")"
-            read bh bt <<< "$(extract "$branches")"
-            read fh ft <<< "$(extract "$funcs")"
-            total_lines_hit=$((total_lines_hit + lh)); total_lines_all=$((total_lines_all + lt))
-            total_stmts_hit=$((total_stmts_hit + sh)); total_stmts_all=$((total_stmts_all + st))
-            total_branch_hit=$((total_branch_hit + bh)); total_branch_all=$((total_branch_all + bt))
-            total_funcs_hit=$((total_funcs_hit + fh)); total_funcs_all=$((total_funcs_all + ft))
-          done < src-rows.txt
-
-          pct() { [ "$2" -eq 0 ] && echo "100.00% (0/0)" || printf "%.2f%% (%d/%d)" "$(echo "scale=4; $1 * 100 / $2" | bc)" "$1" "$2"; }
-
-          # Compute numeric percentages for threshold checking
-          num_pct() { [ "$2" -eq 0 ] && echo "100.00" || echo "scale=2; $1 * 100 / $2" | bc; }
-          echo "lines_pct=$(num_pct $total_lines_hit $total_lines_all)" >> $GITHUB_OUTPUT
-          echo "stmts_pct=$(num_pct $total_stmts_hit $total_stmts_all)" >> $GITHUB_OUTPUT
-          echo "branch_pct=$(num_pct $total_branch_hit $total_branch_all)" >> $GITHUB_OUTPUT
-          echo "funcs_pct=$(num_pct $total_funcs_hit $total_funcs_all)" >> $GITHUB_OUTPUT
-
-          # Build the markdown comment
-          {
-            echo "## Coverage Report"
-            echo ""
-            echo "| Metric | Coverage |"
-            echo "|--------|----------|"
-            echo "| Lines | $(pct $total_lines_hit $total_lines_all) |"
-            echo "| Statements | $(pct $total_stmts_hit $total_stmts_all) |"
-            echo "| Branches | $(pct $total_branch_hit $total_branch_all) |"
-            echo "| Functions | $(pct $total_funcs_hit $total_funcs_all) |"
-            echo ""
-            echo "<details><summary>Coverage by file</summary>"
-            echo ""
-            echo "| File | Lines | Statements | Branches | Functions |"
-            echo "|------|-------|------------|----------|-----------|"
-            while IFS='|' read -r _ file lines stmts branches funcs _; do
-              file=$(echo "$file" | xargs)
-              lines=$(echo "$lines" | xargs)
-              stmts=$(echo "$stmts" | xargs)
-              branches=$(echo "$branches" | xargs)
-              funcs=$(echo "$funcs" | xargs)
-              echo "| \`$file\` | $lines | $stmts | $branches | $funcs |"
-            done < src-rows.txt
-            echo ""
-            echo "</details>"
-          } > coverage-comment.md
+        env:
+          COVERAGE_SOURCE_FILTER: ${{ inputs.coverage-source-filter }}
+        run: bash .etherform/scripts/coverage/extract-summary.sh
 
       - name: Post coverage comment
         if: inputs.coverage-post-comment && github.event_name == 'pull_request'
@@ -376,24 +329,13 @@ jobs:
 
       - name: Check coverage threshold
         if: inputs.coverage-min-threshold > 0
-        run: |
-          THRESHOLD=${{ inputs.coverage-min-threshold }}
-          FAILED=0
-          for metric in "Lines:${{ steps.summary.outputs.lines_pct }}" \
-                        "Statements:${{ steps.summary.outputs.stmts_pct }}" \
-                        "Branches:${{ steps.summary.outputs.branch_pct }}" \
-                        "Functions:${{ steps.summary.outputs.funcs_pct }}"; do
-            NAME="${metric%%:*}"
-            VALUE="${metric#*:}"
-            if (( $(echo "$VALUE < $THRESHOLD" | bc -l) )); then
-              echo "::error::$NAME coverage ($VALUE%) is below threshold ($THRESHOLD%)"
-              FAILED=1
-            fi
-          done
-          if [[ $FAILED -eq 1 ]]; then
-            exit 1
-          fi
-          echo "All coverage metrics meet the $THRESHOLD% threshold"
+        env:
+          THRESHOLD: ${{ inputs.coverage-min-threshold }}
+          LINES_PCT: ${{ steps.summary.outputs.lines_pct }}
+          STMTS_PCT: ${{ steps.summary.outputs.stmts_pct }}
+          BRANCH_PCT: ${{ steps.summary.outputs.branch_pct }}
+          FUNCS_PCT: ${{ steps.summary.outputs.funcs_pct }}
+        run: bash .etherform/scripts/coverage/check-threshold.sh
 
   halmos:
     name: Symbolic Execution
@@ -445,9 +387,7 @@ jobs:
     name: Upgrade Safety
     runs-on: ubuntu-latest
     needs: [detect-changes, ci]
-    if: |
-      needs.detect-changes.outputs.should-run == 'true' &&
-      inputs.run-upgrade-safety
+    if: needs.detect-changes.outputs.should-run == 'true'
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -455,16 +395,18 @@ jobs:
           submodules: recursive
           fetch-depth: 0
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - name: Checkout etherform scripts
+        uses: actions/checkout@v4
         with:
-          node-version: ${{ inputs.node-version }}
+          repository: BreadchainCoop/etherform
+          ref: ${{ inputs.etherform-ref }}
+          path: .etherform
+          sparse-checkout: scripts
 
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
 
       - name: Setup Node.js
-        if: inputs.package-manager != 'none'
         uses: actions/setup-node@v4
         with:
           node-version: ${{ inputs.node-version }}
@@ -482,172 +424,18 @@ jobs:
       - name: Build contracts
         run: forge build --build-info --extra-output storageLayout
 
-      - name: Validate upgrade safety
-        run: |
-          set -euo pipefail
-
-          CONFIG="${{ inputs.upgrades-config }}"
-          BASE_BRANCH="${{ inputs.main-branch }}"
-          CURRENT_BUILD="out/build-info"
-
-          # Check if config exists
-          if [[ ! -f "$CONFIG" ]]; then
-            echo "::warning::No upgrades config found at $CONFIG — skipping upgrade safety validation"
-            {
-              echo "## Upgrade Safety Validation"
-              echo ""
-              echo "> No \`$CONFIG\` found. Skipping validation."
-            } >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-
-          # Check for contracts array and handle empty contracts
-          CONTRACT_COUNT=$(jq -r 'try (.contracts | length) catch "INVALID_CONTRACTS"' "$CONFIG")
-          if [[ "$CONTRACT_COUNT" == "INVALID_CONTRACTS" ]]; then
-            echo "::error::Invalid upgrades config at $CONFIG — \`.contracts\` must be an array"
-            exit 1
-          fi
-          if [[ "$CONTRACT_COUNT" -eq 0 ]]; then
-            echo "::warning::No contracts defined in $CONFIG — skipping upgrade safety validation"
-            {
-              echo "## Upgrade Safety Validation"
-              echo ""
-              echo "> No contracts defined in \`$CONFIG\`. Skipping validation."
-            } >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-
-          # Check if any contracts need base branch comparison (no explicit reference)
-          NEEDS_BASE=false
-          while IFS= read -r entry; do
-            REF_VALUE=$(echo "$entry" | jq -c '.reference // empty')
-            if [[ -z "$REF_VALUE" || "$REF_VALUE" == "null" ]]; then
-              NEEDS_BASE=true
-              break
-            fi
-          done < <(jq -c '.contracts[]' "$CONFIG")
-
-          # Build base branch in a worktree if needed
-          BASE_BUILD=""
-          BASE_DIR=""
-          if [[ "$NEEDS_BASE" == "true" ]]; then
-            echo "Building base branch ($BASE_BRANCH) for comparison..."
-            git fetch origin "$BASE_BRANCH" 2>/dev/null || true
-            BASE_DIR=$(mktemp -d)
-
-            if git worktree add --detach "$BASE_DIR" "origin/$BASE_BRANCH" 2>/dev/null; then
-              (cd "$BASE_DIR" && git submodule update --init --recursive 2>/dev/null || true)
-
-              # Install dependencies in base worktree if needed
-              if [[ "${{ inputs.package-manager }}" != "none" ]]; then
-                (cd "$BASE_DIR" && case "${{ inputs.package-manager }}" in
-                  npm)  npm ci ;;
-                  yarn) yarn --frozen-lockfile ;;
-                  pnpm) corepack enable && pnpm install --frozen-lockfile ;;
-                esac) || echo "::warning::Failed to install dependencies in base branch"
-              fi
-
-              if (cd "$BASE_DIR" && forge build --build-info --extra-output storageLayout 2>&1); then
-                mv "${BASE_DIR}/out/build-info" "${BASE_DIR}/out/base-build-info"
-                BASE_BUILD="${BASE_DIR}/out/base-build-info"
-                echo "Base branch built successfully"
-              else
-                echo "::warning::Failed to build base branch — contracts without explicit reference will be validated for upgradeability only"
-              fi
-            else
-              echo "::warning::Could not checkout base branch '$BASE_BRANCH' — contracts without explicit reference will be validated for upgradeability only"
-            fi
-          fi
-
-          PASSED=0
-          FAILED=0
-          SUMMARY=""
-
-          # Validate each contract
-          while IFS= read -r entry; do
-            CONTRACT=$(echo "$entry" | jq -r '.contract')
-            REF_VALUE=$(echo "$entry" | jq -c '.reference // empty')
-            CONTRACT_PATH="${CONTRACT%%:*}"
-
-            echo "::group::Validating $CONTRACT"
-
-            if [[ -z "$REF_VALUE" || "$REF_VALUE" == "null" ]]; then
-              # === Base branch comparison (default) ===
-              if [[ -n "$BASE_BUILD" ]] && git show "origin/${BASE_BRANCH}:${CONTRACT_PATH}" > /dev/null 2>&1; then
-                # Contract exists on base branch — compare storage layouts
-                if OUTPUT=$(npx @openzeppelin/upgrades-core validate "$CURRENT_BUILD" \
-                    --contract "$CONTRACT" \
-                    --reference "base-build-info:${CONTRACT}" \
-                    --referenceBuildInfoDirs "$BASE_BUILD" 2>&1); then
-                  echo "$OUTPUT"
-                  SUMMARY="${SUMMARY}| \`${CONTRACT}\` | \`${BASE_BRANCH}\` branch | Pass |"$'\n'
-                  PASSED=$((PASSED + 1))
-                else
-                  echo "$OUTPUT"
-                  SUMMARY="${SUMMARY}| \`${CONTRACT}\` | \`${BASE_BRANCH}\` branch | **FAIL** |"$'\n'
-                  FAILED=$((FAILED + 1))
-                fi
-              else
-                # Contract doesn't exist on base branch or base build failed — validate upgradeability only
-                echo "Contract not found on $BASE_BRANCH or base build unavailable, validating upgradeability only..."
-                if OUTPUT=$(npx @openzeppelin/upgrades-core validate "$CURRENT_BUILD" \
-                    --contract "$CONTRACT" 2>&1); then
-                  echo "$OUTPUT"
-                  SUMMARY="${SUMMARY}| \`${CONTRACT}\` | (new contract) | Pass |"$'\n'
-                  PASSED=$((PASSED + 1))
-                else
-                  echo "$OUTPUT"
-                  SUMMARY="${SUMMARY}| \`${CONTRACT}\` | (new contract) | **FAIL** |"$'\n'
-                  FAILED=$((FAILED + 1))
-                fi
-              fi
-
-            elif echo "$REF_VALUE" | jq -e 'type == "string"' > /dev/null 2>&1; then
-              # === Contract qualifier reference ===
-              QUALIFIER=$(echo "$entry" | jq -r '.reference')
-              if OUTPUT=$(npx @openzeppelin/upgrades-core validate "$CURRENT_BUILD" \
-                  --contract "$CONTRACT" \
-                  --reference "$QUALIFIER" 2>&1); then
-                echo "$OUTPUT"
-                SUMMARY="${SUMMARY}| \`${CONTRACT}\` | \`${QUALIFIER}\` | Pass |"$'\n'
-                PASSED=$((PASSED + 1))
-              else
-                echo "$OUTPUT"
-                SUMMARY="${SUMMARY}| \`${CONTRACT}\` | \`${QUALIFIER}\` | **FAIL** |"$'\n'
-                FAILED=$((FAILED + 1))
-              fi
-
-            else
-              echo "::error::Invalid reference format for $CONTRACT"
-              SUMMARY="${SUMMARY}| \`${CONTRACT}\` | (invalid reference) | **FAIL** |"$'\n'
-              FAILED=$((FAILED + 1))
-            fi
-
-            echo "::endgroup::"
-          done < <(jq -c '.contracts[]' "$CONFIG")
-
-          # Clean up worktree
-          if [[ -n "$BASE_DIR" ]]; then
-            git worktree remove "$BASE_DIR" --force 2>/dev/null || true
-          fi
-
-          # Write Step Summary
-          {
-            echo "## Upgrade Safety Validation"
-            echo ""
-            echo "| Contract | Reference | Result |"
-            echo "|----------|-----------|--------|"
-            echo -n "$SUMMARY"
-            echo ""
-            echo "**${PASSED} passed, ${FAILED} failed**"
-          } >> "$GITHUB_STEP_SUMMARY"
-
-          if [[ "$FAILED" -gt 0 ]]; then
-            echo "::error::${FAILED} contract(s) failed upgrade safety validation"
-            exit 1
-          fi
+      - name: Validate upgrades config
+        env:
+          UPGRADES_CONFIG: ${{ inputs.upgrades-config }}
+          BASE_BRANCH: ${{ inputs.main-branch }}
+        run: bash .etherform/scripts/upgrade-safety/validate-config.sh
 
-          echo "All contracts passed upgrade safety validation"
+      - name: Validate upgrade safety
+        env:
+          UPGRADES_CONFIG: ${{ inputs.upgrades-config }}
+          BASE_BRANCH: ${{ inputs.main-branch }}
+          PACKAGE_MANAGER: ${{ inputs.package-manager }}
+        run: bash .etherform/scripts/upgrade-safety/validate.sh
 
   deploy-testnet:
     name: Deploy Testnet
@@ -657,7 +445,7 @@ jobs:
       always() &&
       needs.detect-changes.outputs.should-run == 'true' &&
       needs.ci.result == 'success' &&
-      (needs.upgrade-safety.result == 'success' || needs.upgrade-safety.result == 'skipped') &&
+      needs.upgrade-safety.result == 'success' &&
       inputs.deploy-on-pr &&
       github.event_name == 'pull_request'
     steps:
@@ -666,6 +454,14 @@ jobs:
         with:
           submodules: recursive
 
+      - name: Checkout etherform scripts
+        uses: actions/checkout@v4
+        with:
+          repository: BreadchainCoop/etherform
+          ref: ${{ inputs.etherform-ref }}
+          path: .etherform
+          sparse-checkout: scripts
+
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
 
@@ -691,19 +487,8 @@ jobs:
           RPC_URL: ${{ secrets.RPC_URL }}
           DEPLOY_ENV_VARS: ${{ secrets.DEPLOY_ENV_VARS }}
         run: |
-          if [[ "$PRIVATE_KEY" != 0x* ]]; then
-            export PRIVATE_KEY="0x$PRIVATE_KEY"
-          fi
-
-          # Export user-provided environment variables
-          if [[ -n "$DEPLOY_ENV_VARS" ]]; then
-            while IFS= read -r line; do
-              [[ -z "$line" || "$line" == \#* ]] && continue
-              export "$line"
-            done <<< "$DEPLOY_ENV_VARS"
-          fi
-
-          forge script ${{ inputs.deploy-script }} \
+          source .etherform/scripts/deploy/prepare-env.sh
+          forge script "${{ inputs.deploy-script }}" \
             --rpc-url "$RPC_URL" \
             --private-key "$PRIVATE_KEY" \
             --broadcast \
@@ -715,175 +500,25 @@ jobs:
 
       - name: Parse deployment addresses
         id: parse
-        run: |
-          BROADCAST_FILE=$(find broadcast -name "run-latest.json" -type f | head -1)
-          if [[ -z "$BROADCAST_FILE" ]]; then
-            echo "No broadcast file found"
-            exit 1
-          fi
-          echo "broadcast_file=$BROADCAST_FILE" >> $GITHUB_OUTPUT
-
-          # Extract the chain ID from the broadcast file path (broadcast/<script>/<chain_id>/run-latest.json)
-          CHAIN_ID=$(echo "$BROADCAST_FILE" | sed -E 's|.*/([0-9]+)/run-latest\.json$|\1|')
-          echo "chain_id=$CHAIN_ID" >> $GITHUB_OUTPUT
-          echo "Deployed to chain ID: $CHAIN_ID"
-
-          jq -r '.transactions[] | select(.transactionType == "CREATE") | "\(.contractName): \(.contractAddress)"' "$BROADCAST_FILE" | tee deployment-summary.txt
+        run: bash .etherform/scripts/deploy/parse-broadcast.sh
 
       - name: Resolve Blockscout URL from chain ID
         id: network
-        run: |
-          CHAIN_ID="${{ steps.parse.outputs.chain_id }}"
-          CONFIG="${{ inputs.network-config-path }}"
-
-          # Search testnets array for a matching chain_id
-          BLOCKSCOUT_URL=$(jq -r --argjson cid "$CHAIN_ID" '
-            (.testnets // [])
-            | map(select(.chain_id == $cid))
-            | first
-            | .blockscout_url // empty
-          ' "$CONFIG" 2>/dev/null) || true
-
-          if [[ -z "$BLOCKSCOUT_URL" || "$BLOCKSCOUT_URL" == "null" ]]; then
-            echo "::warning::No Blockscout URL found for chain ID $CHAIN_ID in $CONFIG. Falling back to testnets[0]."
-            BLOCKSCOUT_URL=$(jq -r '.testnets[0].blockscout_url' "$CONFIG")
-          fi
-
-          NETWORK_NAME=$(jq -r --argjson cid "$CHAIN_ID" '
-            (.testnets // [])
-            | map(select(.chain_id == $cid))
-            | first
-            | .name // "unknown"
-          ' "$CONFIG" 2>/dev/null) || NETWORK_NAME="unknown"
-
-          # Ensure BLOCKSCOUT_URL is actually BLOCKSCOUT API
-          BLOCKSCOUT_API="${BLOCKSCOUT_URL%/}/api/"
-
-          echo "Checking Blockscout API at: $BLOCKSCOUT_API"
-
-          RESPONSE=$(curl -sS --max-time 10 \
-          "${BLOCKSCOUT_API}?module=block&action=eth_block_number" || true)
-
-          # Check it's valid JSON and has expected shape
-          STATUS=$(echo "$RESPONSE" | jq -r '.jsonrpc // empty' 2>/dev/null || true)
-
-          if [[ "$STATUS" != "2.0" ]]; then
-            echo "::error::Invalid Blockscout API URL: $BLOCKSCOUT_API"
-            echo "Response was:"
-            echo "$RESPONSE"
-            exit 1
-          fi
-
-          echo "✓ Blockscout API looks valid"
-
-          echo "blockscout_url=$BLOCKSCOUT_URL" >> $GITHUB_OUTPUT
-          echo "network_name=$NETWORK_NAME" >> $GITHUB_OUTPUT
-          echo "Resolved Blockscout URL for chain $CHAIN_ID: $BLOCKSCOUT_URL ($NETWORK_NAME)"
+        env:
+          CHAIN_ID: ${{ steps.parse.outputs.chain_id }}
+          NETWORK_CONFIG: ${{ inputs.network-config-path }}
+        run: bash .etherform/scripts/deploy/resolve-network.sh
 
       - name: Create deployment summary
         env:
           BLOCKSCOUT_URL: ${{ steps.network.outputs.blockscout_url }}
-          ETH_RPC_URL: ${{ secrets.RPC_URL }}
-        run: |
-          echo "## Testnet Deployment Summary" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "| Contract | Address | Explorer |" >> $GITHUB_STEP_SUMMARY
-          echo "|----------|---------|----------|" >> $GITHUB_STEP_SUMMARY
-          while read -r line; do
-            CONTRACT=$(echo "$line" | cut -d: -f1)
-            ADDRESS=$(echo "$line" | cut -d: -f2 | tr -d ' ')
-            echo "| $CONTRACT | \`$ADDRESS\` | [View](${BLOCKSCOUT_URL}/address/$ADDRESS) |" >> $GITHUB_STEP_SUMMARY
-          done < deployment-summary.txt
+          SUMMARY_TITLE: Testnet Deployment Summary
+        run: bash .etherform/scripts/deploy/deployment-summary.sh
 
       - name: Verify contracts on Blockscout
         if: inputs.verify-contracts
         env:
           BLOCKSCOUT_URL: ${{ steps.network.outputs.blockscout_url }}
           ETH_RPC_URL: ${{ secrets.RPC_URL }}
-        run: |
-          # Validate Blockscout URL format (fail fast on bad URL)
-          if [[ -z "$BLOCKSCOUT_URL" || "$BLOCKSCOUT_URL" == "null" ]]; then
-            echo "::error::BLOCKSCOUT_URL is empty or not configured. Check deploy-networks.json."
-            exit 1
-          fi
-          if [[ ! "$BLOCKSCOUT_URL" =~ ^https?:// ]]; then
-            echo "::error::BLOCKSCOUT_URL has invalid format (got: '$BLOCKSCOUT_URL'). Must start with http:// or https://."
-            exit 1
-          fi
-
-          BROADCAST_FILE="${{ steps.parse.outputs.broadcast_file }}"
-
-          # Collect all CREATE contracts
-          CONTRACTS=()
-          while read -r tx; do
-            name=$(echo "$tx" | jq -r '.contractName')
-            addr=$(echo "$tx" | jq -r '.contractAddress')
-            CONTRACTS+=("${name}:${addr}")
-          done < <(jq -c '.transactions[] | select(.transactionType == "CREATE")' "$BROADCAST_FILE")
-
-          echo "Found ${#CONTRACTS[@]} contracts to verify"
-
-          # Phase 1: Submit all contracts for verification (no --watch)
-          for entry in "${CONTRACTS[@]}"; do
-            CONTRACT_NAME="${entry%%:*}"
-            CONTRACT_ADDR="${entry#*:}"
-            echo "Submitting $CONTRACT_NAME ($CONTRACT_ADDR) for verification..."
-            SUBMIT_OUTPUT=$(forge verify-contract "$CONTRACT_ADDR" "$CONTRACT_NAME" \
-              --verifier blockscout \
-              --verifier-url "${BLOCKSCOUT_URL}/api" \
-              --guess-constructor-args 2>&1) || true
-            echo "$SUBMIT_OUTPUT"
-            if echo "$SUBMIT_OUTPUT" | grep -qi "already verified"; then
-              echo "  → already verified"
-            fi
-          done
-
-          # Phase 2: Wait for Blockscout to process the verification queue
-          echo "Waiting 60s for Blockscout to process submissions..."
-          sleep 60
-
-          # Phase 3: Check verification status via API, retry unverified contracts
-          VERIFY_FAILED=0
-          MAX_CHECKS=10
-          CHECK_DELAY=30
-
-          for entry in "${CONTRACTS[@]}"; do
-            CONTRACT_NAME="${entry%%:*}"
-            CONTRACT_ADDR="${entry#*:}"
-
-            VERIFIED=0
-            for check in $(seq 1 $MAX_CHECKS); do
-              # Query Blockscout API for verification status
-              API_RESULT=$(curl -sf "${BLOCKSCOUT_URL}/api?module=contract&action=getabi&address=${CONTRACT_ADDR}" 2>/dev/null) || true
-              API_STATUS=$(echo "$API_RESULT" | jq -r '.status // "0"' 2>/dev/null) || API_STATUS="0"
-
-              if [[ "$API_STATUS" == "1" ]]; then
-                echo "✓ $CONTRACT_NAME ($CONTRACT_ADDR) verified"
-                VERIFIED=1
-                break
-              fi
-
-              if [[ $check -lt $MAX_CHECKS ]]; then
-                echo "  $CONTRACT_NAME not yet verified (check $check/$MAX_CHECKS), resubmitting and waiting ${CHECK_DELAY}s..."
-                # Resubmit to ensure it's in the queue
-                forge verify-contract "$CONTRACT_ADDR" "$CONTRACT_NAME" \
-                  --verifier blockscout \
-                  --verifier-url "${BLOCKSCOUT_URL}/api" \
-                  --guess-constructor-args 2>&1 || true
-                sleep $CHECK_DELAY
-              fi
-            done
-
-            if [[ $VERIFIED -eq 0 ]]; then
-              echo "::error::Verification failed for $CONTRACT_NAME ($CONTRACT_ADDR) after $MAX_CHECKS checks"
-              VERIFY_FAILED=1
-            fi
-          done
-
-          if [[ $VERIFY_FAILED -eq 1 ]]; then
-            echo "::error::One or more contracts failed verification"
-            exit 1
-          fi
-
-          echo "All contracts verified successfully"
-
+          BROADCAST_FILE: ${{ steps.parse.outputs.broadcast_file }}
+        run: bash .etherform/scripts/deploy/verify-blockscout.sh
diff --git a/.github/workflows/_upgrade-safety.yml b/.github/workflows/_upgrade-safety.yml
index b6c851b..4fc21dc 100644
--- a/.github/workflows/_upgrade-safety.yml
+++ b/.github/workflows/_upgrade-safety.yml
@@ -1,5 +1,5 @@
 # Reusable upgrade safety validation workflow using OpenZeppelin upgrades-core CLI
-# Usage: jobs.<job>.uses: ./.github/workflows/_upgrade-safety.yml
+# Usage: jobs.<job>.uses: BreadchainCoop/etherform/.github/workflows/_upgrade-safety.yml@main
 #
 # Validates contracts listed in upgrades.json for upgrade safety.
 # Contracts without an explicit reference are compared against the base branch.
@@ -29,6 +29,10 @@ on:
         description: 'Node.js version for package installation'
         type: string
         default: '20'
+      etherform-ref:
+        description: 'Git ref for etherform scripts checkout (default: main)'
+        type: string
+        default: 'main'
 jobs:
   upgrade-safety:
     name: Validate Upgrade Safety
@@ -40,16 +44,18 @@ jobs:
           submodules: recursive
           fetch-depth: 0
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - name: Checkout etherform scripts
+        uses: actions/checkout@v4
         with:
-          node-version: ${{ inputs.node-version }}
+          repository: BreadchainCoop/etherform
+          ref: ${{ inputs.etherform-ref }}
+          path: .etherform
+          sparse-checkout: scripts
 
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
 
       - name: Setup Node.js
-        if: inputs.package-manager != 'none'
         uses: actions/setup-node@v4
         with:
           node-version: ${{ inputs.node-version }}
@@ -65,178 +71,17 @@ jobs:
           esac
 
       - name: Build contracts
-        run: forge build
-
-      - name: Validate upgrade safety
-        run: |
-          set -euo pipefail
-
-          CONFIG="${{ inputs.upgrades-config }}"
-          BASE_BRANCH="${{ inputs.base-branch }}"
-          CURRENT_BUILD="out/build-info"
-
-          # Check if config exists
-          if [[ ! -f "$CONFIG" ]]; then
-            echo "::warning::No upgrades config found at $CONFIG — skipping upgrade safety validation"
-            {
-              echo "## Upgrade Safety Validation"
-              echo ""
-              echo "> No \`$CONFIG\` found. Skipping validation."
-            } >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-
-          # Check that contracts field exists
-          if ! jq -e 'has("contracts")' "$CONFIG" > /dev/null 2>&1; then
-            echo "::error::Missing 'contracts' field in $CONFIG — expected an array of contract entries"
-            {
-              echo "## Upgrade Safety Validation"
-              echo ""
-              echo "> **Error:** \`$CONFIG\` is missing the \`contracts\` field."
-            } >> "$GITHUB_STEP_SUMMARY"
-            exit 1
-          fi
-
-          # Check for empty contracts array
-          CONTRACT_COUNT=$(jq '.contracts | length' "$CONFIG")
-          if [[ "$CONTRACT_COUNT" -eq 0 ]]; then
-            echo "::warning::No contracts defined in $CONFIG — skipping upgrade safety validation"
-            {
-              echo "## Upgrade Safety Validation"
-              echo ""
-              echo "> No contracts defined in \`$CONFIG\`. Skipping validation."
-            } >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-
-          # Check if any contracts need base branch comparison (no explicit reference)
-          NEEDS_BASE=false
-          while IFS= read -r entry; do
-            REF_VALUE=$(echo "$entry" | jq -c '.reference // empty')
-            if [[ -z "$REF_VALUE" || "$REF_VALUE" == "null" ]]; then
-              NEEDS_BASE=true
-              break
-            fi
-          done < <(jq -c '.contracts[]' "$CONFIG")
+        run: forge build --build-info --extra-output storageLayout
 
-          # Build base branch in a worktree if needed
-          BASE_BUILD=""
-          BASE_DIR=""
-          if [[ "$NEEDS_BASE" == "true" ]]; then
-            echo "Building base branch ($BASE_BRANCH) for comparison..."
-            git fetch origin "$BASE_BRANCH" 2>/dev/null || true
-            BASE_DIR=$(mktemp -d)
+      - name: Validate upgrades config
+        env:
+          UPGRADES_CONFIG: ${{ inputs.upgrades-config }}
+          BASE_BRANCH: ${{ inputs.base-branch }}
+        run: bash .etherform/scripts/upgrade-safety/validate-config.sh
 
-            if git worktree add --detach "$BASE_DIR" "origin/$BASE_BRANCH" 2>/dev/null; then
-              (cd "$BASE_DIR" && git submodule update --init --recursive 2>/dev/null || true)
-
-              # Install dependencies in base worktree if needed
-              if [[ "${{ inputs.package-manager }}" != "none" ]]; then
-                (cd "$BASE_DIR" && case "${{ inputs.package-manager }}" in
-                  npm)  npm ci ;;
-                  yarn) yarn --frozen-lockfile ;;
-                  pnpm) corepack enable && pnpm install --frozen-lockfile ;;
-                esac) || echo "::warning::Failed to install dependencies in base branch"
-              fi
-
-              if (cd "$BASE_DIR" && forge build 2>&1); then
-                mv "${BASE_DIR}/out/build-info" "${BASE_DIR}/out/base-build-info"
-                BASE_BUILD="${BASE_DIR}/out/base-build-info"
-                echo "Base branch built successfully"
-              else
-                echo "::warning::Failed to build base branch — contracts without explicit reference will be validated for upgradeability only"
-              fi
-            else
-              echo "::warning::Could not checkout base branch '$BASE_BRANCH' — contracts without explicit reference will be validated for upgradeability only"
-            fi
-          fi
-
-          PASSED=0
-          FAILED=0
-          SUMMARY=""
-
-          # Validate each contract
-          while IFS= read -r entry; do
-            CONTRACT=$(echo "$entry" | jq -r '.contract')
-            REF_VALUE=$(echo "$entry" | jq -c '.reference // empty')
-            CONTRACT_PATH="${CONTRACT%%:*}"
-
-            echo "::group::Validating $CONTRACT"
-
-            if [[ -z "$REF_VALUE" || "$REF_VALUE" == "null" ]]; then
-              # === Base branch comparison (default) ===
-              if [[ -n "$BASE_BUILD" ]] && git show "origin/${BASE_BRANCH}:${CONTRACT_PATH}" > /dev/null 2>&1; then
-                # Contract exists on base branch — compare storage layouts
-                if OUTPUT=$(npx @openzeppelin/upgrades-core validate "$CURRENT_BUILD" \
-                    --contract "$CONTRACT" \
-                    --reference "base-build-info:${CONTRACT}" \
-                    --referenceBuildInfoDirs "$BASE_BUILD" 2>&1); then
-                  echo "$OUTPUT"
-                  SUMMARY="${SUMMARY}| \`${CONTRACT}\` | \`${BASE_BRANCH}\` branch | Pass |"$'\n'
-                  PASSED=$((PASSED + 1))
-                else
-                  echo "$OUTPUT"
-                  SUMMARY="${SUMMARY}| \`${CONTRACT}\` | \`${BASE_BRANCH}\` branch | **FAIL** |"$'\n'
-                  FAILED=$((FAILED + 1))
-                fi
-              else
-                # Contract doesn't exist on base branch or base build failed — validate upgradeability only
-                echo "Contract not found on $BASE_BRANCH or base build unavailable, validating upgradeability only..."
-                if OUTPUT=$(npx @openzeppelin/upgrades-core validate "$CURRENT_BUILD" \
-                    --contract "$CONTRACT" 2>&1); then
-                  echo "$OUTPUT"
-                  SUMMARY="${SUMMARY}| \`${CONTRACT}\` | (new contract) | Pass |"$'\n'
-                  PASSED=$((PASSED + 1))
-                else
-                  echo "$OUTPUT"
-                  SUMMARY="${SUMMARY}| \`${CONTRACT}\` | (new contract) | **FAIL** |"$'\n'
-                  FAILED=$((FAILED + 1))
-                fi
-              fi
-
-            elif echo "$REF_VALUE" | jq -e 'type == "string"' > /dev/null 2>&1; then
-              # === Contract qualifier reference ===
-              QUALIFIER=$(echo "$entry" | jq -r '.reference')
-              if OUTPUT=$(npx @openzeppelin/upgrades-core validate "$CURRENT_BUILD" \
-                  --contract "$CONTRACT" \
-                  --reference "$QUALIFIER" 2>&1); then
-                echo "$OUTPUT"
-                SUMMARY="${SUMMARY}| \`${CONTRACT}\` | \`${QUALIFIER}\` | Pass |"$'\n'
-                PASSED=$((PASSED + 1))
-              else
-                echo "$OUTPUT"
-                SUMMARY="${SUMMARY}| \`${CONTRACT}\` | \`${QUALIFIER}\` | **FAIL** |"$'\n'
-                FAILED=$((FAILED + 1))
-              fi
-
-            else
-              echo "::error::Invalid reference format for $CONTRACT"
-              SUMMARY="${SUMMARY}| \`${CONTRACT}\` | (invalid reference) | **FAIL** |"$'\n'
-              FAILED=$((FAILED + 1))
-            fi
-
-            echo "::endgroup::"
-          done < <(jq -c '.contracts[]' "$CONFIG")
-
-          # Clean up worktree
-          if [[ -n "$BASE_DIR" ]]; then
-            git worktree remove "$BASE_DIR" --force 2>/dev/null || true
-          fi
-
-          # Write Step Summary
-          {
-            echo "## Upgrade Safety Validation"
-            echo ""
-            echo "| Contract | Reference | Result |"
-            echo "|----------|-----------|--------|"
-            echo -n "$SUMMARY"
-            echo ""
-            echo "**${PASSED} passed, ${FAILED} failed**"
-          } >> "$GITHUB_STEP_SUMMARY"
-
-          if [[ "$FAILED" -gt 0 ]]; then
-            echo "::error::${FAILED} contract(s) failed upgrade safety validation"
-            exit 1
-          fi
-
-          echo "All contracts passed upgrade safety validation"
+      - name: Validate upgrade safety
+        env:
+          UPGRADES_CONFIG: ${{ inputs.upgrades-config }}
+          BASE_BRANCH: ${{ inputs.base-branch }}
+          PACKAGE_MANAGER: ${{ inputs.package-manager }}
+        run: bash .etherform/scripts/upgrade-safety/validate.sh
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..a22c56e
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,42 @@
+name: Test Scripts
+
+on:
+  push:
+    branches: [main]
+    paths: ['scripts/**', 'tests/**', '.github/workflows/test.yml']
+  pull_request:
+    paths: ['scripts/**', 'tests/**', '.github/workflows/test.yml']
+
+jobs:
+  shellcheck:
+    name: ShellCheck Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run ShellCheck on all scripts
+        run: find scripts/ -name '*.sh' -exec shellcheck -s bash {} +
+
+  unit-tests:
+    name: Unit Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Test prepare-env
+        run: bash tests/test-prepare-env.sh
+
+      - name: Test parse-broadcast
+        run: bash tests/test-parse-broadcast.sh
+
+      - name: Test resolve-network
+        run: bash tests/test-resolve-network.sh
+
+      - name: Test deployment-summary
+        run: bash tests/test-deployment-summary.sh
+
+      - name: Test extract-summary
+        run: bash tests/test-extract-summary.sh
+
+      - name: Test check-threshold
+        run: bash tests/test-check-threshold.sh
diff --git a/README.md b/README.md
index 8763132..ec5a00d 100644
--- a/README.md
+++ b/README.md
@@ -188,6 +188,7 @@ If your Foundry project uses npm/yarn/pnpm for Solidity dependencies (e.g., Open
 | `coverage-post-comment` | boolean | `true` | Post coverage summary as a sticky PR comment |
 | `coverage-min-threshold` | number | `0` | Minimum coverage % to pass (0 = disabled) |
 | `run-halmos` | boolean | `false` | Run Halmos symbolic execution |
+| `etherform-ref` | string | `'main'` | Git ref for etherform scripts checkout |
 
 | Secret | Required | Description |
 |--------|----------|-------------|
@@ -203,6 +204,7 @@ If your Foundry project uses npm/yarn/pnpm for Solidity dependencies (e.g., Open
 | `node-version` | string | `'20'` | Node.js version for package installation |
 | `upgrades-config` | string | `'.github/upgrades.json'` | Path to upgrade safety config |
 | `base-branch` | string | `'main'` | Base branch for upgrade safety comparison |
+| `etherform-ref` | string | `'main'` | Git ref for etherform scripts checkout |
 
 ### `_deploy-testnet.yml`
 
@@ -215,6 +217,7 @@ If your Foundry project uses npm/yarn/pnpm for Solidity dependencies (e.g., Open
 | `verify-contracts` | boolean | `true` | Verify on Blockscout |
 | `package-manager` | string | `'none'` | Package manager (`none`, `npm`, `yarn`, `pnpm`) |
 | `node-version` | string | `'20'` | Node.js version for package installation |
+| `etherform-ref` | string | `'main'` | Git ref for etherform scripts checkout |
 
 ### `_foundry-cicd.yml`
 
@@ -226,3 +229,17 @@ The all-in-one workflow accepts all inputs from the above workflows plus:
 | `contract-paths` | string | `src/**`, `script/**`, etc. | Paths to watch for changes |
 | `main-branch` | string | `'main'` | Base branch for upgrade safety comparison |
 | `deploy-on-pr` | boolean | `false` | Deploy to testnet on PR |
+
+All workflows also accept `etherform-ref` (default: `'main'`) to control which etherform branch the scripts are checked out from. Override this when testing against an unreleased etherform branch.
+
+## Scripts
+
+Shared logic is extracted into modular bash scripts under `scripts/`. Workflows check out these scripts at runtime via `actions/checkout`. The scripts are independently testable.
+
+| Directory | Scripts | Purpose |
+|-----------|---------|---------|
+| `scripts/deploy/` | `prepare-env.sh`, `parse-broadcast.sh`, `resolve-network.sh`, `deployment-summary.sh`, `verify-blockscout.sh` | Deployment helpers |
+| `scripts/coverage/` | `extract-summary.sh`, `check-threshold.sh` | Coverage reporting |
+| `scripts/upgrade-safety/` | `validate.sh` | Upgrade safety validation |
+
+Run tests locally: `bash tests/test-*.sh`
diff --git a/scripts/coverage/check-threshold.sh b/scripts/coverage/check-threshold.sh
new file mode 100755
index 0000000..e707643
--- /dev/null
+++ b/scripts/coverage/check-threshold.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Check coverage percentages against a minimum threshold.
+# Exits with code 1 if any metric falls below the threshold.
+#
+# Env inputs:
+#   THRESHOLD  — required, minimum coverage percentage
+#   LINES_PCT  — required
+#   STMTS_PCT  — required
+#   BRANCH_PCT — required
+#   FUNCS_PCT  — required
+
+: "${THRESHOLD:?THRESHOLD is required}"
+: "${LINES_PCT:?LINES_PCT is required}"
+: "${STMTS_PCT:?STMTS_PCT is required}"
+: "${BRANCH_PCT:?BRANCH_PCT is required}"
+: "${FUNCS_PCT:?FUNCS_PCT is required}"
+
+FAILED=0
+for metric in "Lines:$LINES_PCT" \
+              "Statements:$STMTS_PCT" \
+              "Branches:$BRANCH_PCT" \
+              "Functions:$FUNCS_PCT"; do
+  NAME="${metric%%:*}"
+  VALUE="${metric#*:}"
+  if (( $(echo "$VALUE < $THRESHOLD" | bc -l) )); then
+    echo "::error::$NAME coverage ($VALUE%) is below threshold ($THRESHOLD%)"
+    FAILED=1
+  fi
+done
+
+if [[ $FAILED -eq 1 ]]; then
+  exit 1
+fi
+
+echo "All coverage metrics meet the $THRESHOLD% threshold"
diff --git a/scripts/coverage/extract-summary.sh b/scripts/coverage/extract-summary.sh
new file mode 100755
index 0000000..306a3ae
--- /dev/null
+++ b/scripts/coverage/extract-summary.sh
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Parse forge coverage output into summary percentages and a markdown comment.
+#
+# Env inputs:
+#   COVERAGE_SOURCE_FILTER — optional, grep filter for source files (default: ' src/')
+#
+# File inputs:
+#   coverage-raw.txt must exist in the working directory
+#
+# Outputs (via $GITHUB_OUTPUT):
+#   lines_pct, stmts_pct, branch_pct, funcs_pct
+#
+# Side effects:
+#   Creates coverage-comment.md in the working directory
+
+COVERAGE_SOURCE_FILTER="${COVERAGE_SOURCE_FILTER:- src/}"
+
+# Extract the final summary table (box-drawing characters)
+awk '/^╭/,/^╰/' coverage-raw.txt > coverage-table.txt
+
+# Filter to only source files and compute totals from raw counts
+grep '^|' coverage-table.txt | grep "$COVERAGE_SOURCE_FILTER" > src-rows.txt || true
+
+# Sum up hit/total for each metric across source files
+total_lines_hit=0; total_lines_all=0
+total_stmts_hit=0; total_stmts_all=0
+total_branch_hit=0; total_branch_all=0
+total_funcs_hit=0; total_funcs_all=0
+
+while IFS='|' read -r _ file lines stmts branches funcs _; do
+  extract() { echo "$1" | grep -oP '\(\K[0-9]+/[0-9]+' | tr '/' ' '; }
+  read -r lh lt <<< "$(extract "$lines")"
+  read -r sh st <<< "$(extract "$stmts")"
+  read -r bh bt <<< "$(extract "$branches")"
+  read -r fh ft <<< "$(extract "$funcs")"
+  total_lines_hit=$((total_lines_hit + lh)); total_lines_all=$((total_lines_all + lt))
+  total_stmts_hit=$((total_stmts_hit + sh)); total_stmts_all=$((total_stmts_all + st))
+  total_branch_hit=$((total_branch_hit + bh)); total_branch_all=$((total_branch_all + bt))
+  total_funcs_hit=$((total_funcs_hit + fh)); total_funcs_all=$((total_funcs_all + ft))
+done < src-rows.txt
+
+pct() { [ "$2" -eq 0 ] && echo "100.00% (0/0)" || printf "%.2f%% (%d/%d)" "$(echo "scale=4; $1 * 100 / $2" | bc)" "$1" "$2"; }
+
+# Compute numeric percentages for threshold checking
+num_pct() { if [ "$2" -eq 0 ]; then echo "100.00"; else echo "scale=2; $1 * 100 / $2" | bc; fi; }
+{
+  echo "lines_pct=$(num_pct $total_lines_hit $total_lines_all)"
+  echo "stmts_pct=$(num_pct $total_stmts_hit $total_stmts_all)"
+  echo "branch_pct=$(num_pct $total_branch_hit $total_branch_all)"
+  echo "funcs_pct=$(num_pct $total_funcs_hit $total_funcs_all)"
+} >> "$GITHUB_OUTPUT"
+
+# Build the markdown comment
+{
+  echo "## Coverage Report"
+  echo ""
+  echo "| Metric | Coverage |"
+  echo "|--------|----------|"
+  echo "| Lines | $(pct $total_lines_hit $total_lines_all) |"
+  echo "| Statements | $(pct $total_stmts_hit $total_stmts_all) |"
+  echo "| Branches | $(pct $total_branch_hit $total_branch_all) |"
+  echo "| Functions | $(pct $total_funcs_hit $total_funcs_all) |"
+  echo ""
+  echo "<details><summary>Coverage by file</summary>"
+  echo ""
+  echo "| File | Lines | Statements | Branches | Functions |"
+  echo "|------|-------|------------|----------|-----------|"
+  while IFS='|' read -r _ file lines stmts branches funcs _; do
+    file=$(echo "$file" | xargs)
+    lines=$(echo "$lines" | xargs)
+    stmts=$(echo "$stmts" | xargs)
+    branches=$(echo "$branches" | xargs)
+    funcs=$(echo "$funcs" | xargs)
+    echo "| \`$file\` | $lines | $stmts | $branches | $funcs |"
+  done < src-rows.txt
+  echo ""
+  echo "</details>"
+} > coverage-comment.md
diff --git a/scripts/deploy/deployment-summary.sh b/scripts/deploy/deployment-summary.sh
new file mode 100755
index 0000000..24c8d81
--- /dev/null
+++ b/scripts/deploy/deployment-summary.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Write a deployment summary table to $GITHUB_STEP_SUMMARY.
+#
+# Env inputs:
+#   BLOCKSCOUT_URL  — required
+#   SUMMARY_TITLE   — optional, defaults to "Deployment Summary"
+#
+# File inputs:
+#   deployment-summary.txt must exist in the working directory
+
+: "${BLOCKSCOUT_URL:?BLOCKSCOUT_URL is required}"
+TITLE="${SUMMARY_TITLE:-Deployment Summary}"
+
+{
+  echo "## $TITLE"
+  echo ""
+  echo "| Contract | Address | Explorer |"
+  echo "|----------|---------|----------|"
+
+  while read -r line; do
+    CONTRACT=$(echo "$line" | cut -d: -f1)
+    ADDRESS=$(echo "$line" | cut -d: -f2 | tr -d ' ')
+    echo "| $CONTRACT | \`$ADDRESS\` | [View](${BLOCKSCOUT_URL}/address/$ADDRESS) |"
+  done < deployment-summary.txt
+} >> "$GITHUB_STEP_SUMMARY"
diff --git a/scripts/deploy/parse-broadcast.sh b/scripts/deploy/parse-broadcast.sh
new file mode 100755
index 0000000..c9ec4d4
--- /dev/null
+++ b/scripts/deploy/parse-broadcast.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Parse Foundry broadcast artifacts after deployment.
+# Finds run-latest.json, extracts chain ID, writes deployment-summary.txt.
+#
+# Outputs (via $GITHUB_OUTPUT):
+#   broadcast_file  — path to the broadcast JSON
+#   chain_id        — chain ID extracted from directory structure
+
+BROADCAST_FILE=$(find broadcast -name "run-latest.json" -type f | head -1)
+if [[ -z "$BROADCAST_FILE" ]]; then
+  echo "No broadcast file found"
+  exit 1
+fi
+echo "broadcast_file=$BROADCAST_FILE" >> "$GITHUB_OUTPUT"
+
+# Extract chain ID from path: broadcast/<script>/<chain_id>/run-latest.json
+CHAIN_ID=$(echo "$BROADCAST_FILE" | sed -E 's|.*/([0-9]+)/run-latest\.json$|\1|')
+echo "chain_id=$CHAIN_ID" >> "$GITHUB_OUTPUT"
+echo "Deployed to chain ID: $CHAIN_ID"
+
+jq -r '.transactions[] | select(.transactionType == "CREATE") | "\(.contractName): \(.contractAddress)"' "$BROADCAST_FILE" | tee deployment-summary.txt
diff --git a/scripts/deploy/prepare-env.sh b/scripts/deploy/prepare-env.sh
new file mode 100755
index 0000000..c44dbce
--- /dev/null
+++ b/scripts/deploy/prepare-env.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Prepare deployment environment variables.
+# Must be SOURCED (not executed) — modifies the caller's environment.
+#
+# Env inputs:
+#   PRIVATE_KEY      — optional, adds 0x prefix if missing
+#   DEPLOY_ENV_VARS  — optional, newline-separated KEY=VALUE pairs (# comments and blanks skipped)
+
+if [[ -n "${PRIVATE_KEY:-}" && "$PRIVATE_KEY" != 0x* ]]; then
+  export PRIVATE_KEY="0x$PRIVATE_KEY"
+fi
+
+if [[ -n "${DEPLOY_ENV_VARS:-}" ]]; then
+  while IFS= read -r line; do
+    [[ -z "$line" || "$line" == \#* ]] && continue
+
+    # Expect KEY=VALUE; fail on malformed lines
+    if [[ "$line" != *=* ]]; then
+      echo "::error::Malformed DEPLOY_ENV_VARS line (no '='): $line"
+      return 1
+    fi
+
+    key=${line%%=*}
+    value=${line#*=}
+
+    # Validate KEY against a safe variable-name pattern
+    if [[ ! "$key" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
+      echo "::error::Invalid variable name in DEPLOY_ENV_VARS: $key"
+      return 1
+    fi
+
+    export "$key=$value"
+  done <<< "$DEPLOY_ENV_VARS"
+fi
diff --git a/scripts/deploy/resolve-network.sh b/scripts/deploy/resolve-network.sh
new file mode 100755
index 0000000..9b6586b
--- /dev/null
+++ b/scripts/deploy/resolve-network.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Resolve Blockscout URL and network name from chain ID.
+# Validates that the Blockscout API is reachable.
+#
+# Env inputs:
+#   CHAIN_ID        — required
+#   NETWORK_CONFIG  — required, path to deploy-networks.json
+#
+# Outputs (via $GITHUB_OUTPUT):
+#   blockscout_url
+#   network_name
+
+: "${CHAIN_ID:?CHAIN_ID is required}"
+: "${NETWORK_CONFIG:?NETWORK_CONFIG is required}"
+
+# Search testnets array for a matching chain_id
+BLOCKSCOUT_URL=$(jq -r --argjson cid "$CHAIN_ID" '
+  (.testnets // [])
+  | map(select(.chain_id == $cid))
+  | first
+  | .blockscout_url // empty
+' "$NETWORK_CONFIG" 2>/dev/null) || true
+
+if [[ -z "$BLOCKSCOUT_URL" || "$BLOCKSCOUT_URL" == "null" ]]; then
+  echo "::warning::No Blockscout URL found for chain ID $CHAIN_ID in $NETWORK_CONFIG. Falling back to testnets[0]."
+  BLOCKSCOUT_URL=$(jq -r '.testnets[0].blockscout_url' "$NETWORK_CONFIG")
+fi
+
+# Post-fallback validation: ensure we have a non-empty, HTTP(S) Blockscout URL
+if [[ -z "$BLOCKSCOUT_URL" || "$BLOCKSCOUT_URL" == "null" || ! "$BLOCKSCOUT_URL" =~ ^https?:// ]]; then
+  echo "::error::No valid blockscout_url found in $NETWORK_CONFIG"
+  exit 1
+fi
+
+NETWORK_NAME=$(jq -r --argjson cid "$CHAIN_ID" '
+  (.testnets // [])
+  | map(select(.chain_id == $cid))
+  | first
+  | .name // "unknown"
+' "$NETWORK_CONFIG" 2>/dev/null) || NETWORK_NAME="unknown"
+
+# Validate Blockscout API
+BLOCKSCOUT_API="${BLOCKSCOUT_URL%/}/api/"
+echo "Checking Blockscout API at: $BLOCKSCOUT_API"
+
+RESPONSE=$(curl -sS --max-time 10 \
+  "${BLOCKSCOUT_API}?module=block&action=eth_block_number" || true)
+
+STATUS=$(echo "$RESPONSE" | jq -r '.jsonrpc // empty' 2>/dev/null || true)
+
+if [[ "$STATUS" != "2.0" ]]; then
+  echo "::error::Invalid Blockscout API URL: $BLOCKSCOUT_API"
+  echo "Response was:"
+  echo "$RESPONSE"
+  exit 1
+fi
+
+echo "Blockscout API looks valid"
+
+echo "blockscout_url=$BLOCKSCOUT_URL" >> "$GITHUB_OUTPUT"
+echo "network_name=$NETWORK_NAME" >> "$GITHUB_OUTPUT"
+echo "Resolved Blockscout URL for chain $CHAIN_ID: $BLOCKSCOUT_URL ($NETWORK_NAME)"
diff --git a/scripts/deploy/verify-blockscout.sh b/scripts/deploy/verify-blockscout.sh
new file mode 100755
index 0000000..7b92292
--- /dev/null
+++ b/scripts/deploy/verify-blockscout.sh
@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Verify deployed contracts on Blockscout using a 2-phase approach:
+# Phase 1: Submit all contracts for verification
+# Phase 2: Poll Blockscout API for verification status with retries
+#
+# Env inputs:
+#   BLOCKSCOUT_URL  — required
+#   BROADCAST_FILE  — required, path to run-latest.json
+#   MAX_CHECKS      — optional, default 10
+#   CHECK_DELAY     — optional, default 30 (seconds between checks)
+#   INITIAL_WAIT    — optional, default 60 (seconds to wait after submission)
+
+: "${BLOCKSCOUT_URL:?BLOCKSCOUT_URL is required}"
+: "${BROADCAST_FILE:?BROADCAST_FILE is required}"
+MAX_CHECKS="${MAX_CHECKS:-10}"
+CHECK_DELAY="${CHECK_DELAY:-30}"
+INITIAL_WAIT="${INITIAL_WAIT:-60}"
+
+# Validate Blockscout URL format
+if [[ -z "$BLOCKSCOUT_URL" || "$BLOCKSCOUT_URL" == "null" ]]; then
+  echo "::error::BLOCKSCOUT_URL is empty or not configured. Check deploy-networks.json."
+  exit 1
+fi
+if [[ ! "$BLOCKSCOUT_URL" =~ ^https?:// ]]; then
+  echo "::error::BLOCKSCOUT_URL has invalid format (got: '$BLOCKSCOUT_URL'). Must start with http:// or https://."
+  exit 1
+fi
+
+# Normalize URL once (strip trailing slash) to avoid double-slash in API calls
+BLOCKSCOUT_URL="${BLOCKSCOUT_URL%/}"
+
+# Collect all CREATE contracts
+CONTRACTS=()
+while read -r tx; do
+  name=$(echo "$tx" | jq -r '.contractName')
+  addr=$(echo "$tx" | jq -r '.contractAddress')
+  CONTRACTS+=("${name}:${addr}")
+done < <(jq -c '.transactions[] | select(.transactionType == "CREATE")' "$BROADCAST_FILE")
+
+echo "Found ${#CONTRACTS[@]} contracts to verify"
+
+# Phase 1: Submit all contracts for verification (no --watch)
+for entry in "${CONTRACTS[@]}"; do
+  CONTRACT_NAME="${entry%%:*}"
+  CONTRACT_ADDR="${entry#*:}"
+  echo "Submitting $CONTRACT_NAME ($CONTRACT_ADDR) for verification..."
+  SUBMIT_OUTPUT=$(forge verify-contract "$CONTRACT_ADDR" "$CONTRACT_NAME" \
+    --verifier blockscout \
+    --verifier-url "${BLOCKSCOUT_URL}/api" \
+    --guess-constructor-args 2>&1) || true
+  echo "$SUBMIT_OUTPUT"
+  if echo "$SUBMIT_OUTPUT" | grep -qi "already verified"; then
+    echo "  -> already verified"
+  fi
+done
+
+# Phase 2: Wait for Blockscout to process the verification queue
+echo "Waiting ${INITIAL_WAIT}s for Blockscout to process submissions..."
+sleep "$INITIAL_WAIT"
+
+# Phase 3: Check verification status via API, retry unverified contracts
+VERIFY_FAILED=0
+
+for entry in "${CONTRACTS[@]}"; do
+  CONTRACT_NAME="${entry%%:*}"
+  CONTRACT_ADDR="${entry#*:}"
+
+  VERIFIED=0
+  for check in $(seq 1 "$MAX_CHECKS"); do
+    # Query Blockscout API for verification status
+    API_RESULT=$(curl -sf --connect-timeout 10 --max-time 30 "${BLOCKSCOUT_URL}/api?module=contract&action=getabi&address=${CONTRACT_ADDR}" 2>/dev/null) || true
+    API_STATUS=$(echo "$API_RESULT" | jq -r '.status // "0"' 2>/dev/null) || API_STATUS="0"
+
+    if [[ "$API_STATUS" == "1" ]]; then
+      echo "Verified: $CONTRACT_NAME ($CONTRACT_ADDR)"
+      VERIFIED=1
+      break
+    fi
+
+    if [[ $check -lt $MAX_CHECKS ]]; then
+      echo "  $CONTRACT_NAME not yet verified (check $check/$MAX_CHECKS), resubmitting and waiting ${CHECK_DELAY}s..."
+      # Resubmit to ensure it's in the queue
+      forge verify-contract "$CONTRACT_ADDR" "$CONTRACT_NAME" \
+        --verifier blockscout \
+        --verifier-url "${BLOCKSCOUT_URL}/api" \
+        --guess-constructor-args 2>&1 || true
+      sleep "$CHECK_DELAY"
+    fi
+  done
+
+  if [[ $VERIFIED -eq 0 ]]; then
+    echo "::error::Verification failed for $CONTRACT_NAME ($CONTRACT_ADDR) after $MAX_CHECKS checks"
+    VERIFY_FAILED=1
+  fi
+done
+
+if [[ $VERIFY_FAILED -eq 1 ]]; then
+  echo "::error::One or more contracts failed verification"
+  exit 1
+fi
+
+echo "All contracts verified successfully"
diff --git a/scripts/upgrade-safety/validate-config.sh b/scripts/upgrade-safety/validate-config.sh
new file mode 100755
index 0000000..32589ea
--- /dev/null
+++ b/scripts/upgrade-safety/validate-config.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Validate that no contracts were removed from the upgrades config compared to the base branch.
+# Compares by .contract field only. Prevents bypassing upgrade safety by removing entries.
+#
+# Env inputs:
+#   UPGRADES_CONFIG   — required, path to upgrades.json
+#   BASE_BRANCH       — required, branch name to compare against
+
+: "${UPGRADES_CONFIG:?UPGRADES_CONFIG is required}"
+: "${BASE_BRANCH:?BASE_BRANCH is required}"
+
+if [[ ! -f "$UPGRADES_CONFIG" ]]; then
+  echo "::error::No upgrades config found at $UPGRADES_CONFIG"
+  exit 1
+fi
+
+# Fetch the base branch
+if ! git fetch origin "$BASE_BRANCH" 2>/dev/null; then
+  echo "::error::Failed to fetch base branch $BASE_BRANCH — cannot validate config changes"
+  exit 1
+fi
+
+# Read base branch config
+if ! git show "origin/${BASE_BRANCH}:${UPGRADES_CONFIG}" > /dev/null 2>&1; then
+  echo "No $UPGRADES_CONFIG on base branch — nothing to compare against"
+  exit 0
+fi
+
+BASE_CONFIG=$(git show "origin/${BASE_BRANCH}:${UPGRADES_CONFIG}") || {
+  echo "::error::Failed to read $UPGRADES_CONFIG from base branch $BASE_BRANCH"
+  exit 1
+}
+
+CURRENT_CONTRACTS=$(jq -r '[.contracts[].contract]' "$UPGRADES_CONFIG")
+BASE_CONTRACTS=$(echo "$BASE_CONFIG" | jq -r '[.contracts[].contract]')
+
+# Find base branch contracts missing from current config
+REMOVED=$(jq -n --argjson base "$BASE_CONTRACTS" --argjson current "$CURRENT_CONTRACTS" \
+  '[$base[] | select(. as $b | $current | index($b) | not)]')
+
+REMOVED_COUNT=$(echo "$REMOVED" | jq 'length')
+
+if [[ "$REMOVED_COUNT" -gt 0 ]]; then
+  REMOVED_LIST=$(echo "$REMOVED" | jq -r '.[]')
+  echo "::error::$REMOVED_COUNT contract(s) removed from $UPGRADES_CONFIG compared to base branch ($BASE_BRANCH):"
+  echo "$REMOVED_LIST"
+  {
+    echo "## Upgrade Config Validation"
+    echo ""
+    echo "> **Error:** $REMOVED_COUNT contract(s) were removed from \`$UPGRADES_CONFIG\`:"
+    echo ""
+    echo "$REMOVED_LIST" | while read -r c; do echo "- \`$c\`"; done
+  } >> "$GITHUB_STEP_SUMMARY"
+  exit 1
+fi
+
+CURRENT_COUNT=$(echo "$CURRENT_CONTRACTS" | jq 'length')
+BASE_COUNT=$(echo "$BASE_CONTRACTS" | jq 'length')
+echo "Config validation passed: $CURRENT_COUNT contracts (base branch has $BASE_COUNT)"
diff --git a/scripts/upgrade-safety/validate.sh b/scripts/upgrade-safety/validate.sh
new file mode 100755
index 0000000..80d03ba
--- /dev/null
+++ b/scripts/upgrade-safety/validate.sh
@@ -0,0 +1,188 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Validate upgrade safety for contracts listed in upgrades.json.
+# Contracts without an explicit reference are compared against the base branch.
+# Contracts with an explicit reference are compared within the current build.
+#
+# Env inputs:
+#   UPGRADES_CONFIG   — required, path to upgrades.json
+#   BASE_BRANCH       — required, branch name to compare against
+#   PACKAGE_MANAGER   — required, one of: none, npm, yarn, pnpm
+#   CURRENT_BUILD     — optional, default "out/build-info"
+
+: "${UPGRADES_CONFIG:?UPGRADES_CONFIG is required}"
+: "${BASE_BRANCH:?BASE_BRANCH is required}"
+: "${PACKAGE_MANAGER:?PACKAGE_MANAGER is required}"
+CURRENT_BUILD="${CURRENT_BUILD:-out/build-info}"
+OZ_UPGRADES_CORE_VERSION="${OZ_UPGRADES_CORE_VERSION:-1.44.2}"
+
+# Check if config exists
+if [[ ! -f "$UPGRADES_CONFIG" ]]; then
+  echo "::error::No upgrades config found at $UPGRADES_CONFIG"
+  {
+    echo "## Upgrade Safety Validation"
+    echo ""
+    echo "> **Error:** No \`$UPGRADES_CONFIG\` found. Create the config file or disable upgrade safety."
+  } >> "$GITHUB_STEP_SUMMARY"
+  exit 1
+fi
+
+# Check that contracts field exists
+if ! jq -e 'has("contracts")' "$UPGRADES_CONFIG" > /dev/null 2>&1; then
+  echo "::error::Missing 'contracts' field in $UPGRADES_CONFIG — expected an array of contract entries"
+  {
+    echo "## Upgrade Safety Validation"
+    echo ""
+    echo "> **Error:** \`$UPGRADES_CONFIG\` is missing the \`contracts\` field."
+  } >> "$GITHUB_STEP_SUMMARY"
+  exit 1
+fi
+
+# Check for empty contracts array
+CONTRACT_COUNT=$(jq '.contracts | length' "$UPGRADES_CONFIG")
+if [[ "$CONTRACT_COUNT" -eq 0 ]]; then
+  echo "::warning::No contracts defined in $UPGRADES_CONFIG — skipping upgrade safety validation"
+  {
+    echo "## Upgrade Safety Validation"
+    echo ""
+    echo "> No contracts defined in \`$UPGRADES_CONFIG\`. Skipping validation."
+  } >> "$GITHUB_STEP_SUMMARY"
+  exit 0
+fi
+
+# Check if any contracts need base branch comparison (no explicit reference)
+NEEDS_BASE=false
+while IFS= read -r entry; do
+  REF_VALUE=$(echo "$entry" | jq -c '.reference // empty')
+  if [[ -z "$REF_VALUE" || "$REF_VALUE" == "null" ]]; then
+    NEEDS_BASE=true
+    break
+  fi
+done < <(jq -c '.contracts[]' "$UPGRADES_CONFIG")
+
+# Build base branch in a worktree if needed
+BASE_BUILD=""
+BASE_DIR=""
+if [[ "$NEEDS_BASE" == "true" ]]; then
+  echo "Building base branch ($BASE_BRANCH) for comparison..."
+  if ! git fetch origin "$BASE_BRANCH" 2>/dev/null; then
+    echo "::error::Failed to fetch base branch $BASE_BRANCH — required for contracts without explicit reference"
+    exit 1
+  fi
+  BASE_DIR=$(mktemp -d)
+
+  if git worktree add --detach "$BASE_DIR" "origin/$BASE_BRANCH" 2>/dev/null; then
+    (cd "$BASE_DIR" && { git submodule update --init --recursive 2>/dev/null || true; })
+
+    # Install dependencies in base worktree if needed
+    if [[ "$PACKAGE_MANAGER" != "none" ]]; then
+      (cd "$BASE_DIR" && case "$PACKAGE_MANAGER" in
+        npm)  npm ci ;;
+        yarn) yarn --frozen-lockfile ;;
+        pnpm) corepack enable && pnpm install --frozen-lockfile ;;
+      esac) || echo "::warning::Failed to install dependencies in base branch"
+    fi
+
+    if (cd "$BASE_DIR" && forge build --build-info --extra-output storageLayout 2>&1); then
+      mv "${BASE_DIR}/out/build-info" "${BASE_DIR}/out/base-build-info"
+      BASE_BUILD="${BASE_DIR}/out/base-build-info"
+      echo "Base branch built successfully"
+    else
+      echo "::error::Failed to build base branch — required for contracts without explicit reference"
+      exit 1
+    fi
+  else
+    echo "::error::Could not checkout base branch '$BASE_BRANCH' — required for contracts without explicit reference"
+    exit 1
+  fi
+fi
+
+PASSED=0
+FAILED=0
+SUMMARY=""
+
+# Validate each contract
+while IFS= read -r entry; do
+  CONTRACT=$(echo "$entry" | jq -r '.contract')
+  REF_VALUE=$(echo "$entry" | jq -c '.reference // empty')
+  CONTRACT_PATH="${CONTRACT%%:*}"
+
+  echo "::group::Validating $CONTRACT"
+
+  if [[ -z "$REF_VALUE" || "$REF_VALUE" == "null" ]]; then
+    # === Base branch comparison (default) ===
+    if [[ -n "$BASE_BUILD" ]] && git show "origin/${BASE_BRANCH}:${CONTRACT_PATH}" > /dev/null 2>&1; then
+      # Contract exists on base branch — compare storage layouts
+      if OUTPUT=$(npx @openzeppelin/upgrades-core@"$OZ_UPGRADES_CORE_VERSION" validate "$CURRENT_BUILD" \
+          --contract "$CONTRACT" \
+          --reference "base-build-info:${CONTRACT}" \
+          --referenceBuildInfoDirs "$BASE_BUILD" 2>&1); then
+        echo "$OUTPUT"
+        SUMMARY="${SUMMARY}| \`${CONTRACT}\` | \`${BASE_BRANCH}\` branch | Pass |"$'\n'
+        PASSED=$((PASSED + 1))
+      else
+        echo "$OUTPUT"
+        SUMMARY="${SUMMARY}| \`${CONTRACT}\` | \`${BASE_BRANCH}\` branch | **FAIL** |"$'\n'
+        FAILED=$((FAILED + 1))
+      fi
+    else
+      # Contract doesn't exist on base branch or base build failed — validate upgradeability only
+      echo "Contract not found on $BASE_BRANCH or base build unavailable, validating upgradeability only..."
+      if OUTPUT=$(npx @openzeppelin/upgrades-core@"$OZ_UPGRADES_CORE_VERSION" validate "$CURRENT_BUILD" \
+          --contract "$CONTRACT" 2>&1); then
+        echo "$OUTPUT"
+        SUMMARY="${SUMMARY}| \`${CONTRACT}\` | (new contract) | Pass |"$'\n'
+        PASSED=$((PASSED + 1))
+      else
+        echo "$OUTPUT"
+        SUMMARY="${SUMMARY}| \`${CONTRACT}\` | (new contract) | **FAIL** |"$'\n'
+        FAILED=$((FAILED + 1))
+      fi
+    fi
+
+  elif echo "$REF_VALUE" | jq -e 'type == "string"' > /dev/null 2>&1; then
+    # === Contract qualifier reference ===
+    QUALIFIER=$(echo "$entry" | jq -r '.reference')
+    if OUTPUT=$(npx @openzeppelin/upgrades-core@"$OZ_UPGRADES_CORE_VERSION" validate "$CURRENT_BUILD" \
+        --contract "$CONTRACT" \
+        --reference "$QUALIFIER" 2>&1); then
+      echo "$OUTPUT"
+      SUMMARY="${SUMMARY}| \`${CONTRACT}\` | \`${QUALIFIER}\` | Pass |"$'\n'
+      PASSED=$((PASSED + 1))
+    else
+      echo "$OUTPUT"
+      SUMMARY="${SUMMARY}| \`${CONTRACT}\` | \`${QUALIFIER}\` | **FAIL** |"$'\n'
+      FAILED=$((FAILED + 1))
+    fi
+
+  else
+    echo "::error::Invalid reference format for $CONTRACT"
+    SUMMARY="${SUMMARY}| \`${CONTRACT}\` | (invalid reference) | **FAIL** |"$'\n'
+    FAILED=$((FAILED + 1))
+  fi
+
+  echo "::endgroup::"
+done < <(jq -c '.contracts[]' "$UPGRADES_CONFIG")
+
+# Clean up worktree
+if [[ -n "$BASE_DIR" ]]; then
+  git worktree remove "$BASE_DIR" --force 2>/dev/null || true
+fi
+
+# Write Step Summary
+{
+  echo "## Upgrade Safety Validation"
+  echo ""
+  echo "| Contract | Reference | Result |"
+  echo "|----------|-----------|--------|"
+  echo -n "$SUMMARY"
+  echo ""
+  echo "**${PASSED} passed, ${FAILED} failed**"
+} >> "$GITHUB_STEP_SUMMARY"
+
+if [[ "$FAILED" -gt 0 ]]; then
+  echo "::error::${FAILED} contract(s) failed upgrade safety validation"
+  exit 1
+fi
+
+echo "All contracts passed upgrade safety validation"
diff --git a/tests/fixtures/broadcast/Deploy.s.sol/31337/run-latest.json b/tests/fixtures/broadcast/Deploy.s.sol/31337/run-latest.json
new file mode 100644
index 0000000..ba7346f
--- /dev/null
+++ b/tests/fixtures/broadcast/Deploy.s.sol/31337/run-latest.json
@@ -0,0 +1,22 @@
+{
+  "transactions": [
+    {
+      "hash": "0xabc123",
+      "transactionType": "CREATE",
+      "contractName": "MyToken",
+      "contractAddress": "0x1234567890abcdef1234567890abcdef12345678"
+    },
+    {
+      "hash": "0xdef456",
+      "transactionType": "CREATE",
+      "contractName": "MyProxy",
+      "contractAddress": "0xabcdefabcdefabcdefabcdefabcdefabcdefabcd"
+    },
+    {
+      "hash": "0x789012",
+      "transactionType": "CALL",
+      "contractName": "MyProxy",
+      "contractAddress": "0xabcdefabcdefabcdefabcdefabcdefabcdefabcd"
+    }
+  ]
+}
diff --git a/tests/fixtures/coverage-raw.txt b/tests/fixtures/coverage-raw.txt
new file mode 100644
index 0000000..df7e32d
--- /dev/null
+++ b/tests/fixtures/coverage-raw.txt
@@ -0,0 +1,11 @@
+Compiling 10 files with Solc 0.8.28
+Compiler run successful!
+Analysing contracts...
+Running tests...
+╭--------------------------+------------------+------------------+------------------+------------------╮
+| File                     | % Lines          | % Statements     | % Branches       | % Funcs          |
+├--------------------------+------------------+------------------+------------------+------------------┤
+| src/MyToken.sol          | 80.00% (8/10)    | 75.00% (9/12)    | 50.00% (3/6)     | 100.00% (4/4)   |
+| src/MyProxy.sol          | 60.00% (3/5)     | 66.67% (4/6)     | 33.33% (1/3)     | 50.00% (1/2)    |
+| test/MyToken.t.sol       | 100.00% (20/20)  | 100.00% (25/25)  | 100.00% (10/10)  | 100.00% (5/5)   |
+╰--------------------------+------------------+------------------+------------------+------------------╯
diff --git a/tests/fixtures/deploy-networks.json b/tests/fixtures/deploy-networks.json
new file mode 100644
index 0000000..aee6451
--- /dev/null
+++ b/tests/fixtures/deploy-networks.json
@@ -0,0 +1,16 @@
+{
+  "testnets": [
+    {
+      "name": "sepolia",
+      "chain_id": 11155111,
+      "blockscout_url": "https://eth-sepolia.blockscout.com",
+      "environment": "testnet"
+    },
+    {
+      "name": "local",
+      "chain_id": 31337,
+      "blockscout_url": "http://localhost:4000",
+      "environment": "local"
+    }
+  ]
+}
diff --git a/tests/test-check-threshold.sh b/tests/test-check-threshold.sh
new file mode 100755
index 0000000..a3be194
--- /dev/null
+++ b/tests/test-check-threshold.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+FAILURES=0
+
+echo "=== Testing scripts/coverage/check-threshold.sh ==="
+
+# Test 1: All metrics above threshold — passes
+(
+  export THRESHOLD=50
+  export LINES_PCT=80.00
+  export STMTS_PCT=75.00
+  export BRANCH_PCT=60.00
+  export FUNCS_PCT=90.00
+
+  bash "$SCRIPT_DIR/scripts/coverage/check-threshold.sh" > /dev/null 2>&1
+  echo "PASS: passes when all metrics above threshold"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 2: One metric below threshold — fails
+(
+  export THRESHOLD=50
+  export LINES_PCT=80.00
+  export STMTS_PCT=75.00
+  export BRANCH_PCT=30.00
+  export FUNCS_PCT=90.00
+
+  if bash "$SCRIPT_DIR/scripts/coverage/check-threshold.sh" > /dev/null 2>&1; then
+    echo "FAIL: should have exited with error"
+    exit 1
+  fi
+  echo "PASS: fails when a metric is below threshold"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 3: Exactly at threshold — passes
+(
+  export THRESHOLD=80
+  export LINES_PCT=80.00
+  export STMTS_PCT=80.00
+  export BRANCH_PCT=80.00
+  export FUNCS_PCT=80.00
+
+  bash "$SCRIPT_DIR/scripts/coverage/check-threshold.sh" > /dev/null 2>&1
+  echo "PASS: passes when metrics exactly at threshold"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 4: Zero threshold always passes
+(
+  export THRESHOLD=0
+  export LINES_PCT=0
+  export STMTS_PCT=0
+  export BRANCH_PCT=0
+  export FUNCS_PCT=0
+
+  bash "$SCRIPT_DIR/scripts/coverage/check-threshold.sh" > /dev/null 2>&1
+  echo "PASS: zero threshold always passes"
+) || { FAILURES=$((FAILURES + 1)); }
+
+echo "--- $((4 - FAILURES))/4 tests passed ---"
+exit $FAILURES
diff --git a/tests/test-deployment-summary.sh b/tests/test-deployment-summary.sh
new file mode 100755
index 0000000..ce1706d
--- /dev/null
+++ b/tests/test-deployment-summary.sh
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+FAILURES=0
+
+echo "=== Testing scripts/deploy/deployment-summary.sh ==="
+
+# Test 1: Generates markdown table
+(
+  TMPDIR=$(mktemp -d)
+  trap 'rm -rf "$TMPDIR"' EXIT
+  cd "$TMPDIR"
+
+  cat > deployment-summary.txt <<'EOF'
+MyToken: 0x1234567890abcdef1234567890abcdef12345678
+MyProxy: 0xabcdefabcdefabcdefabcdefabcdefabcdefabcd
+EOF
+
+  export BLOCKSCOUT_URL="https://eth-sepolia.blockscout.com"
+  export GITHUB_STEP_SUMMARY="$TMPDIR/summary.md"
+  touch "$GITHUB_STEP_SUMMARY"
+
+  bash "$SCRIPT_DIR/scripts/deploy/deployment-summary.sh"
+
+  grep -q "Deployment Summary" "$GITHUB_STEP_SUMMARY" || { echo "FAIL: no title"; exit 1; }
+  grep -q "MyToken" "$GITHUB_STEP_SUMMARY" || { echo "FAIL: MyToken not found"; exit 1; }
+  grep -q "MyProxy" "$GITHUB_STEP_SUMMARY" || { echo "FAIL: MyProxy not found"; exit 1; }
+  grep -q "View" "$GITHUB_STEP_SUMMARY" || { echo "FAIL: explorer link not found"; exit 1; }
+
+  echo "PASS: generates markdown table"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 2: Custom title via SUMMARY_TITLE
+(
+  TMPDIR=$(mktemp -d)
+  trap 'rm -rf "$TMPDIR"' EXIT
+  cd "$TMPDIR"
+
+  cat > deployment-summary.txt <<'EOF'
+MyToken: 0x1234567890abcdef1234567890abcdef12345678
+EOF
+
+  export BLOCKSCOUT_URL="https://eth-sepolia.blockscout.com"
+  export SUMMARY_TITLE="Testnet Deployment Summary"
+  export GITHUB_STEP_SUMMARY="$TMPDIR/summary.md"
+  touch "$GITHUB_STEP_SUMMARY"
+
+  bash "$SCRIPT_DIR/scripts/deploy/deployment-summary.sh"
+
+  grep -q "Testnet Deployment Summary" "$GITHUB_STEP_SUMMARY" || { echo "FAIL: custom title not found"; exit 1; }
+
+  echo "PASS: custom title works"
+) || { FAILURES=$((FAILURES + 1)); }
+
+echo "--- $((2 - FAILURES))/2 tests passed ---"
+exit $FAILURES
diff --git a/tests/test-extract-summary.sh b/tests/test-extract-summary.sh
new file mode 100755
index 0000000..2ef615f
--- /dev/null
+++ b/tests/test-extract-summary.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+FAILURES=0
+
+echo "=== Testing scripts/coverage/extract-summary.sh ==="
+
+# Test 1: Extracts coverage percentages for src/ files only
+(
+  TMPDIR=$(mktemp -d)
+  trap 'rm -rf "$TMPDIR"' EXIT
+  cd "$TMPDIR"
+
+  cp "$SCRIPT_DIR/tests/fixtures/coverage-raw.txt" .
+
+  export GITHUB_OUTPUT="$TMPDIR/github-output.txt"
+  export COVERAGE_SOURCE_FILTER=" src/"
+  touch "$GITHUB_OUTPUT"
+
+  bash "$SCRIPT_DIR/scripts/coverage/extract-summary.sh"
+
+  grep -q "lines_pct=" "$GITHUB_OUTPUT" || { echo "FAIL: lines_pct not in output"; exit 1; }
+  grep -q "stmts_pct=" "$GITHUB_OUTPUT" || { echo "FAIL: stmts_pct not in output"; exit 1; }
+  grep -q "branch_pct=" "$GITHUB_OUTPUT" || { echo "FAIL: branch_pct not in output"; exit 1; }
+  grep -q "funcs_pct=" "$GITHUB_OUTPUT" || { echo "FAIL: funcs_pct not in output"; exit 1; }
+
+  # Verify test/ files are excluded (11/15 = 73.33, not 100)
+  LINES_PCT=$(grep "lines_pct=" "$GITHUB_OUTPUT" | cut -d= -f2)
+  if (( $(echo "$LINES_PCT > 80" | bc -l) )); then
+    echo "FAIL: lines_pct=$LINES_PCT, test files likely included"
+    exit 1
+  fi
+
+  echo "PASS: extracts correct src-only percentages"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 2: Generates coverage-comment.md
+(
+  TMPDIR=$(mktemp -d)
+  trap 'rm -rf "$TMPDIR"' EXIT
+  cd "$TMPDIR"
+
+  cp "$SCRIPT_DIR/tests/fixtures/coverage-raw.txt" .
+
+  export GITHUB_OUTPUT="$TMPDIR/github-output.txt"
+  export COVERAGE_SOURCE_FILTER=" src/"
+  touch "$GITHUB_OUTPUT"
+
+  bash "$SCRIPT_DIR/scripts/coverage/extract-summary.sh"
+
+  [[ -f coverage-comment.md ]] || { echo "FAIL: coverage-comment.md not created"; exit 1; }
+  grep -q "Coverage Report" coverage-comment.md || { echo "FAIL: no title in comment"; exit 1; }
+  grep -q "Lines" coverage-comment.md || { echo "FAIL: no Lines metric"; exit 1; }
+  grep -q "MyToken" coverage-comment.md || { echo "FAIL: no per-file breakdown"; exit 1; }
+
+  echo "PASS: generates coverage-comment.md"
+) || { FAILURES=$((FAILURES + 1)); }
+
+echo "--- $((2 - FAILURES))/2 tests passed ---"
+exit $FAILURES
diff --git a/tests/test-parse-broadcast.sh b/tests/test-parse-broadcast.sh
new file mode 100755
index 0000000..40a4b7e
--- /dev/null
+++ b/tests/test-parse-broadcast.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+FAILURES=0
+
+echo "=== Testing scripts/deploy/parse-broadcast.sh ==="
+
+# Test 1: Parses broadcast file and extracts chain ID
+(
+  TMPDIR=$(mktemp -d)
+  trap 'rm -rf "$TMPDIR"' EXIT
+  cp -r "$SCRIPT_DIR/tests/fixtures/broadcast" "$TMPDIR/"
+  cd "$TMPDIR"
+
+  export GITHUB_OUTPUT="$TMPDIR/github-output.txt"
+  touch "$GITHUB_OUTPUT"
+
+  bash "$SCRIPT_DIR/scripts/deploy/parse-broadcast.sh" > /dev/null
+
+  grep -q "broadcast_file=" "$GITHUB_OUTPUT" || { echo "FAIL: broadcast_file not in output"; exit 1; }
+  grep -q "chain_id=31337" "$GITHUB_OUTPUT" || { echo "FAIL: chain_id not 31337"; cat "$GITHUB_OUTPUT"; exit 1; }
+
+  echo "PASS: extracts broadcast_file and chain_id"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 2: Creates deployment-summary.txt with CREATE transactions only
+(
+  TMPDIR=$(mktemp -d)
+  trap 'rm -rf "$TMPDIR"' EXIT
+  cp -r "$SCRIPT_DIR/tests/fixtures/broadcast" "$TMPDIR/"
+  cd "$TMPDIR"
+
+  export GITHUB_OUTPUT="$TMPDIR/github-output.txt"
+  touch "$GITHUB_OUTPUT"
+
+  bash "$SCRIPT_DIR/scripts/deploy/parse-broadcast.sh" > /dev/null
+
+  [[ $(wc -l < deployment-summary.txt) -eq 2 ]] || { echo "FAIL: expected 2 lines, got $(wc -l < deployment-summary.txt)"; exit 1; }
+  grep -q "MyToken" deployment-summary.txt || { echo "FAIL: MyToken not found"; exit 1; }
+  grep -q "MyProxy" deployment-summary.txt || { echo "FAIL: MyProxy not found"; exit 1; }
+
+  echo "PASS: deployment-summary.txt has correct CREATE entries"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 3: Fails when no broadcast file exists
+(
+  TMPDIR=$(mktemp -d)
+  trap 'rm -rf "$TMPDIR"' EXIT
+  cd "$TMPDIR"
+
+  export GITHUB_OUTPUT="$TMPDIR/github-output.txt"
+  touch "$GITHUB_OUTPUT"
+
+  if bash "$SCRIPT_DIR/scripts/deploy/parse-broadcast.sh" > /dev/null 2>&1; then
+    echo "FAIL: should have exited with error"
+    exit 1
+  fi
+
+  echo "PASS: fails when no broadcast file"
+) || { FAILURES=$((FAILURES + 1)); }
+
+echo "--- $((3 - FAILURES))/3 tests passed ---"
+exit $FAILURES
diff --git a/tests/test-prepare-env.sh b/tests/test-prepare-env.sh
new file mode 100755
index 0000000..a136230
--- /dev/null
+++ b/tests/test-prepare-env.sh
@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+FAILURES=0
+
+echo "=== Testing scripts/deploy/prepare-env.sh ==="
+
+# Test 1: PRIVATE_KEY without 0x gets prefix added
+(
+  export PRIVATE_KEY="abc123"
+  unset DEPLOY_ENV_VARS 2>/dev/null || true
+  source "$SCRIPT_DIR/scripts/deploy/prepare-env.sh"
+  [[ "$PRIVATE_KEY" == "0xabc123" ]] || { echo "FAIL: expected 0xabc123, got $PRIVATE_KEY"; exit 1; }
+  echo "PASS: adds 0x prefix"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 2: PRIVATE_KEY already with 0x is not doubled
+(
+  export PRIVATE_KEY="0xabc123"
+  unset DEPLOY_ENV_VARS 2>/dev/null || true
+  source "$SCRIPT_DIR/scripts/deploy/prepare-env.sh"
+  [[ "$PRIVATE_KEY" == "0xabc123" ]] || { echo "FAIL: expected 0xabc123, got $PRIVATE_KEY"; exit 1; }
+  echo "PASS: preserves existing 0x prefix"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 3: Empty PRIVATE_KEY stays empty
+(
+  export PRIVATE_KEY=""
+  unset DEPLOY_ENV_VARS 2>/dev/null || true
+  source "$SCRIPT_DIR/scripts/deploy/prepare-env.sh"
+  [[ -z "$PRIVATE_KEY" || "$PRIVATE_KEY" == "0x" ]] || { echo "FAIL: expected empty or 0x, got $PRIVATE_KEY"; exit 1; }
+  echo "PASS: empty key handled"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 4: DEPLOY_ENV_VARS are exported
+(
+  export PRIVATE_KEY="0xtest"
+  export DEPLOY_ENV_VARS=$'FOO=bar\nBAZ=qux'
+  source "$SCRIPT_DIR/scripts/deploy/prepare-env.sh"
+  [[ "$FOO" == "bar" ]] || { echo "FAIL: FOO not set"; exit 1; }
+  [[ "$BAZ" == "qux" ]] || { echo "FAIL: BAZ not set"; exit 1; }
+  echo "PASS: DEPLOY_ENV_VARS exported"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 5: Comments and blank lines in DEPLOY_ENV_VARS are skipped
+(
+  export PRIVATE_KEY="0xtest"
+  export DEPLOY_ENV_VARS=$'# comment\n\nFOO=bar\n# another\nBAZ=qux'
+  source "$SCRIPT_DIR/scripts/deploy/prepare-env.sh"
+  [[ "$FOO" == "bar" ]] || { echo "FAIL: FOO not set"; exit 1; }
+  [[ "$BAZ" == "qux" ]] || { echo "FAIL: BAZ not set"; exit 1; }
+  echo "PASS: comments and blanks skipped"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 6: No DEPLOY_ENV_VARS is fine
+(
+  export PRIVATE_KEY="0xtest"
+  unset DEPLOY_ENV_VARS 2>/dev/null || true
+  source "$SCRIPT_DIR/scripts/deploy/prepare-env.sh"
+  echo "PASS: no DEPLOY_ENV_VARS ok"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 7: No PRIVATE_KEY is fine
+(
+  unset PRIVATE_KEY 2>/dev/null || true
+  unset DEPLOY_ENV_VARS 2>/dev/null || true
+  source "$SCRIPT_DIR/scripts/deploy/prepare-env.sh"
+  echo "PASS: no PRIVATE_KEY ok"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 8: Lines without = cause failure
+(
+  export PRIVATE_KEY="0xtest"
+  export DEPLOY_ENV_VARS=$'GOOD=val\nmalformed_no_equals\nALSO_GOOD=123'
+  if source "$SCRIPT_DIR/scripts/deploy/prepare-env.sh" 2>/dev/null; then
+    echo "FAIL: should have failed on malformed line"
+    exit 1
+  fi
+  echo "PASS: lines without = cause failure"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 9: Invalid key names cause failure
+(
+  export PRIVATE_KEY="0xtest"
+  export DEPLOY_ENV_VARS=$'GOOD_KEY=ok\nbad-key=nope'
+  if source "$SCRIPT_DIR/scripts/deploy/prepare-env.sh" 2>/dev/null; then
+    echo "FAIL: should have failed on invalid key name"
+    exit 1
+  fi
+  echo "PASS: invalid key names cause failure"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 10: Valid keys with various value formats export correctly
+(
+  export PRIVATE_KEY="0xtest"
+  export DEPLOY_ENV_VARS=$'KEY_WITH_NUMS_123=abc\n_UNDERSCORE=yes\nVAL_WITH_EQUALS=a=b=c'
+  source "$SCRIPT_DIR/scripts/deploy/prepare-env.sh"
+  [[ "$KEY_WITH_NUMS_123" == "abc" ]] || { echo "FAIL: KEY_WITH_NUMS_123 not set"; exit 1; }
+  [[ "$_UNDERSCORE" == "yes" ]] || { echo "FAIL: _UNDERSCORE not set"; exit 1; }
+  [[ "$VAL_WITH_EQUALS" == "a=b=c" ]] || { echo "FAIL: VAL_WITH_EQUALS should preserve = in value, got $VAL_WITH_EQUALS"; exit 1; }
+  echo "PASS: valid keys with various values export correctly"
+) || { FAILURES=$((FAILURES + 1)); }
+
+TOTAL=10
+echo "--- $((TOTAL - FAILURES))/$TOTAL tests passed ---"
+exit $FAILURES
diff --git a/tests/test-resolve-network.sh b/tests/test-resolve-network.sh
new file mode 100755
index 0000000..c1aba67
--- /dev/null
+++ b/tests/test-resolve-network.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+FIXTURES="$SCRIPT_DIR/tests/fixtures"
+FAILURES=0
+
+echo "=== Testing scripts/deploy/resolve-network.sh (jq parsing only) ==="
+
+# Test 1: Finds matching chain ID
+(
+  RESULT=$(jq -r --argjson cid 31337 '
+    (.testnets // [])
+    | map(select(.chain_id == $cid))
+    | first
+    | .blockscout_url // empty
+  ' "$FIXTURES/deploy-networks.json")
+
+  [[ "$RESULT" == "http://localhost:4000" ]] || { echo "FAIL: expected http://localhost:4000, got $RESULT"; exit 1; }
+  echo "PASS: finds matching chain ID"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 2: Finds network name
+(
+  RESULT=$(jq -r --argjson cid 11155111 '
+    (.testnets // [])
+    | map(select(.chain_id == $cid))
+    | first
+    | .name // "unknown"
+  ' "$FIXTURES/deploy-networks.json")
+
+  [[ "$RESULT" == "sepolia" ]] || { echo "FAIL: expected sepolia, got $RESULT"; exit 1; }
+  echo "PASS: finds network name"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 3: Returns empty for unknown chain ID
+(
+  RESULT=$(jq -r --argjson cid 99999 '
+    (.testnets // [])
+    | map(select(.chain_id == $cid))
+    | first
+    | .blockscout_url // empty
+  ' "$FIXTURES/deploy-networks.json")
+
+  [[ -z "$RESULT" || "$RESULT" == "null" ]] || { echo "FAIL: expected empty, got $RESULT"; exit 1; }
+  echo "PASS: returns empty for unknown chain ID"
+) || { FAILURES=$((FAILURES + 1)); }
+
+# Test 4: Fallback to testnets[0]
+(
+  RESULT=$(jq -r '.testnets[0].blockscout_url' "$FIXTURES/deploy-networks.json")
+
+  [[ "$RESULT" == "https://eth-sepolia.blockscout.com" ]] || { echo "FAIL: expected sepolia URL, got $RESULT"; exit 1; }
+  echo "PASS: fallback to testnets[0] works"
+) || { FAILURES=$((FAILURES + 1)); }
+
+echo "--- $((4 - FAILURES))/4 tests passed ---"
+exit $FAILURES