[hpmaxi]

Summary

Closes #323

One kind of address had several names. The vault called the account behind a request from, caller, controller or holder, depending on the entrypoint, and the token and the compliance contract called their signer operator in their own entrypoints. The shared crates read like library modules, and proptest was pinned loosely.

Now caller is the account that signs and holder is the account whose request or position the call is about; when one account is both, the entrypoint takes holder. Events and internal helpers use the same names. The crates carry a strata- prefix, every dependency is pinned exactly, and AGENTS.md writes these conventions down. No behaviour changes.

Changes

• The shared crates are strata-timelock, strata-storage and strata-bindings
• The vault's deposit, redemption and request-view entrypoints take holder; fund takes caller
• legal_transfer and the compliance contract's own admin calls take caller instead of operator
• The vault's request events name the account holder, and Funded names the payer caller
• The vault's internal helpers and the token's co-sign check use the same names
• proptest is pinned exactly in both manifests that use it
• AGENTS.md has a Code conventions section
• The harness and the docs use the new names

Deviations

• legal_transfer keeps from and to, the two ends of the transfer; only its signer becomes caller.
• The identity verifier's allow and is_allowed keep account: it names an allowlist entry, not a position.
• The kit spec listed caller.require_auth() for claim_wind_down; it now says holder.require_auth(), as the code does.
• The vault's error docs and the design doc said "controller"; they now say "holder".
• The crate grep still matches OpenZeppelin's compliance::storage and the SDK's testutils::storage, which are not the kit's crates.

Acceptance criteria

• No path names the old crates
• Every entrypoint the kit defines uses caller or holder for its acting address, with argument order and types unchanged
• proptest is pinned with =
• AGENTS.md has a code conventions section
• The workspace tests and the harness (deploy, happy path, guards, wind-down) pass on a local network

Test plan

Automated tests

1. cargo test --locked: 583 passed (379 vault, 80 oracle, 64 token, 29 compliance, 6 identity verifier, 19 timelock, 6 storage).
2. cargo clippy --locked --all-targets -- -D warnings on the eight crates: clean.
3. CI runs the harness deploy, happy path and guards on a local network.

Manual verification

1. Start a local network: docker run --rm -d -p 8000:8000 --name stellar-local stellar/quickstart --local --enable core,rpc.
2. Run stellar contract build, then CARGO_TARGET_DIR=target/short-wind-down stellar contract build --package async-vault --features short_wind_down.
3. Run npm run build:clients, then npm run typecheck -w scripts/harness. Against the new clients, the harness before this change had 63 type errors, one per old argument name.
4. Run HARNESS_NETWORK=local npm run deploy -w scripts/harness, then test:happy-path, test:guards and test:wind-down with npm run <script> -w scripts/harness.
5. You should see 24, 48 and 6 tests pass. The vault's Wasm is 71,793 bytes, down from 71,845: shorter names in its spec. The token (42,444), oracle (33,079), compliance (24,514) and identity verifier (4,151) keep their sizes.

Breaking changes

Fresh deployments only. The names below change in the contract spec, so a client that passes arguments by name, or labels event fields from the spec, must follow. Argument order and types, error codes, and the topics and data each event emits are unchanged.

• async_vault: request_deposit, cancel_deposit, request_redeem and cancel_redeem take holder (was from); claim_deposit and claim_redeem take holder (was caller); get_deposit_request and get_redeem_request take holder (was controller); fund takes caller (was from).
• share_token: legal_transfer takes caller (was operator).
• compliance: bind_vault, finish_setup, propose_change, cancel_change and apply_change take caller (was operator).
• async_vault events: the topic field of DepositRequested, DepositClaimed, DepositCancelled, DepositConvertedToExit, RedeemRequested, RedeemClaimed, RedeemCancelled and RedemptionSurrendered is holder (was controller); Funded's is caller (was from).

The console is not edited here. It builds its clients from the deployed testnet contracts, so it keeps working until the redeploy; then its calls to request_deposit, cancel_deposit, claim_deposit, request_redeem, cancel_redeem, claim_redeem and fund must use the new names. It reads event topics by position, so the event renames do not affect it.

Checklist

• Self-reviewed my own diff
• Tests added or updated
• Docs updated (if applicable)
• No unrelated changes bundled in

Screenshots

None.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
strata-vault-kit-app	Ready	Preview	Oct 23, 2026 3:32pm UTC