Repository navigation
feat(control-plane): wire treasury, burn, emergency recovery, and governed upgrade entrypoints (closes #178) - #233
Open
ranjeet150 wants to merge 1 commit into
Conversation
…erned upgrade entrypoints (closes Vero-protocol#178) - Expose role-gated wrapper entrypoints in ControlPlane for emergency recovery (init_recovery, request_recovery, approve_recovery, pending_recovery_approvals). - Expose role-gated wrapper entrypoints for treasury outflow timelocking and snapshots (init_treasury, schedule_outflow, execute_outflow, record_snapshot, get_outflow, get_snapshot, get_latest_snapshot). - Expose burn safety entrypoints (burn_to, reject_zero_address) with admin authorization and Stellar zero-address rejection. - Expose governed contract upgrade entrypoint (governed_upgrade) gated behind multi-sig proposal approval and timelock, avoiding symbol collision with UpgradeableProxy::upgrade. - Add comprehensive integration tests verifying each flow through ControlPlaneClient with 100% pass rate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #178
Exposes role-gated contract entrypoints on
ControlPlaneforemergency_recovery,treasury,burn, and governance-gatedupgrademodules. Previously, production contracts never wired into these four fully-implemented security modules, leaving emergency fund-recovery, treasury outflow timelocking, burn safety checks, and governance-gated upgrades unreachable from deployed WASM binaries.Key Changes
Emergency Recovery Entrypoints (
engine-core/src/core/control_plane.rs):init_recovery(caller, admins, threshold): Reentrancy-guarded, admin-authorized initialization of multi-sig emergency recovery admins and threshold.request_recovery(requester, token, dest, amount): Authorized emergency recovery admin initiates fund recovery request.approve_recovery(admin): Authorized admin approves pending recovery request.pending_recovery_approvals(): Read-only query of pending recovery approvals.Treasury & Outflow Time-Locking Entrypoints (
engine-core/src/core/control_plane.rs):init_treasury(caller, admin): Reentrancy-guarded initialization configuring treasury administrator.schedule_outflow(caller, outflow_id, amount): Queues treasury outflow behind the mandatory 24-hour time-lock.execute_outflow(caller, outflow_id): Executes outflow strictly after timelock expiration.record_snapshot(caller, total_balance, account_count, trigger, context): Records immutable treasury state snapshot with SHA-256 verification.get_outflow(outflow_id),get_snapshot(snapshot_id),get_latest_snapshot(): Query accessors for outflows and snapshots.Burn Safety Entrypoints (
engine-core/src/core/control_plane.rs):burn_to(caller, to, amount): Reentrancy-guarded, admin-authorized burn transfer validating non-zero amounts and rejecting the Stellar zero address.reject_zero_address(to): Pure preflight validation againstGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWHF.Governed Contract Upgrade Entrypoint (
engine-core/src/core/control_plane.rs):governed_upgrade(proposal_id, new_wasm_hash): Executes contract upgrade only after multi-sig governance proposal approval and timelock completion.governed_upgradeto avoid symbol collision withUpgradeableProxy::upgradewhen buildingcdylibWASM target.Comprehensive Integration Test Suite (
engine-core/src/core/tests.rs):test_control_plane_emergency_recovery_flow: End-to-end multi-sig recovery lifecycle viaControlPlaneClient.test_control_plane_treasury_outflow_and_snapshot_flow: Outflow scheduling, timelock boundary enforcement, and snapshot recording viaControlPlaneClient.test_control_plane_burn_flow: Zero-address rejection and unauthorized caller rejection viaControlPlaneClient.test_control_plane_governed_upgrade_flow: Governance proposal lifecycle, quorum threshold, hash verification, and upgrade execution viaControlPlaneClient.Verification
cargo build --target wasm32-unknown-unknown --release: 100% clean build (generated 124KBengine_core.wasmand 6.8KBvero_audit_guard.wasm).cargo test: 100/100 tests passed inengine-core, 3/3 tests passed invero-audit-guard.cargo clippy --all-targets -- -D warnings: Clean, 0 warnings.cargo fmt --all -- --check: 100% compliant.bash scripts/check-security-md.sh: Passed.