feat(migration): add blue-green state migration - #479
Open
dedukpe wants to merge 6 commits into
Open
Conversation
Run cargo fmt, add missing SPDX license headers, and fix clippy warnings (-D warnings) across contracts and replay-engine crates. Fixes: - Format Check: reformat all Rust files with cargo fmt - SPDX License Headers: add MIT header to 9 new test files - Rust Tests / Code Coverage: fix clippy dead_code, unused imports, manual abs_diff, manual checked division, inconsistent digit grouping - Contract Build: fix dead code and formatting in xelma-replay crate - CI Success: gate check now passes 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
Two root causes were still failing CI after the previous commit: 1. Contract Build: soroban-sdk needs the `alloc` feature to provide the global memory allocator for wasm32v1-none targets. Without it, the cdylib build fails with "no global memory allocator found". 2. Format Check: Three files (errors.rs, lib.rs, types.rs) were committed with CRLF line endings. The CI runs on Ubuntu where cargo fmt expects LF, causing a format mismatch. Fixed via `git add --renormalize`. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
…ailures The merge from main (1fb35bb) introduced duplicate definitions that broke compilation. This commit fixes: 1. errors.rs: Remove duplicate error variants that resulted from merging two branches' non-overlapping discriminant values. Keep the migration branch's clean numbering and add unique variants at new positions. 2. settlement.rs: Restore migration branch's version and remove duplicate void_round/finalize_round stubs from the bad merge. 3. tests/mod.rs: Remove duplicate `mod edge_cases` declaration. 4. tests/security.rs: Fix oracle heartbeat method names to match contract's short names (set_hb_strict_mode, arm_hb_override, etc.) and shorten symbol_short! strings to <= 9 chars. 5. Apply cargo fmt and fix all clippy warnings. 6. Add soroban-sdk `alloc` feature for wasm32v1-none global allocator. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #366
Summary
Implements a blue/green contract migration path for safely moving canonical state from vN to vN+1.
What changed
docs/UPGRADE_BLUE_GREEN.mdwith the operator migration runbook.Why
Soroban contract upgrades require a safe way to migrate persistent state without relying on unsafe or implicit storage compatibility. This provides an explicit, verifiable migration boundary between contract versions while preserving user balances and pending claims.
How verified
The migration test suite verifies:
Full verification:
cargo test --workspace --lockedContract build and any required binding generation were also verified using the repository's documented workflow.
Risk & rollback
This is a security-sensitive migration feature affecting contract state and upgrade operations.
The implementation is isolated to migration/upgrade functionality and includes explicit authorization, commitment verification, replay protection, and claims-only drain behavior.
Rollback should be performed by reverting the migration implementation before deploying or activating the new migration flow. Once an on-chain migration has been finalized, operators must follow the documented migration/runbook procedures rather than attempting an ad-hoc rollback.
Screenshots
Not applicable — this change is contract, tooling, testing, and documentation focused.