Merge main into PR 1064

Author: nanaf6203-bit

.github/workflows/nightly-security-audit.yml

@@ -45,36 +45,54 @@ jobs:
           echo "---" >> AUDIT_LOG.md
 
       - name: Execute Cargo Deny Checks
+        id: deny
         run: |
           echo "## 📦 Dependency License & Advisory Checks (cargo-deny)" >> AUDIT_LOG.md
           echo "\`\`\`text" >> AUDIT_LOG.md
-          cargo deny check licenses bans sources 2>&1 >> AUDIT_LOG.md || echo "cargo-deny failed or flagged warnings" >> AUDIT_LOG.md
+          if cargo deny check licenses bans sources 2>&1 | tee -a AUDIT_LOG.md; then
+            echo "deny_exit=0" >> "$GITHUB_OUTPUT"
+          else
+            echo "deny_exit=$?" >> "$GITHUB_OUTPUT"
+            echo "::warning::cargo-deny flagged warnings or errors (see AUDIT_LOG.md)"
+          fi
           echo "\`\`\`" >> AUDIT_LOG.md
           echo "---" >> AUDIT_LOG.md
 
       - name: Execute Cargo Audit Sweeps
+        id: audit
         run: |
           echo "## 🔍 Vulnerability Advisory Scans (cargo-audit)" >> AUDIT_LOG.md
           echo "\`\`\`text" >> AUDIT_LOG.md
-          cargo audit 2>&1 >> AUDIT_LOG.md || echo "cargo-audit detected critical vulnerability markers" >> AUDIT_LOG.md
+          set +e
+          cargo audit 2>&1 | tee -a AUDIT_LOG.md
+          AUDIT_EXIT=$?
+          set -e
           echo "\`\`\`" >> AUDIT_LOG.md
           echo "---" >> AUDIT_LOG.md
+          if [ "$AUDIT_EXIT" -ne 0 ]; then
+            echo "::error::cargo-audit found vulnerabilities (exit code $AUDIT_EXIT). See AUDIT_LOG.md for details."
+            echo "audit_exit=$AUDIT_EXIT" >> "$GITHUB_OUTPUT"
+          else
+            echo "audit_exit=0" >> "$GITHUB_OUTPUT"
+          fi
 
-      - name: Mutants Gate — lending
+      - name: Mutants Gate — propchain-lending
         run: |
           set -o pipefail
           echo "## 🧬 Mutation Gate: lending" >> AUDIT_LOG.md
           echo "\`\`\`text" >> AUDIT_LOG.md
-          cargo mutants -p lending --timeout 120 2>&1 | tee -a AUDIT_LOG.md
+          cargo mutants -p propchain-lending --timeout 120 2>&1 | tee -a AUDIT_LOG.md
           echo "\`\`\`" >> AUDIT_LOG.md
+          echo "---" >> AUDIT_LOG.md
 
-      - name: Mutants Gate — bridge
+      - name: Mutants Gate — propchain-bridge
         run: |
           set -o pipefail
           echo "## 🧬 Mutation Gate: bridge" >> AUDIT_LOG.md
           echo "\`\`\`text" >> AUDIT_LOG.md
-          cargo mutants -p bridge --timeout 180 2>&1 | tee -a AUDIT_LOG.md
+          cargo mutants -p propchain-bridge --timeout 180 2>&1 | tee -a AUDIT_LOG.md
           echo "\`\`\`" >> AUDIT_LOG.md
+          echo "---" >> AUDIT_LOG.md
 
       - name: Mutants Gate — oracle
         run: |
@@ -83,12 +101,23 @@ jobs:
           echo "\`\`\`text" >> AUDIT_LOG.md
           cargo mutants -p oracle --timeout 120 2>&1 | tee -a AUDIT_LOG.md
           echo "\`\`\`" >> AUDIT_LOG.md
+          echo "---" >> AUDIT_LOG.md
+
+      - name: Evaluate Audit Results
+        if: always()
+        run: |
+          DENY_EXIT="${{ steps.deny.outputs.deny_exit }}"
+          AUDIT_EXIT="${{ steps.audit.outputs.audit_exit }}"
+          if [ "$DENY_EXIT" != "0" ] || [ "$AUDIT_EXIT" != "0" ]; then
+            echo "::error::Security audit found issues. Review AUDIT_LOG.md and fix before proceeding."
+            exit 1
+          fi
 
       - name: Commit and Push Security Results to Repo
         if: always()
         run: |
           git config --global user.name "github-actions[bot]"
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
           git add AUDIT_LOG.md
-          git diff-index --quiet HEAD || git commit -m "chore(ci): update nightly AUDIT_LOG.md validation tracking profiles [skip ci]"
-          git push origin HEAD:${{ github.ref }}
+          git diff-index --quiet HEAD || git commit -m "chore(ci): update nightly AUDIT_LOG.md [skip ci]"
+          git push origin HEAD:${{ github.ref }}

.github/workflows/smoke-ci.yml

@@ -1,59 +1,10 @@
-name: Smoke CI Gate
-
-on:
-  push:
-    branches: [ main, master, develop ]
-  pull_request:
-    branches: [ main, master, develop ]
-
-permissions:
-  contents: read
-
-jobs:
-  smoke-test:
-    name: Code Quality & Testing Suite
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout Code Repository
-        uses: actions/checkout@v4
-
-      - name: Validate CODEOWNERS coverage for security-critical contracts
-        shell: bash
-        run: |
-          test -f .github/CODEOWNERS
-          grep -Eq '^/contracts/bridge/\s+@MettaChain/bridge$' .github/CODEOWNERS
-          grep -Eq '^/contracts/lending/\s+@MettaChain/lending$' .github/CODEOWNERS
-          grep -Eq '^/contracts/oracle/\s+@MettaChain/oracle$' .github/CODEOWNERS
-
-      - name: Install Nightly Rust Toolchain (for fmt)
-        uses: dtolnay/rust-toolchain@nightly
-        with:
-          components: rustfmt
-
-      - name: Install Stable Rust Toolchain (for clippy & test)
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy
-
-      - name: Cache Cargo Build Artifacts
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-smoke-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-smoke-
-
-      - name: Check Code Formatting Style (nightly fmt)
-        run: cargo +nightly fmt --check
-
-      - name: Execute Static Analysis Compiler Lints (clippy)
-        run: cargo clippy --all-targets --all-features -- -D warnings
-
-      - name: Run Core Verification Tests (test)
-        run: cargo test --all-features --workspace
+# Smoke CI Gate - TEMPORARILY DISABLED
+#
+# Disabled at maintainer request. The gate currently fails for EVERY pull
+# request regardless of its contents: the pinned dependency set (e.g.
+# trie-db 0.28.0) no longer compiles under the stable rustc that CI
+# installs fresh on each run (1.98.0), so `cargo clippy --all-targets
+# --all-features` aborts before ever reaching project code, and the
+# workspace test step hits the same failure.
+#
+# Re-enable once the dependency/toolchain baseline is refreshed.

AUDIT_LOG.md

@@ -1,5 +1,5 @@
 # 🛡️ Automated Security & Mutation Audit Log
-Generated on: Mon Aug 24 03:07:26 UTC 2026
+Generated on: Tue Aug 25 03:02:28 UTC 2026
 ---
 ## 📦 Dependency License & Advisory Checks (cargo-deny)
 ```text

Cargo.lock

@@ -12,6 +12,7 @@ members = [
     "contracts/analytics",
     "contracts/fees",
     "contracts/dex",
+    "contracts/common",
     "contracts/compliance_registry",
     "contracts/property-management",
     "contracts/fractional",