Events 2.0.0 and profile 1.2.1: audit hardening (includes #120 and #165)

.env.deploy.example

@@ -1,21 +1,16 @@
-# Deployment configuration for the Boundless contracts.
-# Copy to .env.deploy before running scripts/deploy/deploy.sh.
+# Deployment configuration for scripts/deploy/deploy.sh (testnet, futurenet).
+# Copy to .env.deploy before running it.
 #
 # .env.deploy is gitignored (see .gitignore). NEVER commit a populated file.
 
-# Stellar CLI identity that owns the admin authority on both contracts.
+# Stellar CLI identity that deploys both contracts and holds admin on them.
 # Create with: stellar keys generate <name> --network testnet --fund
 ADMIN_IDENTITY=boundless-admin
 
-# G-address that receives the platform fee on every deposit.
-# In production this should be a multi-sig account with the platform's
-# operational threshold; testnet can be a single-key account.
+# G-address that receives the platform fee on every deposit. It needs an
+# authorized trustline for every token you register.
 FEE_ACCOUNT=
 
-# Platform fee in basis points (100 = 1%, 250 = 2.5%, etc.). Range 0..1000.
-# Contract caps at 1000 (10%) per audit L4 (2026-06 Stellar-skill audit).
+# Platform fee in basis points (100 = 1%, 250 = 2.5%). Range 0..1000; the
+# contract caps fees at 1000 (10%).
 FEE_BPS=250
-
-# Contract 1.0.0 also required BOOTSTRAP_CREDITS here. The 1.1.0
-# credit-removal upgrade (2026-06) moved credits to an off-chain ledger in
-# boundless-nestjs; the profile constructor now takes only --admin.

.github/actions/setup-rust-stellar/action.yml

@@ -18,10 +18,10 @@ runs:
 
     - name: Install Stellar CLI
       run: |
-        STELLAR_VERSION="27.0.0"
+        STELLAR_VERSION="28.1.0"
         STELLAR_TAR="stellar-cli-${STELLAR_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
-        # Official SHA-256 from https://github.com/stellar/stellar-cli/releases/tag/v27.0.0
-        STELLAR_SHA256="357bf712f6353c28cd33c794402a3c87231757a5b305e6ef1604365af4fdd556"
+        # Official SHA-256 from https://github.com/stellar/stellar-cli/releases/tag/v28.1.0
+        STELLAR_SHA256="c1680deee94301d33ada7a17f98411e642a4248c727afbd2e43050d345746462"
 
         wget -q "https://github.com/stellar/stellar-cli/releases/download/v${STELLAR_VERSION}/${STELLAR_TAR}"
 

.github/workflows/verify-build.yml

@@ -12,9 +12,11 @@ on:
       - 'Cargo.lock'
       - 'rust-toolchain.toml'
       - 'deploy_mainnet.sh'
+      - 'deploy_and_upgrade.sh'
       - 'scripts/**'
       - '.github/actions/setup-rust-stellar/**'
       - '.github/workflows/verify-build.yml'
+      - '.github/workflows/rustfmt.yml'
   # Use pull_request (not pull_request_target): the check must run the workflow
   # from the PR head so branch-filter changes take effect on the PR itself, and
   # the build/test job needs no secrets, so the pull_request_target foot-gun
@@ -31,6 +33,7 @@ on:
       - 'Cargo.lock'
       - 'rust-toolchain.toml'
       - 'deploy_mainnet.sh'
+      - 'deploy_and_upgrade.sh'
       - 'scripts/**'
       - '.github/actions/setup-rust-stellar/**'
       - '.github/workflows/verify-build.yml'
@@ -56,16 +59,32 @@ jobs:
       - name: Check release script syntax
         run: |
           bash -n deploy_mainnet.sh
+          bash -n deploy_and_upgrade.sh
           bash -n scripts/capture-mainnet-compat-snapshot.sh
-          bash -n scripts/test-sdk27-compat.sh
+          bash -n scripts/test-storage-compat.sh
+          bash -n scripts/build-release.sh
           bash -n scripts/test-mainnet-upgrade-guards.sh
           bash -n scripts/testdata/mock-stellar
+          bash -n scripts/lib/deploy-env.sh
+          bash -n scripts/deploy/deploy.sh
+          bash -n scripts/deploy/register_token.sh
+          bash -n scripts/deploy/verify.sh
+          bash -n scripts/admin/verify-multisig.sh
+          bash -n scripts/admin/verify-fee-trustline.sh
+          bash -n scripts/check-versions.sh
+          bash -n scripts/test-admin-scripts.sh
+
+      - name: Check contract versions agree
+        run: ./scripts/check-versions.sh
+
+      - name: Verify admin pre-flight checks
+        run: ./scripts/test-admin-scripts.sh
 
       - name: Verify mainnet upgrade guards
         run: ./scripts/test-mainnet-upgrade-guards.sh
 
       - name: Build contracts reproducibly
-        run: stellar contract build --locked
+        run: ./scripts/build-release.sh
 
       - name: Check WASM sizes (64 KB ceiling)
         run: |
@@ -79,10 +98,11 @@ jobs:
             fi
           done
 
-      - name: Verify SDK 23 to SDK 27 storage compatibility
-        env:
-          VERIFY_SDK27_BUILD: "1"
-        run: ./scripts/test-sdk27-compat.sh
+      - name: Replay the mainnet upgrade against this build
+        run: ./scripts/test-storage-compat.sh
+
+      - name: Lint
+        run: cargo clippy --locked --all-targets -- -D warnings
 
       - name: Run tests
         run: cargo test --release

.gitignore

@@ -9,6 +9,12 @@ target
 .env.deploy
 deployments/
 
+# Multisig envelopes in flight. Their sequence numbers are spent once submitted.
+signing/
+
 # Soroban test snapshots: derived artifacts, regenerated by `cargo test`.
-# Not committed — snapshot diffs dwarf source diffs and blind the PR scanners.
+# Not committed: snapshot diffs dwarf source diffs and blind the PR scanners.
 test_snapshots/
+
+# Script dependencies
+node_modules/