Skip to content

docs(backlog): track protocol-27 alignment and mainnet gates #93

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
0xdevcollins wants to merge 1 commit into
base: testnet
Choose a base branch
from
Open

docs(backlog): track protocol-27 alignment and mainnet gates #93

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions BACKLOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,9 @@ Legend: `[ ]` open, `[~]` in flight, `[x]` done.
- [x] Non-USDC token end-to-end smoke. 2026-06-05: registered the testnet native XLM SAC (`CDLZFC3SYJYDZT7K67VZ75HPJVIEUVNIXF47ZG2FB2RMQQVU2HHGCYSC`) on the new events contract; ran `scripts/smoke/contract-non-usdc-token.ts`. Bounty published in XLM, alice applied + submitted + won + got paid; payout tx `a6c8daad…`. Smoke updated to tolerate native-asset tx fees (~143k stroops / 0.014 XLM for 3 alice-signed txs); for non-native tokens the assertion still demands exact-budget delta.
- [ ] Mainnet admin multi-sig provisioned per `docs/admin-custody-policy.md` (3 signers, 2-of-3). 2026-06-05: launch baseline updated to software multi-sig (Freighter on 3 isolated machines) with a hardware-upgrade trigger codified in `admin-custody-policy.md` §10 (TVL $250k OR daily volume $50k/day for 7 days OR first signer-machine incident → mandatory Yubikey upgrade). Pre-flight gate codified for both paths — see `docs/multisig-preflight.md` (Section 1.A hardware, Section 1.B Freighter; everything else identical) and `scripts/admin/verify-multisig.sh` (chain-state gate, hardware-agnostic). The verify script was sanity-tested against a single-sig account and correctly fails with the per-check breakdown.
- [ ] Mainnet deploy executed per `docs/mainnet-deploy-runbook.md`. Result committed to `deployments/mainnet.json`.
- [ ] **Protocol-27 alignment.** The network (mainnet + testnet) runs Protocol 27; the repo was on `soroban-sdk` 23.5.2 (Protocol 23), four majors behind. Toolchain bumped to `soroban-sdk` 27.0.0 / Rust 1.93.0 / stellar-cli 27.0.0 in #87 (Rust 1.91.0 is unbuildable — it is both the sdk-27 MSRV floor and on the stellar-cli blocklist; 1.93.0 clears both). Two follow-ups gate the mainnet upgrade:
- [ ] **#91** — verify sdk 23→27 storage decode compatibility against the live 1.1.0 rows before any mainnet `apply_upgrade` (same trap class as the #83 struct-decode break, across an SDK boundary; the empty-state test suite does not cover it).
- [ ] **#92** — protocol-27 mainnet rollout: bump `contractmeta`/`INITIAL_VERSION` to 1.4.0 in the deploy PR, testnet smoke first, then the H6 timelocked mainnet upgrade. Sequence after the third-party audit so the audited artifact is the protocol-27 build.
- [~] **On-chain credit removal: 1.0.0 -> 1.1.0 in-place upgrade (both contracts).** 2026-07-03: APPLIED on mainnet. Both contracts now report `version() == "1.1.0"`. propose (events tx `03b1b30b`, profile `531ff5a2`, 2026-06-29) -> ~1-day timelock -> apply (events tx `b2c84d7c` ledger 63315871, profile `663085fc` ledger 63315890, 2026-07-03). Live wasm: events `2a8789bf`, profile `b9e3500c`. Recorded in `deployments/mainnet.json` + `deployments/mainnet-upgrades.jsonl`. Remaining: `migrate()` no-op stamp on both (audit-trail marker), then deploy the credit-free `boundless-nestjs`. Original notes below. 2026-06-28: dropped the on-chain credit surface from both contracts (source + tests green, 41 profile / 150 events; wasm builds). Profile struct went `{ bootstrapped_at, credits, reputation }` -> `{ bootstrapped_at, reputation }`; `spend_credits` / `earn_credits` / `refund_credits` / `admin_grant_credits` / `set_default_bootstrap_credits` removed; events contract dropped `application_credit_cost` (EventRecord / CreateEventParams) and `credit_earn` (WinnerSpec). Credits are off-chain only now (see `boundless-credits-reputation-prd.md` §2). Versioned as a minor bump: `INITIAL_VERSION` + `contractmeta` are now `1.1.0` on both. **No data migration required:** the live contracts were freshly deployed with ZERO bootstrapped profiles and ZERO events, so there are no `Profile` / `EventRecord` rows in the old shape to rewrite. The dropped-field structs only ever have to deserialize rows that do not exist. **Timelock kept as-is** (audited H6 control; cheap insurance as real escrow lands; revisit only if operationally painful). Upgrade sequence (multisig governance op per `docs/mainnet-deploy-runbook.md` + `docs/admin-custody-policy.md`, NOT yet executed): build + commit the 1.1.0 wasm -> `propose_upgrade(new_wasm_hash, "1.1.0")` -> wait out `UPGRADE_TIMELOCK_LEDGERS` -> `apply_upgrade()` -> `migrate()` (no-op stamp; emits the `Migrated` audit event) -> verify `version()` reads `1.1.0` -> cut backend over to confirm the credit-free contract surface. Do BOTH contracts. Re-confirm zero on-chain profiles/events at upgrade time (the no-migration assumption rests on it).

### From the 2026-06 Stellar-skill audit
Expand Down
Loading