test: update e2e-testnet.sh + tansu-stub to drive trigger flow

Stub gains a Tansu-shaped `execute(maintainer, project_key, proposal_id,
tallies, seeds) -> ProposalStatus` plus `Error::ProposalActive = 402`
(matches Tansu's #402). It auto-invokes the proposal's index-0 outcome
the same way real Tansu does, and sets an `Executed(project_key,
proposal_id)` storage marker so a second call panics with the same
#402 callers would see against live Tansu.

This lets the stub-based smoke loop exercise the new `manager.trigger`
path end-to-end without needing live testnet Tansu:

  manager.trigger(id)
   ├── reads proposal from stub.get_proposal under our project_key
   ├── env.authorize_as_current_contract(outcome)
   └── stub.execute(self, project_key, id, _, _)
         └── env.invoke_contract(outcome) -> registry.deploy(...)
               └── manager.require_auth -> matched by pre-auth
                     -> hello deploys

Verified by running e2e-testnet.sh against testnet — `hello(world)` returns
"world" on the freshly deployed contract; second trigger rejects with #402.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: willemneal

contracts/registry-tansu-manager/e2e-testnet.sh

@@ -5,13 +5,18 @@
 # Flow:
 #   1. Deploy a fresh registry (no manager yet → author can self-publish).
 #   2. Author publishes hello.wasm to the registry.
-#   3. Deploy a tansu-stub (stand-in for the Tansu DAO).
+#   3. Deploy a tansu-stub (stand-in for the Tansu DAO; implements
+#      `get_proposal` + a Tansu-like `execute` that auto-invokes the outcome).
 #   4. Deploy the registry-tansu-manager, pointing at the stub + registry.
 #   5. Admin installs the manager on the registry.
 #   6. Plant an `Approved` deploy-proposal on the stub.
-#   7. Call manager.execute(proposal_id) — registry deploys hello via XCC.
+#   7. Call manager.trigger(proposal_id). The manager reads the proposal,
+#      pre-authorizes the outcome (registry.deploy) via
+#      `env.authorize_as_current_contract`, then calls stub.execute — which
+#      auto-invokes the outcome. The registry's manager.require_auth() is
+#      satisfied by the pre-authorization, so the deploy lands in one tx.
 #   8. Verify: invoke hello on the freshly deployed contract.
-#   9. Replay guard: second execute(proposal_id) returns AlreadyExecuted.
+#   9. Replay guard: second trigger(proposal_id) returns ProposalActive (#402).
 #
 # Usage: contracts/registry-tansu-manager/e2e-testnet.sh
 # Env vars:
@@ -142,13 +147,16 @@ stellar contract invoke --id "$TANSU_ID" \
     --contract_name "$CONTRACT_NAME" \
     --admin "$ADMIN_ADDR"
 
-# 7. Execute the proposal via the manager. No external signer is required —
-#    the registry's manager.require_auth() is satisfied by the manager
-#    contract's own outgoing-call auth.
-echo "==> Executing proposal via manager"
+# 7. Drive the proposal via manager.trigger. The manager reads the proposal
+#    from the stub, pre-authorizes the single outcome (registry.deploy) via
+#    `env.authorize_as_current_contract`, then calls the stub's
+#    `execute(...)`. The stub mimics real Tansu: auto-invokes the outcome via
+#    XCC; the registry's `manager.require_auth()` is satisfied by the
+#    pre-authorization, so the deploy lands in the same tx.
+echo "==> Driving proposal via manager.trigger"
 stellar contract invoke --id "$MANAGER_ID" \
     --source "$CALLER_ID" --network "$NETWORK" \
-    -- execute --proposal_id "$PROPOSAL_ID"
+    -- trigger --proposal_id "$PROPOSAL_ID"
 
 # 8. Verify the registry now resolves the deployed contract.
 echo "==> Resolving deployed contract via registry"
@@ -164,12 +172,13 @@ GREETING=$(stellar contract invoke --id "$DEPLOYED" \
     -- hello --to world)
 echo "    hello(world) = $GREETING"
 
-# 9. Replay guard.
-echo "==> Re-executing proposal — must fail with AlreadyExecuted"
+# 9. Replay guard — Tansu's own `if proposal.status != Active { panic }`
+#    (mirrored by the stub as `Error::ProposalActive = 402`).
+echo "==> Re-triggering proposal — must fail with ProposalActive"
 REPLAY_OUT=$(stellar contract invoke --id "$MANAGER_ID" \
     --source "$CALLER_ID" --network "$NETWORK" \
-    -- execute --proposal_id "$PROPOSAL_ID" 2>&1 || true)
-if grep -qE 'AlreadyExecuted|Error\(Contract, ?#5\)' <<<"$REPLAY_OUT"; then
+    -- trigger --proposal_id "$PROPOSAL_ID" 2>&1 || true)
+if grep -qE 'ProposalActive|Error\(Contract, ?#402\)' <<<"$REPLAY_OUT"; then
     echo "    ✓ replay rejected"
 else
     echo "    ❌ replay was NOT rejected" >&2

contracts/test/tansu-stub/src/lib.rs

@@ -2,8 +2,8 @@
 #![allow(clippy::too_many_arguments, clippy::needless_pass_by_value)]
 
 use soroban_sdk::{
-    contract, contractimpl, contracttype, vec, Address, Bytes, BytesN, Env, IntoVal, String,
-    Symbol, Val, Vec,
+    contract, contracterror, contractimpl, contracttype, panic_with_error, vec, Address, Bytes,
+    BytesN, Env, IntoVal, String, Symbol, Val, Vec,
 };
 
 // Tansu Proposal types — kept in lock-step with both `Consulting-Manao/tansu`
@@ -88,6 +88,22 @@ pub struct Proposal {
 #[contracttype]
 enum Key {
     Proposal(Bytes, u32),
+    /// Marker set when `execute(...)` runs for a (project_key, proposal_id).
+    /// On a second call we panic with [`Error::ProposalActive`] to mirror
+    /// Tansu's status guard.
+    Executed(Bytes, u32),
+}
+
+/// Subset of `Consulting-Manao/tansu`'s `ContractErrors` that this stub
+/// surfaces — keeps the same numeric codes so test harnesses can match by
+/// `Error(Contract, #N)` the same way they would against real Tansu.
+#[contracterror]
+#[derive(Copy, Clone, Debug, Eq, PartialEq, PartialOrd, Ord)]
+#[repr(u32)]
+pub enum Error {
+    /// The proposal has already been executed once (Tansu would say the
+    /// proposal isn't `Active` anymore).
+    ProposalActive = 402,
 }
 
 #[contract]
@@ -104,6 +120,46 @@ impl TansuStub {
             .unwrap()
     }
 
+    /// Stand-in for `Consulting-Manao/tansu`'s `execute`. Real Tansu tallies
+    /// votes, flips the proposal's status, then auto-invokes the
+    /// matching-branch outcome via `try_invoke_contract`. The stub skips the
+    /// tally (proposals are planted as `Approved` directly) but reproduces
+    /// the same auto-invocation + the `if proposal.status != Active` replay
+    /// guard, so callers like `RegistryTansuManager::trigger` can exercise
+    /// the full flow without needing live Tansu.
+    ///
+    /// `maintainer`, `tallies`, `seeds` are accepted for signature parity
+    /// with real Tansu's CLI shape; the stub ignores them.
+    pub fn execute(
+        env: &Env,
+        _maintainer: Address,
+        project_key: Bytes,
+        proposal_id: u32,
+        _tallies: Option<Vec<u128>>,
+        _seeds: Option<Vec<u128>>,
+    ) -> ProposalStatus {
+        let exec_key = Key::Executed(project_key.clone(), proposal_id);
+        if env.storage().persistent().has(&exec_key) {
+            panic_with_error!(env, Error::ProposalActive);
+        }
+
+        let proposal: Proposal = env
+            .storage()
+            .persistent()
+            .get(&Key::Proposal(project_key, proposal_id))
+            .unwrap();
+
+        // Auto-invoke the approved-branch outcome (index 0 in real Tansu).
+        if let Some(outcomes) = &proposal.outcome_contracts {
+            if let Some(oc) = outcomes.get(0) {
+                let _: Val = env.invoke_contract(&oc.address, &oc.execute_fn, oc.args.clone());
+            }
+        }
+
+        env.storage().persistent().set(&exec_key, &true);
+        proposal.status
+    }
+
     /// Plant an arbitrary, fully-formed `Proposal`. Used by callers that need
     /// non-`Approved` states or unusual outcome shapes (e.g. unit tests that
     /// exercise every rejection path in `RegistryTansuManager::execute`).