Fix/issues 1682 1683 1673 1668

.github/CODEOWNERS

@@ -38,3 +38,12 @@
 /CONTRIBUTING.md @YieldVault-RWA/docs-maintainers @YieldVault-RWA/core-maintainers
 /TRIAGE_AND_REVIEW.md @YieldVault-RWA/docs-maintainers @YieldVault-RWA/core-maintainers
 /README.md @YieldVault-RWA/docs-maintainers
+
+# Monitoring & Observability
+/monitoring/ @YieldVault-RWA/devops-maintainers
+
+# Testing Infrastructure
+/tests/ @YieldVault-RWA/backend-maintainers @YieldVault-RWA/frontend-maintainers
+
+# Packages
+/packages/ @YieldVault-RWA/backend-maintainers

.github/ISSUE_TEMPLATE/bug_report.md

@@ -22,8 +22,23 @@ Describe what should have happened.
 Describe what happened instead, including any errors, logs, or stack traces.
 
 ## 📍 Impact
-- Affected area: `scope: frontend` / `scope: backend` / `scope: contracts` / `scope: infra`
-- Severity / priority: `priority: p0-critical` / `priority: p1-high` / `priority: p2-medium` / `priority: p3-low`
+
+### Affected Package
+Select the package(s) affected by this bug:
+- [ ] `contracts` - Smart contracts & blockchain
+- [ ] `backend` - Backend services & API
+- [ ] `frontend` - UI & React components
+- [ ] `docs` - Documentation
+- [ ] `infra` - Infrastructure, CI/CD, deployment
+
+### Severity
+Select the severity level based on impact:
+- [ ] `critical` - Production outage, data loss, security breach
+- [ ] `high` - Feature broken, significant performance degradation
+- [ ] `medium` - Feature partially broken, user workflow impacted
+- [ ] `low` - Minor bug, cosmetic issue, documentation
+
+### Environment
 - Environment: Local / Testnet / Mainnet
 - Browser / OS / Runtime: e.g. Chrome v120 / Windows / Node v20
 

.github/dependabot.yml

@@ -52,6 +52,20 @@ updates:
       - "security"
       - "general"
 
+  - package-ecosystem: "npm"
+    directory: "/packages/api-schemas"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "04:00"
+    open-pull-requests-limit: 10
+    security-updates: true
+    rebase-strategy: auto
+    labels:
+      - "dependencies"
+      - "security"
+      - "general"
+
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:

.github/workflows/dependency-security.yml

@@ -97,3 +97,36 @@ jobs:
         uses: actions/dependency-review-action@v4
         with:
           fail-on-severity: high
+
+  npm-license-check:
+    name: NPM License Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Enable Corepack & Setup pnpm
+        run: |
+          corepack enable
+          corepack prepare pnpm@9.12.0 --activate
+
+      - name: Install Dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install license-checker
+        run: npm install -g license-checker-rseidelsohn
+
+      - name: Check Frontend Licenses
+        working-directory: ./frontend
+        run: |
+          license-checker --onlyAllow "MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;CC0-1.0;Unlicense;Python-2.0;CC-BY-3.0;CC-BY-4.0" --summary
+
+      - name: Check Backend Licenses
+        working-directory: ./backend
+        run: |
+          license-checker --onlyAllow "MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;CC0-1.0;Unlicense;Python-2.0;CC-BY-3.0;CC-BY-4.0" --summary

.github/workflows/docs.yml

@@ -28,3 +28,33 @@ jobs:
         run: |
           cargo doc -p share-price-math --no-deps
           cargo doc -p mock-strategy --no-deps
+        continue-on-error: false
+
+  spell-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install cspell
+        run: npm install -g cspell
+
+      - name: Run spell check
+        run: cspell "**/*.md" --config cspell.json
+
+  link-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Check links
+        uses: lycheeverse/lychee-action@v1
+        with:
+          args: --verbose --no-progress --accept 200,403,429 --timeout 30 --max-retries 3 '**/*.md'
+          fail: true

.github/workflows/release.yml

@@ -54,7 +54,47 @@ jobs:
           branch: "chore/changelog-${{ github.ref_name }}"
           base: "main"
 
-      # Create the GitHub Release with the generated notes
+      # Build Rust workspace
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Build Rust workspace
+        run: cargo build --release --workspace
+
+      # Build frontend
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Enable Corepack
+        run: |
+          corepack enable
+          corepack prepare pnpm@9.12.0 --activate
+
+      - name: Install frontend dependencies
+        working-directory: ./frontend
+        run: pnpm install --frozen-lockfile
+
+      - name: Build frontend
+        working-directory: ./frontend
+        run: pnpm build
+
+      # Generate SBOM for Rust workspace
+      - name: Install cargo-sbom
+        run: cargo install cargo-sbom
+
+      - name: Generate Rust SBOM
+        run: cargo sbom --output-format spdx_json_2_3 > rust-sbom.spdx.json
+
+      # Generate SBOM for frontend
+      - name: Generate Frontend SBOM
+        working-directory: ./frontend
+        run: |
+          npm install -g @cyclonedx/cyclonedx-npm
+          cyclonedx-npm --output-file ../frontend-sbom.json
+
+      # Create the GitHub Release with the generated notes and SBOMs
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
@@ -63,3 +103,6 @@ jobs:
           body_path: /tmp/release-notes.md
           draft: false
           prerelease: ${{ contains(github.ref_name, '-') }}
+          files: |
+            rust-sbom.spdx.json
+            frontend-sbom.json

README.md

@@ -13,7 +13,7 @@ This project is structured as a monorepo containing both the Stellar Soroban sma
 - `/contracts/vault/`: Contains the Rust Soroban smart contract for handling the vault logic, fractional share minting (`yvUSDC`), scaling withdrawals, and simulated yield accrual.
 - `/contracts/mock-strategy/`: Contains test mock contracts for the Korean sovereign debt strategy and price oracle.
 - `/frontend/`: Contains the React + Vite frontend application, integrating `@stellar/freighter-api` for seamless user wallet connections and a premium UI to interact with the protocol.
-- `/docs/`: Contains the Product Requirements Document (PRD), Architecture Document, [Domain Glossary](./docs/GLOSSARY.md), [Vault Invariants](./docs/VAULT_INVARIANTS.md), [Protocol Risk Limits](./docs/PROTOCOL_RISK_LIMITS.md), [Oracle Failure Handling](./docs/ORACLE_FAILURE_HANDLING.md), [Performance Regression Thresholds](./docs/PERFORMANCE_REGRESSION.md), and tracked GitHub issues. See also the [Deposit & Withdrawal Lifecycle](./docs/DEPOSIT_WITHDRAWAL_LIFECYCLE.md) for sequence diagrams, the [Deposit & Withdrawal Troubleshooting Guide](./docs/DEPOSIT_WITHDRAWAL_TROUBLESHOOTING.md) for diagnosing failed operations, and the [Dependency Update Policy](./docs/DEPENDENCY_UPDATE_POLICY.md) for upgrade cadence, testing gates, CVE SLAs, and high-risk library requirements.
+- `/docs/`: Contains the Product Requirements Document (PRD), Architecture Document, [Domain Glossary](./docs/GLOSSARY.md), [Vault Invariants](./docs/VAULT_INVARIANTS.md), [Protocol Risk Limits](./docs/PROTOCOL_RISK_LIMITS.md), [Oracle Failure Handling](./docs/ORACLE_FAILURE_HANDLING.md), [Performance Regression Thresholds](./docs/PERFORMANCE_REGRESSION.md), [Root Scripts Reference](./docs/ROOT_SCRIPTS_REFERENCE.md), and tracked GitHub issues. See also the [Deposit & Withdrawal Lifecycle](./docs/DEPOSIT_WITHDRAWAL_LIFECYCLE.md) for sequence diagrams, the [Deposit & Withdrawal Troubleshooting Guide](./docs/DEPOSIT_WITHDRAWAL_TROUBLESHOOTING.md) for diagnosing failed operations, and the [Dependency Update Policy](./docs/DEPENDENCY_UPDATE_POLICY.md) for upgrade cadence, testing gates, CVE SLAs, and high-risk library requirements.
 
 ## Architecture
 

TRIAGE_LABELS.md

@@ -27,6 +27,7 @@ Severity indicates impact and urgency. Every issue must have exactly one severit
 | `high` | 🟠 Orange | Feature broken, significant performance degradation, security vulnerability (no active exploit) | 1 hour | 1 day |
 | `medium` | 🟡 Yellow | Feature partially broken, user workflow impacted, performance issue (non-critical path) | 4 hours | 3 days |
 | `low` | 🟢 Green | Minor bug, cosmetic issue, documentation, question | 1 day | 2 weeks |
+| `trivial` | 🔵 Blue | Very minor fix, typo, extremely low priority | 3 days | 4 weeks |
 
 **Severity Definitions**:
 
@@ -99,6 +100,7 @@ Status indicates where the issue is in its lifecycle. Use exactly one status lab
 | Label | Purpose | Example |
 |---|---|---|
 | `roadmap-qX-YYYY` | Links issue to roadmap phase | `roadmap-q3-2026`, `roadmap-q4-2026` |
+| `stellar-wave` | Links issue to Stellar Wave initiative | Strategic work related to Stellar blockchain |
 | `breaking-change` | Requires major version bump | API signature change |
 | `security` | Security-related (in addition to `area:security`) | Use for visibility |
 | `good-first-issue` | Suitable for new contributors | Small scope, clear requirements |

contracts/vault/src/lib.rs

@@ -388,7 +388,18 @@ pub struct StrategyProposal {
 
 #[contracttype]
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[contracttype]
 /// Pending large withdrawal with 24-hour timelock.
+///
+/// ## Share Price Behavior
+///
+/// The shares recorded here are NOT reserved or priced at request time.
+/// When `execute_withdrawal` is called after the timelock expires, the shares
+/// are converted to assets using the then-current `total_assets` and `total_shares`.
+/// This means the user's effective share price depends on what happens during the
+/// timelock period (yield accrual, deposits, other withdrawals, etc.).
+///
+/// Related: issue #1683
 pub struct PendingWithdrawal {
     pub shares: i128,
     pub unlock_timestamp: u64,
@@ -4251,6 +4262,11 @@ impl YieldVault {
         if threshold <= 0 {
             return Err(VaultError::InvalidDaoThreshold);
         }
+        let total_assets: i128 = env.storage().instance().get(&DataKey::TotalAssets).unwrap_or(0);
+        let max_threshold = total_assets.saturating_mul(95).saturating_div(100);
+        if threshold > max_threshold {
+            return Err(VaultError::InvalidDaoThreshold);
+        }
         env.storage()
             .instance()
             .set(&DataKey::LargeWithdrawalThreshold, &threshold);
@@ -4331,6 +4347,10 @@ impl YieldVault {
         let admin: Address = get_admin(&env).expect("Admin not set");
         admin.require_auth();
         Self::assert_admin_param_interval(&env)?;
+        const MAX_COOLDOWN: u64 = 365 * 24 * 60 * 60;
+        if seconds > MAX_COOLDOWN {
+            return Err(VaultError::InvalidDaoThreshold);
+        }
         let old: u64 = env
             .storage()
             .instance()

cspell.json

@@ -0,0 +1,56 @@
+{
+  "version": "0.2",
+  "language": "en-US",
+  "words": [
+    "Soroban",
+    "Freighter",
+    "yvUSDC",
+    "USDC",
+    "XLM",
+    "Stellar",
+    "blockchain",
+    "smartcontract",
+    "smartcontracts",
+    "testnet",
+    "mainnet",
+    "keypair",
+    "keypairs",
+    "Junirezz",
+    "YieldVault",
+    "RWA",
+    "Rustc",
+    "Wasm",
+    "WASM",
+    "rustup",
+    "pnpm",
+    "typecheck",
+    "SBOM",
+    "SPDX",
+    "CycloneDX",
+    "lockfile",
+    "codeowners",
+    "repo",
+    "Github",
+    "deps",
+    "codeql",
+    "slither",
+    "gitleaks",
+    "clippy",
+    "rustfmt"
+  ],
+  "ignorePaths": [
+    "node_modules",
+    "target",
+    "dist",
+    "build",
+    "*.lock",
+    "*.log",
+    "coverage",
+    ".git"
+  ],
+  "ignoreRegExpList": [
+    "/0x[0-9a-fA-F]+/",
+    "/[A-Z0-9]{56}/",
+    "/G[A-Z0-9]{55}/"
+  ]
+}