New features

.github/workflows/contract.yml

@@ -52,13 +52,13 @@ jobs:
           stellar contract build
 
       - name: Run contract test suite (flat weight fixture)
-        run: ACCORD_WEIGHT_FIXTURE=flat cargo test -- --nocapture
+        run: ACCORD_WEIGHT_FIXTURE=flat cargo test --locked -- --nocapture
 
       - name: Run contract test suite (skewed weight fixture)
-        run: ACCORD_WEIGHT_FIXTURE=skewed cargo test -- --nocapture
+        run: ACCORD_WEIGHT_FIXTURE=skewed cargo test --locked -- --nocapture
 
       - name: Run RBAC tests
-        run: cargo test -- rbac -- --nocapture
+        run: cargo test --locked -- rbac -- --nocapture
 
       - name: Generate wasm-manifest.json
         run: |
@@ -210,7 +210,7 @@ jobs:
 
       - name: Measure contract coverage
         run: |
-          cargo llvm-cov -p accord --lib --no-report --ignore-run-fail \
+          cargo llvm-cov --locked -p accord --lib --no-report --ignore-run-fail \
             --ignore-filename-regex '(test|bench)\.rs$'
 
       - name: Write coverage reports
@@ -262,7 +262,7 @@ jobs:
           cache: true
 
       - name: Run resource benchmarks
-        run: cargo test -p accord --lib bench_hot_entrypoints -- --nocapture
+        run: cargo test --locked -p accord --lib bench_hot_entrypoints -- --nocapture
 
       - name: Report benchmark deltas
         if: always()

.github/workflows/indexer-analytics.yml

@@ -136,12 +136,12 @@ jobs:
         run: cargo fmt -p accord-analytics-api -- --check
 
       - name: Run Clippy
-        run: cargo clippy -p accord-analytics-api --all-targets -- -D warnings
+        run: cargo clippy --locked -p accord-analytics-api --all-targets -- -D warnings
 
       - name: Run API tests
         env:
           TEST_DATABASE_URL: postgres://accord:accord@localhost:5432/accord_analytics_test
-        run: cargo test -p accord-analytics-api
+        run: cargo test --locked -p accord-analytics-api
 
       - name: Verify the OpenAPI spec is valid JSON
         run: node -e "const s = JSON.parse(require('fs').readFileSync('docs/analytics-api.openapi.json', 'utf8')); if (s.openapi !== '3.0.3' || !Object.keys(s.paths).length) process.exit(1)"
@@ -151,4 +151,4 @@ jobs:
         # spec is reported by name rather than buried in the test output.
         env:
           TEST_DATABASE_URL: postgres://accord:accord@localhost:5432/accord_analytics_test
-        run: cargo test -p accord-analytics-api openapi
+        run: cargo test --locked -p accord-analytics-api openapi

.github/workflows/launch-checklist.yml

@@ -0,0 +1,22 @@
+name: Launch checklist
+
+on:
+  pull_request:
+    paths:
+      - launch/**
+      - scripts/check-mainnet-checklist.mjs
+      - .github/workflows/launch-checklist.yml
+
+permissions:
+  contents: read
+
+jobs:
+  structure:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 20
+      - run: node scripts/check-mainnet-checklist.mjs --structure

.github/workflows/nightly.yml

@@ -37,13 +37,13 @@ jobs:
           target: wasm32v1-none
 
       - name: Run contract test suite (flat weight fixture)
-        run: ACCORD_WEIGHT_FIXTURE=flat cargo test -p accord -- --nocapture
+        run: ACCORD_WEIGHT_FIXTURE=flat cargo test --locked -p accord -- --nocapture
 
       - name: Run contract test suite (skewed weight fixture)
-        run: ACCORD_WEIGHT_FIXTURE=skewed cargo test -p accord -- --nocapture
+        run: ACCORD_WEIGHT_FIXTURE=skewed cargo test --locked -p accord -- --nocapture
 
       - name: Run RBAC tests
-        run: cargo test -p accord -- rbac -- --nocapture
+        run: cargo test --locked -p accord -- rbac -- --nocapture
 
   frontend:
     name: "Frontend: unit tests & coverage"
@@ -151,12 +151,12 @@ jobs:
         run: cargo fmt -p accord-analytics-api -- --check
 
       - name: Run Clippy
-        run: cargo clippy -p accord-analytics-api --all-targets -- -D warnings
+        run: cargo clippy --locked -p accord-analytics-api --all-targets -- -D warnings
 
       - name: Run API tests
         env:
           TEST_DATABASE_URL: postgres://accord:accord@localhost:5432/accord_analytics_test
-        run: cargo test -p accord-analytics-api
+        run: cargo test --locked -p accord-analytics-api
 
   e2e:
     name: "Frontend: E2E (Playwright)"

.github/workflows/release.yml

@@ -46,13 +46,13 @@ jobs:
           target: wasm32v1-none
 
       - name: Run contract test suite (flat weight fixture)
-        run: ACCORD_WEIGHT_FIXTURE=flat cargo test -p accord -- --nocapture
+        run: ACCORD_WEIGHT_FIXTURE=flat cargo test --locked -p accord -- --nocapture
 
       - name: Run contract test suite (skewed weight fixture)
-        run: ACCORD_WEIGHT_FIXTURE=skewed cargo test -p accord -- --nocapture
+        run: ACCORD_WEIGHT_FIXTURE=skewed cargo test --locked -p accord -- --nocapture
 
       - name: Run RBAC tests
-        run: cargo test -p accord -- rbac -- --nocapture
+        run: cargo test --locked -p accord -- rbac -- --nocapture
 
   frontend-tests:
     name: "Gate: frontend tests"
@@ -122,9 +122,31 @@ jobs:
   # ---------------------------------------------------------------------------
   # Build the contract artifact + manifest and publish the GitHub Release.
   # ---------------------------------------------------------------------------
+  mainnet-checklist:
+    name: "Gate: mainnet launch checklist"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: "22"
+
+      # Tags with a pre-release suffix (v1.0.0-rc.1) only get a structure check;
+      # any other v* tag is a mainnet release and needs a complete, signed-off checklist.
+      - name: Enforce launch checklist
+        run: |
+          if [[ "$GITHUB_REF_NAME" == *-* ]]; then
+            node scripts/check-mainnet-checklist.mjs --structure
+          else
+            node scripts/check-mainnet-checklist.mjs --release "$GITHUB_REF_NAME"
+          fi
+
   release:
     name: Build artifact & publish release
-    needs: [contract-tests, frontend-tests, indexer-tests]
+    needs: [contract-tests, frontend-tests, indexer-tests, mainnet-checklist]
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -218,7 +240,7 @@ jobs:
   # ---------------------------------------------------------------------------
   publish-sdk:
     name: Publish SDK to GitHub Packages
-    needs: [contract-tests, frontend-tests, indexer-tests]
+    needs: [contract-tests, frontend-tests, indexer-tests, mainnet-checklist]
     runs-on: ubuntu-latest
     defaults:
       run:

.github/workflows/security.yml

@@ -31,9 +31,13 @@ jobs:
 
       - name: Install gitleaks
         run: |
-          curl -sSfL \
-            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
-            | tar -xz -C "$RUNNER_TEMP" gitleaks
+          base="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}"
+          archive="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          curl -sSfL -o "$RUNNER_TEMP/$archive" "$base/$archive"
+          curl -sSfL -o "$RUNNER_TEMP/checksums.txt" "$base/gitleaks_${GITLEAKS_VERSION}_checksums.txt"
+          # Provenance: refuse a binary that does not match the published checksum.
+          (cd "$RUNNER_TEMP" && grep " $archive\$" checksums.txt | sha256sum -c -)
+          tar -xzf "$RUNNER_TEMP/$archive" -C "$RUNNER_TEMP" gitleaks
           echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
           "$RUNNER_TEMP/gitleaks" version
 

.github/workflows/supply-chain.yml

@@ -0,0 +1,101 @@
+name: Supply-chain policy
+
+# Enforces docs/SUPPLY_CHAIN_POLICY.md. pull_request_review re-runs only the
+# exception-review gate when a review lands.
+on:
+  pull_request:
+  pull_request_review:
+    types: [submitted, dismissed]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  policy:
+    name: Pinning policy
+    if: github.event_name != 'pull_request_review'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 20
+      - name: Check lockfiles, sources, action pins and exceptions
+        run: node scripts/check-supply-chain.mjs
+
+  npm-provenance:
+    name: npm provenance (${{ matrix.dir }})
+    if: github.event_name != 'pull_request_review'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        dir: [frontend, indexer]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 20
+      - name: Install from the lockfile without running install scripts
+        working-directory: ${{ matrix.dir }}
+        run: npm ci --ignore-scripts
+      - name: Verify registry signatures and provenance attestations
+        working-directory: ${{ matrix.dir }}
+        run: npm audit signatures
+
+  cargo-sources:
+    name: Cargo sources and lockfile
+    if: github.event_name != 'pull_request_review'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions-rust-lang/setup-rust-toolchain@v2
+      - name: Lockfile is complete and up to date
+        run: cargo metadata --locked --format-version 1 > /dev/null
+      - name: Install cargo-deny
+        run: cargo install cargo-deny --locked
+      - name: Only crates.io is an allowed source
+        run: cargo deny check sources
+
+  exception-review:
+    name: Exception changes need an approving review
+    if: github.event_name != 'push'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: actions/github-script@v9
+        with:
+          script: |
+            const pr = context.payload.pull_request;
+            const watched = ['supply-chain/exceptions.json', 'scripts/check-supply-chain.mjs'];
+            const files = await github.paginate(github.rest.pulls.listFiles, {
+              ...context.repo, pull_number: pr.number, per_page: 100,
+            });
+            const touched = files.map((f) => f.filename).filter((f) => watched.includes(f));
+            if (touched.length === 0) {
+              core.info('No supply-chain exception or policy changes.');
+              return;
+            }
+            const reviews = await github.paginate(github.rest.pulls.listReviews, {
+              ...context.repo, pull_number: pr.number, per_page: 100,
+            });
+            // Latest decisive review per reviewer wins; the author cannot approve their own change.
+            const latest = new Map();
+            for (const r of reviews) {
+              if (r.user.login !== pr.user.login && ['APPROVED', 'CHANGES_REQUESTED', 'DISMISSED'].includes(r.state)) {
+                latest.set(r.user.login, r.state);
+              }
+            }
+            const approved = [...latest.values()].includes('APPROVED');
+            const blocked = [...latest.values()].includes('CHANGES_REQUESTED');
+            if (!approved || blocked) {
+              core.setFailed(`${touched.join(', ')} changed: needs an approving review from someone other than the author.`);
+            }