chore: bump soroban-sdk to 27.0.0 and close out scanner noise (#87)

* chore: bump soroban-sdk to 27.0.0 and close out scanner noise

- Bump soroban-sdk from 23.5.2 → 27.0.0 in workspace Cargo.toml
- Bump Rust toolchain from 1.90.0 → 1.91.0 in rust-toolchain.toml
  (required by soroban-sdk 27.0.0)
- Update build target reference in CLAUDE.md from wasm32-unknown-unknown
  to wasm32v1-none (required by Soroban environment ≥ SDK 22+, deploy
  scripts already used the correct target)
- Update docs/scout-audit-report.md:
  - Mark soroban_version ENHANCEMENT as resolved
  - Record all ~44 storage_change_events ENHANCEMENT flags as no action
    (flagged functions already emit events; Scout cannot trace through
    dispatcher wrappers; ManagerChanged gap tracked in issue #3)

All 197 events + 66 profile tests pass at soroban-sdk 27.0.0.

Closes #77

* ci: use Rust 1.93 and stellar-cli 27 so the sdk-27 bump actually builds

soroban-sdk 27.0.0 has MSRV 1.91.0, but the Stellar contract build tool
blocklists Rust 1.91.0 exactly ("use a rust version other than 1.81,
1.82, 1.83 or 1.91.0"), so `make build` fails under the previously
pinned 1.91.0. Pin 1.93.0 instead: it clears the SDK MSRV and is not on
the blocklist. Verified with `stellar contract build` (cli 27.0.0), not
just `cargo build` — the plain cargo path skips the blocklist check.

Also bump the CI-pinned stellar-cli 23.1.3 -> 27.0.0 to match Protocol
27 (mainnet + testnet both run core 27.x), with its verified linux
tarball SHA-256. Merge current testnet in to pick up the hardened CI
action and the 1.3.0 contract changes, and regenerate Cargo.lock.

Verified: stellar contract build OK for both contracts; events wasm
53,257 bytes (< 64 KB ceiling); cargo test 210 + 66 green; fmt clean.

* ci(verify-build): trigger on toolchain + workspace manifest changes

The build job only ran on contracts/** changes, so a Cargo.toml SDK bump
or a rust-toolchain.toml / setup-rust-stellar change could merge without
the build ever running — exactly the toolchain surface most likely to
break the build. Add those paths so make build validates them.

---------

Co-authored-by: Collins Ikechukwu <collinschristroa@gmail.com>

Author: JamesVictor-O

.github/actions/setup-rust-stellar/action.yml

@@ -18,10 +18,10 @@ runs:
 
     - name: Install Stellar CLI
       run: |
-        STELLAR_VERSION="23.1.3"
+        STELLAR_VERSION="27.0.0"
         STELLAR_TAR="stellar-cli-${STELLAR_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
-        # Official SHA-256 from https://github.com/stellar/stellar-cli/releases/tag/v23.1.3
-        STELLAR_SHA256="cca0a9e249176b15ac2d63a394b383c0699dd59cd52b67cd9593427f0d039d87"
+        # Official SHA-256 from https://github.com/stellar/stellar-cli/releases/tag/v27.0.0
+        STELLAR_SHA256="357bf712f6353c28cd33c794402a3c87231757a5b305e6ef1604365af4fdd556"
 
         wget -q "https://github.com/stellar/stellar-cli/releases/download/v${STELLAR_VERSION}/${STELLAR_TAR}"
 

.github/workflows/verify-build.yml

@@ -7,6 +7,10 @@ on:
       - testnet
     paths:
       - 'contracts/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'rust-toolchain.toml'
+      - '.github/actions/setup-rust-stellar/**'
       - '.github/workflows/verify-build.yml'
   # Use pull_request (not pull_request_target): the check must run the workflow
   # from the PR head so branch-filter changes take effect on the PR itself, and
@@ -19,6 +23,10 @@ on:
       - testnet
     paths:
       - 'contracts/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'rust-toolchain.toml'
+      - '.github/actions/setup-rust-stellar/**'
       - '.github/workflows/verify-build.yml'
       - '.github/workflows/rustfmt.yml'
   workflow_dispatch:

CLAUDE.md

@@ -28,7 +28,7 @@ Source: <https://github.com/stellar/stellar-dev-skill>
 
 ```bash
 # Build
-cd contracts/events && cargo build --target wasm32-unknown-unknown --release
+cd contracts/events && cargo build --target wasm32v1-none --release
 
 # Test (host target)
 cargo test -p boundless-events
@@ -46,7 +46,7 @@ Mainnet admin operations live behind the multi-sig defined in `docs/admin-custod
 
 ```bash
 cargo test -p boundless-events
-cargo build --release --target wasm32-unknown-unknown
+cargo build --release --target wasm32v1-none
 ```
 
 Update `BACKLOG.md` if your PR closes one of the entries there.