Skip to content

feat(contract): emit lifecycle events on create, release, and refund (%239) - #238

Merged
afeezorobsco-cyber merged 1 commit into
DocForum:mainfrom
shakourllahfashola-dev:feat/lifecycle-events-issue-9
Oct 28, 2026
Merged

afeezorobsco-cyber merged 1 commit into
DocForum:mainfrom
shakourllahfashola-dev:feat/lifecycle-events-issue-9

Conversation

@shakourllahfashola-dev

Copy link
Copy Markdown
Contributor

Closes #9

@drips-wave

drips-wave Bot commented Oct 21, 2026

Copy link
Copy Markdown

@shakourllahfashola-dev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@github-actions github-actions Bot added the needs-rebase Has merge conflicts with main; the author needs to rebase label Oct 21, 2026
@github-actions

Copy link
Copy Markdown

@shakourllahfashola-dev This PR now has merge conflicts with main, most likely because #152 (feat(contract): payer cancellation window before the payee accepts) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-escrow.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

Automated message. It won't repeat unless the PR conflicts again after your next push.

@github-actions github-actions Bot removed the needs-rebase Has merge conflicts with main; the author needs to rebase label Oct 22, 2026
@afeezorobsco-cyber

Copy link
Copy Markdown
Contributor

@shakourllahfashola-dev CI is failing on this branch against the latest main, so it can't be merged yet. The errors from the latest run:

Soroban contract (test + wasm build), Reproducible WASM across checkout paths, SDK bindings match contract WASM

error[E0425]: cannot find value `event_destination` in this scope
error[E0425]: cannot find value `escrow_id` in this scope
error[E0425]: cannot find value `payer` in this scope
error[E0425]: cannot find value `destination` in this scope
error[E0423]: expected value, found module `token`
error[E0425]: cannot find value `amount` in this scope
error[E0599]: no associated function or constant named `emit_lifecycle` found for struct `EscrowContract` in the current scope
error: could not compile `docforum-escrow` (lib) due to 8 previous errors; 4 warnings emitted

The contract code references event_destination, escrow_id, payer, destination and token in a scope where none of them exist. A block was probably pasted outside the function it belongs to. Run cargo build in contracts/escrow locally, then regenerate the bindings.

@github-actions github-actions Bot added the needs-rebase Has merge conflicts with main; the author needs to rebase label Oct 24, 2026
@github-actions

Copy link
Copy Markdown

@shakourllahfashola-dev This PR now has merge conflicts with main, most likely because #260 (feat(perf): profile and optimize status reads) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-escrow.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

Automated message. It won't repeat unless the PR conflicts again after your next push.

@shakourllahfashola-dev
shakourllahfashola-dev force-pushed the feat/lifecycle-events-issue-9 branch from 4299948 to b9a1c8d Compare October 25, 2026 23:07
@shakourllahfashola-dev

Copy link
Copy Markdown
Contributor Author

Kindly review.

@github-actions github-actions Bot removed the needs-rebase Has merge conflicts with main; the author needs to rebase label Oct 25, 2026
@afeezorobsco-cyber

Copy link
Copy Markdown
Contributor

@shakourllahfashola-dev After updating this branch with main, CI fails at the new "Require a contract version bump when lib.rs changes" step (added by #153, merged today):

contracts/escrow/src/lib.rs changed without a CONTRACT_VERSION bump

Please bump pub const CONTRACT_VERSION: &str = "..."; in contracts/escrow/src/lib.rs, regenerate anything that changes as a result (test snapshots, SDK bindings), and push. Everything else is green.

@github-actions github-actions Bot added the needs-rebase Has merge conflicts with main; the author needs to rebase label Oct 27, 2026
@github-actions

Copy link
Copy Markdown

@shakourllahfashola-dev This PR now has merge conflicts with main, most likely because #242 (feat(contract): per-token liability accounting and solvency view) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-escrow.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

Automated message. It won't repeat unless the PR conflicts again after your next push.

@afeezorobsco-cyber

Copy link
Copy Markdown
Contributor

@shakourllahfashola-dev Heads-up: #268 just changed how contract PRs work in this repo. Your PR changes contracts/escrow/src/lib.rs, so CI's new "Contract changes use a fragment, not a version bump" step will fail it until you make these changes (details in contract-changes.d/README.md):

  1. Don't edit CONTRACT_VERSION when you merge main (currently 2.3.0). Keep main's line as it is.

  2. Add a fragment, e.g. contract-changes.d/9-feat-contract-emit-lifecycle-events-on-c.md:

    bump: minor
    ---
    Issue #9: one-paragraph summary of the contract change.

    Use patch for a behaviour fix with no interface change, minor for new entry points, arguments, events or errors, and major for breaking changes.

  3. If you add any new Error variants, give them provisional codes (issue number × 100 + n, e.g. 900) and never renumber existing ones.

This should also make your next merge from main much easier: the version line was the one thing every contract PR conflicted on.

…ocForum#9)

Emit minimal lifecycle events on create, release, and refund keyed by escrow_id. Topic is ("ESCROW", action, escrow_id); payload is (payer, destination, token, amount). condition_ref is intentionally omitted per threat model T9. Error paths emit nothing.

Closes DocForum#9
@shakourllahfashola-dev
shakourllahfashola-dev force-pushed the feat/lifecycle-events-issue-9 branch from c2e0f3b to 57cef81 Compare October 28, 2026 18:11

@afeezorobsco-cyber afeezorobsco-cyber left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sweep: malware scan clean, CI green.

@afeezorobsco-cyber
afeezorobsco-cyber merged commit 013c965 into DocForum:main Oct 28, 2026
13 checks passed
freebuff-web Bot pushed a commit to Azintar/docforum-escrow that referenced this pull request Oct 30, 2026
…ts.rs

The merge of main (DocForum#238, lifecycle events) left two jobs failing:

- `sdk/src/generated/contract-client.ts` was hand-mangled: the `/**` that
  opens the `transfer_payee` doc block was lost (TS1131), and the file
  predated the provisional pause error codes. It is now exactly what the
  pinned stellar CLI (28.1.0, scripts/stellar-cli-version) generates from
  the current contract WASM, so "SDK bindings match contract WASM" passes
  too. Never hand-edited.
- main's `contracts/escrow/tests/events.rs` still registered the contract
  with the one-argument constructor, so its 13 tests panicked with
  `Error(WasmVm, InvalidAction)` ("2 expected, got 1"). All five
  `env.register` sites now pass a pause admin, and their snapshots are
  regenerated for the `PauseAdmin`/`Paused` instance entries.

`cargo test` passes for every suite in contracts/escrow (events 13,
pause 23, create_escrow 7, release_refund 8, timeout_refund 17, top_up 3,
cancel 18, payee_acceptance 3, pooled 19, settle_many 13, liabilities 14,
protocol_fee 17, quorum 19, transfer_payee 12, undeliverable 2,
token_allowlist 2, token_edge_cases 1, malicious_token 7,
sponsored_refund 16, releaser_rotation 3, release_callback 6,
time_locked_release 5, model 4).

Generated with Codebuff 🤖
Co-Authored-By: Codebuff <noreply@codebuff.com>
freebuff-web Bot pushed a commit to Azintar/docforum-escrow that referenced this pull request Oct 30, 2026
Brings in DocForum#238 (lifecycle events) and DocForum#270, the contract-change fold that
bumped CONTRACT_VERSION to 2.4.0 and renumbered main's provisional
`InvalidNewPayee` from 4500 to 37.

The only conflict was sdk/src/generated/contract-client.ts, resolved as the
repo requires: regenerated from the merged contract WASM with the pinned
stellar CLI 28.1.0 (scripts/stellar-cli-version), never hand-merged. The
contract-changes.d and changelog.d fragments that DocForum#270 folded are dropped;
this PR's own 35-emergency-pause fragments stay, and the pause error codes
stay provisional (3500-3502) for the next fold.

Generated with Codebuff 🤖
Co-Authored-By: Codebuff <noreply@codebuff.com>
afeezorobsco-cyber added a commit that referenced this pull request Oct 31, 2026
* feat(contract): add a deposit-only emergency pause (ADR 0005)

There was no on-chain way to slow down a live bug: the only defence was
telling integrators to stop. This adds a narrow lever instead — a single
custodian set by the contract's constructor can block `create_escrow` and
nothing else, so new exposure stops while every existing escrow can still
be released, refunded, or timeout-refunded. Blocking outbound paths would
have turned a possible loss into a certain lock, which is why the pause
deliberately does not read the flag there (and the 16 new tests prove it).

Records the decision in ADR 0005, adds the role to the threat model (T11,
invariant I6), and regenerates/bumps the SDK to 0.4.0 for the new
pause/unpause/is_paused/get_pause_admin surface.

Closes #35

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>

* feat(contract): add a deposit-only emergency pause (ADR 0011)

Adds a constructor-set custodian that can pause every deposit path
(create_escrow and its variants, plus top_up) and nothing else, so new
exposure stops while existing escrows can still be released, refunded or
timeout-refunded. Pause/unpause are custodian-only, non-idempotent, and emit
Paused/Unpaused events; is_paused/get_pause_admin are read-only.

Rebased onto current main: the constructor is merged with the existing
token allowlist (__constructor(allowed_tokens, pause_admin)), top_up is
gated as the ADR requires of any deposit path, error codes are 26-28 to
avoid colliding with existing codes, and the ADR is renumbered to 0011 so
it does not clash with the protocol-fee ADR.

* fix: reconcile emergency pause with pooled escrows from main

The last merge of main (#257 pooled escrows, #193/#248 SDK work) left the
branch broken:

- contract: `DataKey::Pooled`/`Contribution` had been spliced into the
  `Unpaused` event struct; restore them to `DataKey`.
- contract: `Paused`/`AlreadyPaused`/`NotPaused` collided with
  `NotPooled`/`FundingDeadlinePassed`/`FundingTargetReached` (26-28).
  Main's codes keep their on-chain values; the pause codes are appended
  as 35/36/37 (docs, ADR 0011, README, threat model, ROADMAP, changelog
  updated).
- contract: gate the new pooled deposit paths (`create_pooled_escrow`,
  `contribute`) on the pause; `claim_refund` and `release` stay ungated.
  Three new tests in tests/pause.rs cover this.
- tests: main's new tests (cancel, pooled, model, malicious_token)
  registered the contract with the old one-argument constructor; pass a
  pause admin. Snapshots regenerated with `cargo test`.
- sdk: regenerate src/generated/contract-client.ts with the pinned
  stellar CLI 28.1.0 (it contained a broken hand merge); close the
  unterminated `getPauseAdmin` method in src/index.ts; drop the duplicate
  `test:unit` script key in package.json.
- ci: the Go SDK local-network deploy passes `--pause_admin`.

* ci(sdk-go): pin stellar/quickstart to the digest main last passed with

The 2026-10-26 quickstart:latest (core/RPC v30) fails the pinned Stellar
CLI 28.1.0's first simulation, `stellar contract asset deploy --asset
native`, with HostError: Error(Context, InternalError). It fails the same
way on unrelated PRs, before the escrow contract (and its constructor
args, which match __constructor(allowed_tokens, pause_admin)) is touched.
Pin to the digest from main's last green run (39607326690).

* test(fuzz): seed lifecycle corpus with the pause-admin constructor crash

CI's cargo-fuzz crash (input AQEAAAgBAA==, [1, 1, 0, 0, 8, 1, 0]) was the
harness registering the escrow with main's one-argument constructor; every
input hit 'invalid number of input arguments: 2 expected, got 1'. The
harness now passes (allowed_tokens, pause_admin). Keeping the input in the
corpus replays it on every PR and nightly run.

* chore: bump CONTRACT_VERSION to 2.1.0

Emergency pause is a backward-compatible feature on top of 2.0.0 (#209). Satisfies the CI rule requiring a CONTRACT_VERSION bump whenever contracts/escrow/src/lib.rs changes.

* chore: bump CONTRACT_VERSION to 2.2.0

main is now at 2.1.0 (#242), so the PR head must move past it for the
'Require a contract version bump when lib.rs changes' CI check.

* fix(sdk-go): send fee_recipient/fee_bps on create_escrow and create_escrow_release_time

#209 added two optional trailing args (fee_recipient, fee_bps) to
create_escrow and create_escrow_release_time. The Go SDK still sent the old
argument count, so the integration job failed with
Error(WasmVm, UnexpectedSize) / MismatchingParameterLen. Send None for both
(no protocol fee) until the Go SDK exposes the fee; create_escrow_with_releasers
is unchanged.

* test(releaser-account): refresh snapshot for per-token liability entry (#242)

* feat(contract): settle_many is never blocked by the emergency pause; bump to 2.3.0

Follow-up to the upstream main merge (#254). Per ADR 0011 the pause stops new
deposits only and never blocks outbound paths, so settle_many's release and
refund ops ignore the pause flag exactly like single release/refund
(invariant I8). Documents this in lib.rs, README and the threat model, adds
pause tests showing settle_many release, refund and a mixed batch all succeed
while paused (with their snapshots), bumps CONTRACT_VERSION to 2.3.0 (main
is 2.2.0) and applies cargo fmt.

* fix(contract): repair the merge of main that broke the emergency pause

The last merge of main (#169/#199) left the branch uncompilable and its
tests failing:

- `Error` lost `Paused`, `AlreadyPaused` and `NotPaused` while `lib.rs`
  still returns them (E0599). Re-added with the provisional codes
  3500-3502 that contract-changes.d/README.md asks for, since main already
  spent 35 (`InvalidFee`) and 36 (`Undeliverable`); the maintainer fold
  assigns the final numbers. README, ADR 0011, ROADMAP, the threat model
  and the changelog fragment no longer claim 36-38.
- `use soroban_sdk::{...}` was spliced into itself, so every imported name
  was defined twice (E0252).
- main's newer `tests/transfer_payee.rs` and `tests/undeliverable.rs`
  still registered the contract with the old one-argument constructor, so
  all 14 of their tests panicked ("invalid number of input arguments: 2
  expected, got 1"). They now pass a pause admin and their snapshots are
  regenerated.
- Added the required `contract-changes.d/35-emergency-pause.md` fragment
  (`bump: minor`); `CONTRACT_VERSION` stays at main's 2.3.0, as the new CI
  rule requires.

`cargo test` passes for every suite in contracts/escrow (pause 23,
create_escrow 7, release_refund 8, timeout_refund 17, top_up 3, cancel 18,
payee_acceptance 3, pooled 19, settle_many 13, liabilities 14,
protocol_fee 17, quorum 19, transfer_payee 12, undeliverable 2,
token_allowlist 2, token_edge_cases 1, malicious_token 7,
sponsored_refund 16, releaser_rotation 3, release_callback 6,
time_locked_release 5, model 4).

Generated with Codebuff 🤖
Co-Authored-By: Codebuff <noreply@codebuff.com>

* fix(sdk,contract): regenerate bindings and pass a pause admin in events.rs

The merge of main (#238, lifecycle events) left two jobs failing:

- `sdk/src/generated/contract-client.ts` was hand-mangled: the `/**` that
  opens the `transfer_payee` doc block was lost (TS1131), and the file
  predated the provisional pause error codes. It is now exactly what the
  pinned stellar CLI (28.1.0, scripts/stellar-cli-version) generates from
  the current contract WASM, so "SDK bindings match contract WASM" passes
  too. Never hand-edited.
- main's `contracts/escrow/tests/events.rs` still registered the contract
  with the one-argument constructor, so its 13 tests panicked with
  `Error(WasmVm, InvalidAction)` ("2 expected, got 1"). All five
  `env.register` sites now pass a pause admin, and their snapshots are
  regenerated for the `PauseAdmin`/`Paused` instance entries.

`cargo test` passes for every suite in contracts/escrow (events 13,
pause 23, create_escrow 7, release_refund 8, timeout_refund 17, top_up 3,
cancel 18, payee_acceptance 3, pooled 19, settle_many 13, liabilities 14,
protocol_fee 17, quorum 19, transfer_payee 12, undeliverable 2,
token_allowlist 2, token_edge_cases 1, malicious_token 7,
sponsored_refund 16, releaser_rotation 3, release_callback 6,
time_locked_release 5, model 4).

Generated with Codebuff 🤖
Co-Authored-By: Codebuff <noreply@codebuff.com>

* fix(sdk): regenerate bindings with the pinned Rust toolchain

The bindings committed with the merge were generated from a WASM built
with the sandbox's stable Rust (1.99), but the repo pins 1.96 in
rust-toolchain.toml and CI builds with it. The compiler changes the
order of the ContractSpec entries in the WASM, so the committed file
had the PayeeRefunded event spec in a different slot than CI's
regeneration and "SDK bindings match contract WASM" failed.

Rebuilt the WASM with the pinned 1.96.0 toolchain and regenerated with
stellar CLI 28.1.0 as scripts/check-generated-bindings.sh does, so the
diff is only that one entry moving; the script now reports OK.

Generated with Codebuff 🤖
Co-Authored-By: Codebuff <noreply@codebuff.com>

---------

Co-authored-by: Codebuff Agent <noreply@codebuff.com>
Co-authored-by: Azintar <Azintar@users.noreply.github.com>
Co-authored-by: Azintar <342361479+Azintar@users.noreply.github.com>
Co-authored-by: afeez <afeezorobsco@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs-rebase Has merge conflicts with main; the author needs to rebase

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Phase E4] Emit created / released / refunded events

2 participants