[maxiafolabii]

Summary

Deployment preflight, property-based contract tests, and compliance fail-closed coverage

What was solved

#955 — Validate contract admin-key separation during deployment

Add a deployment preflight check that validates separation of invoice, treasury, and compliance admin keys, blocking deployment when keys are reused unless an explicit approved exception is recorded. This is a CI/deployment workflow guard, likely implemented as a script invoked from the deployment workflow plus documentation of the exception mechanism.

Addressed:

• Changed: .github/workflows/ci-post-deploy-verify.yml, .github/workflows/release.yml, artifacts/addresses.json.example, .env.mainnet.example
• Add a deployment preflight that checks invoice, treasury, and compliance admin keys are distinct (documented separation).
• The deployment workflow must block accidental key reuse.
• Allow an explicit, recorded approved exception to bypass the block.

#956 — Add property-based tests for contract state invariants

Add property-based tests to the invoice and treasury Soroban contracts that drive state transitions with generated sequences/inputs, assert core invariants, and persist reproducible seeds on failure.

Addressed:

• Changed: COMEBACKHERE-contracts/contracts/invoice/src/tests.rs, COMEBACKHERE-contracts/contracts/invoice/Cargo.toml
• Add property-based tests exercising invoice state transitions (create/pay/cancel/refund or equivalent) with generated sequences and inputs
• Add property-based tests exercising treasury state transitions (propose/approve/execute settlement, merchant updates) with generated sequences and inputs
• Assert core invariants for both contracts (e.g., terminal states are final, balances/amounts conserved, approval thresholds respected, no invalid transitions)

#957 — Test fail-closed behavior for compliance integration

Add fail-closed tests verifying invoice and payment operations reject safely when the compliance integration is unavailable, malformed, or returns an error, covering both contract-level and backend-level failure modes.

Addressed:

• Changed: COMEBACKHERE-contracts/contracts/invoice/src/tests.rs, COMEBACKHERE-contracts/contracts/invoice/src/test.rs, backend/src/routes/invoices.rs
• Add contract tests (invoice contract) covering compliance unavailable, malformed response, and error-return failure modes for invoice and payment operations
• Add backend tests covering the same three compliance failure modes for invoice and payment operations
• Assert operations fail closed (reject safely) rather than proceeding when compliance cannot be validated

Changes

• .github/workflows/ci-post-deploy-verify.yml (modify)
• .env.mainnet.example (modify)
• COMEBACKHERE-contracts/contracts/invoice/src/test.rs (modify)
• artifacts/addresses.json.example (modify)
• COMEBACKHERE-contracts/contracts/invoice/Cargo.toml (modify)
• .github/workflows/release.yml (modify)
• COMEBACKHERE-contracts/contracts/invoice/src/tests.rs (modify)
• backend/src/routes/invoices.rs (modify)

Approach

1. Validate contract admin-key separation during deployment #955 — Validate contract admin-key separation during deployment (Changed: .github/workflows/ci-post-deploy-verify.yml, .github/workflows/release.yml, artifacts/addresses.json.example, .env.mainnet.example)
2. Add property-based tests for contract state invariants #956 — Add property-based tests for contract state invariants (Changed: COMEBACKHERE-contracts/contracts/invoice/src/tests.rs, COMEBACKHERE-contracts/contracts/invoice/Cargo.toml)
3. Test fail-closed behavior for compliance integration #957 — Test fail-closed behavior for compliance integration (Changed: COMEBACKHERE-contracts/contracts/invoice/src/tests.rs, COMEBACKHERE-contracts/contracts/invoice/src/test.rs, backend/src/routes/invoices.rs)

Issues

Closes #955
Closes #956
Closes #957

[drips-wave]

@maxiafolabii Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits