Protocol-27 mainnet upgrade rollout: version bump + timelocked deploy

[0xdevcollins]

Contract · boundless-events + boundless-profile · P0 (blocking the protocol-27 mainnet upgrade)

Context

PR #87 aligns the build with Protocol 27 (soroban-sdk 27.0.0, Rust 1.93.0, stellar-cli 27.0.0) and lands on testnet. This issue tracks taking that build to mainnet.

Scope

1. Version bump. contractmeta / INITIAL_VERSION are still 1.3.0 (post-feat(events): pull-model prize claims for Single-release events #90). A protocol/SDK bump is a real version event — bump both contracts to 1.4.0 in the deploy PR (not in chore: bump soroban-sdk to 27.0.0 and close out scanner noise #87, which is toolchain-only).
2. Storage decode gate. Verify sdk 23→27 storage decode compatibility before mainnet protocol-27 upgrade #91 must be closed first — do not apply_upgrade on mainnet until sdk 23→27 read-compat is verified.
3. Testnet first. Deploy the sdk-27 wasm fresh to testnet and run the full scripts/smoke/ lifecycle (create → apply → submit → select → claim → cancel/refund) plus the non-USDC smoke.
4. Mainnet upgrade via H6 timelock, per docs/mainnet-deploy-runbook.md + docs/admin-custody-policy.md (multi-sig): build + commit the 1.4.0 wasm → propose_upgrade(hash, "1.4.0") → wait UPGRADE_TIMELOCK_LEDGERS → apply_upgrade() → migrate() (no-op stamp) → verify version() on both. Record in deployments/mainnet.json + deployments/mainnet-upgrades.jsonl.
5. Ideally sequence after the third-party audit (P0), so the audited artifact is the protocol-27 build.

Notes

• Depends on Verify sdk 23→27 storage decode compatibility before mainnet protocol-27 upgrade #91 (decode gate) and chore: bump soroban-sdk to 27.0.0 and close out scanner noise #87 (toolchain PR).
• Keep the contract source unchanged from the audited state; this is a toolchain/protocol re-target, not a logic change.

[coderabbitai]

🔗 Related PRs

#59 - docs: rewrite README with deployed addresses and versions [merged]
#60 - Revise README and CI workflows for 1.1.0 deployment update [merged]
#81 - chore: strip explanatory comments from contract source [merged]
#87 - chore: bump soroban-sdk to 27.0.0 and close out scanner noise [open]
#90 - feat(events): pull-model prize claims for Single-release events [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[0xdevcollins]

@Ebenezer199914 This is not for external contributors

[OluRemiFour]

I've reviewed the issue and understand the requirements. I'd love to work on this and submit a clean PR that meets the acceptance criteria.

[egwujiohaifesinachiperpetual-max]

Hello boss, Please assign this issue to me. i checked it out and im confident i will solve it
my eta is 4 hours

[jaynomyaro]

Hi! I’m a full-stack developer with a strong blockchain background. I’d love to handle this issue and can deliver a clean, reliable solution. Kindly assign it to me.

[nurudeenheroic]

Hello! I've reviewed the issue and can implement an efficient fix.I'd be happy to contribute and deliver a reliable solution.