[nasirudeenbadirudeen87-cloud]

Summary

• Add an immutable constructor map of positive token caps; tokens without a configured cap are rejected.
• Enforce the cap when creating an escrow and add payer-authorized top_up, bounded by the cumulative escrow amount and backed by a balance-delta check.
• Add at-cap, over-cap, missing-cap, and cumulative top-up regression coverage; document the staged rollout and migration in ADR 0006.
• The current testnet deployment predates this constructor and is explicitly documented as uncapped.

Validation: git diff --check passed. Tests/build/install were not run per contributor workflow. The generated TypeScript bindings and SDK topUp wrapper still need regeneration before SDK consumers can use the new surface; no new testnet deployment was made.

Closes #56

[drips-wave]

@nasirudeenbadirudeen87-cloud Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[afeezorobsco-cyber]

@nasirudeenbadirudeen87-cloud

This PR has merge conflicts with main, which has moved on since this branch was created. Please rebase onto the latest main (or merge main into your branch), resolve the conflicts, and push. CI will then re-run, and the PR can be merged once it's conflict-free, CI is green and it's been reviewed. Thanks!

[afeezorobsco-cyber]

@nasirudeenbadirudeen87-cloud Thanks for the PR. It can't be merged yet. To unblock it:

CI is failing. Here's what broke:

Soroban contract (test + wasm build):

test create_escrow_rejects_lying_transfer ... FAILED
test create_escrow_rejects_short_delivery ... FAILED
test reentrant_transfer_cannot_double_release - should panic ... FAILED
error: test failed, to rerun pass `--test malicious_token`

Please fix these errors and run the same steps locally before pushing (npm run typecheck && npm test && npm run build, or cargo test for contracts).

Merge conflicts: this branch conflicts with main. Please rebase onto the latest main (git fetch upstream && git rebase upstream/main), resolve the conflicts (often ROADMAP.md, ARCHITECTURE*.md or prisma/schema.prisma), and force-push.

Push to this same branch and CI will re-run. Once it's green and conflict-free, it'll be reviewed for merge.

[github-actions]

Malware scan: passed, with notes for the reviewer

Nothing malicious was detected in bcc14ae. These changes touch sensitive areas and should get a careful look before CI is approved:

Where	Rule	Why
.github/workflows/sdk-go.yml:165	workflow-change	Changes a CI workflow; a maintainer must review before approving runs.

[github-actions]

@nasirudeenbadirudeen87-cloud This PR now has merge conflicts with main, most likely because #153 (feat(contract): expose version and build provenance) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-escrow.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[afeezorobsco-cyber]

@nasirudeenbadirudeen87-cloud CI is failing on two jobs.

The SDK bindings match contract WASM job fails: sdk/src/generated/contract-client.ts is out of date with the contract. Regenerate it:

cd contracts/escrow
cargo build --target wasm32v1-none --release
stellar contract bindings typescript --wasm target/wasm32v1-none/release/docforum_escrow.wasm --output-dir /tmp/escrow-bindings --overwrite
cp /tmp/escrow-bindings/src/index.ts ../../sdk/src/generated/contract-client.ts

Use stellar CLI 28.1.0, as CI does (see scripts/stellar-cli-version).

The Go SDK integration (local quickstart) job fails when deploying the contract:

ℹ️  Simulating transaction…
❌ error: transaction simulation failed: HostError: Error(Context, InternalError)

The deploy step passes constructor arguments that no longer match __constructor in contracts/escrow/src/lib.rs after merging main. Check every constructor parameter (name, type, and order) against the stellar contract deploy ... -- <args> line in .github/workflows/sdk-go.yml. Main passes this job with --allowed_tokens '[]' only.

Please fix and push.

[zeemscript]

@afeezorobsco-cyber I regenerated sdk/src/generated/contract-client.ts from the current PR contract with the pinned Stellar CLI. ./scripts/check-generated-bindings.sh now passes locally, and the updated head passes the malware scan. GitHub still reports a merge conflict against current main (including lib.rs and generated bindings), so this PR is not mergeable yet; the token-cap change needs to be ported onto the newest contract/storage state.

[nasirudeenbadirudeen87-cloud]

@afeezorobsco-cyber I merged current main and reconciled the immutable per-token cap checks with the current escrow contract. The full contract suite, release WASM build, generated-binding check, and resource-baseline check pass locally. PR #151 is mergeable and its refreshed malware scan passed. Please review the updated branch and the contract version ordering alongside the other pending changes.

[github-actions]

@nasirudeenbadirudeen87-cloud This PR now has merge conflicts with main, most likely because #154 (fix(contract): keep failed releases recoverable) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-escrow.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[afeezorobsco-cyber]

@nasirudeenbadirudeen87-cloud Heads-up: #268 just changed how contract PRs work in this repo. Your PR changes contracts/escrow/src/lib.rs, so CI's new "Contract changes use a fragment, not a version bump" step will fail it until you make these changes (details in contract-changes.d/README.md):

1. Revert your CONTRACT_VERSION change. This branch sets 2.5.0. Leave the line exactly as it is on main (currently 2.3.0). A maintainer bumps it once per batch now, so nobody picks the same "next" version any more.

2. Add a fragment, e.g. contract-changes.d/56-feat-contract-enforce-immutable-per-toke.md:

   bump: minor
   ---
   Issue #56: one-paragraph summary of the contract change.

   Use patch for a behaviour fix with no interface change, minor for new entry points, arguments, events or errors, and major for breaking changes.

3. Switch your new Error codes to provisional ones (issue number × 100 + n). This branch adds TokenCapNotConfigured = 36, AmountCapExceeded = 37; use TokenCapNotConfigured = 5600, AmountCapExceeded = 5601. The fold assigns the final numbers. Don't renumber existing codes.

This should also make your next merge from main much easier: the version line was the one thing every contract PR conflicted on.