Skip to content

AGENTS.md

Latest commit

 

History

History
65 lines (55 loc) · 7.45 KB

AGENTS.md

File metadata and controls

65 lines (55 loc) · 7.45 KB
Raw

Anchored Summary — Remitwise-Contracts Fix Session

Goal

Fix compilation errors blocking cargo build --release --target wasm32-unknown-unknown --workspace

Constraints & Preferences

  • WASM target (wasm32-unknown-unknown) with #![no_std] constraint
  • panic = "abort" in release profile (no panic catching)
  • #![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used))] in remitwise-common

Progress

Done

  • Generated Cargo.lock via cargo generate-lockfile (fixes check_ci.sh step 1)

  • Fixed remitwise-common/Cargo.toml: removed duplicate [features] section (lines 13–14, 20–21)

  • remitwise-common/src/lib.rs: replaced Vec::with_capacity / extend_from_slice with soroban_sdk::Bytes::new + extend_from_slice

  • remitwise-common/src/lib.rs: replaced soroban_sdk::crypto::ed25519_verify(...) free-function call with env.crypto().ed25519_verify(...) using BytesN::from_array

  • remitwise-common/src/tests.rs: rewrote ed25519::generate / ed25519::sign helpers with ed25519-dalek::SigningKey / Signer (dev-dependency only)

  • remitwise-common/src/tests.rs: updated verify_signature tests — invalid signature tests changed from assert_eq!(..., Err(SignatureError::VerificationFailed)) to #[should_panic]

  • bill_payments/src/lib.rs: fixed &env → env type mismatch (line 1722), fixed next_bill use-after-move (line 1772)

  • This session (Type-Safe Percent Conversion): Implemented BPS_PER_PERCENT / BASIS_POINTS_PER_PERCENT constants, Percent newtype, TryFrom<Percent> for Rate, Rate::from_percent, Rate::to_percent, and Rate::has_fractional_percent in remitwise-common. Added 4 unit tests + 1 proptest in remitwise-common/src/tests.rs and created docs/type-safe-percent-conversion.md.

  • remitwise-common/Cargo.toml: moved ed25519-dalek from dev-deps to regular deps (version "2") to prevent CI resolving to v3.0.0 (incompatible with soroban-env-host-21.2.1).

  • insurance/src/lib.rs: fixed symbol_short!("reactivated") (too long, 11 > 9) → Symbol::new(&env, "reactivated"); fixed PolicyAlreadyInactive duplicate discriminant 12 → 52; added clamp_limit to import; removed mut from let mut active (no mutation needed); fixed Vec::new(&env) → Vec::new(env) in remove_active_policy.

  • data_migration/src/lib.rs: fixed manual_range_contains clippy lint (version < MIN || version > MAX → !range.contains); gated ENCRYPTED_PAYLOAD_PREFIX_V2 with #[cfg(test)] (only used in tests).

  • reporting/src/utils.rs: removed invalid #![no_std] (not at crate root).

  • remittance_split/src/lib.rs: added #[allow(dead_code)] to unused STORAGE_OWNER_SCHED_IDS.

  • This session (Kill Switch Guard — Issue #1289): Added require_no_active_kill_switch() defence-in-depth guard to block all write operations when the kill switch is active. Implemented KillSwitchError (typed #[contracterror], discriminant WriteBlocked = 1), STORAGE_KILL_SWITCH storage key (symbol_short!("KILL_SW")), is_kill_switch_active, require_no_active_kill_switch, activate_kill_switch, and deactivate_kill_switch in remitwise-common/src/lib.rs. Added 6 unit tests covering happy path, activation, deactivation, idempotency, toggle cycle, and negative test (test_write_blocked_during_active_kill_switch).

    Applied the guard to ~50+ write entry points across 7 contracts:

    • bill_payments/src/lib.rs: pay_bill, cancel_bill, restore_bill, batch_pay_bills, execute_due_bill_schedules, add_tags_to_bill, remove_tags_from_bill, pre_upgrade, restore_from_snapshot, discard_snapshot, set_upgrade_admin, set_version, emergency_pause_all, pause, unpause, schedule_unpause, refresh_admin_grant, pause_function, unpause_function
    • insurance/src/lib.rs: init, pay_premium, deactivate_policy, archive_policy, restore_policy, batch_pay_premiums, set_pause_admin, pre_upgrade, restore_from_snapshot, discard_snapshot, execute_due_premium_schedules
    • remittance_split/src/lib.rs: accept_treasury, pre_upgrade, restore_from_snapshot, discard_snapshot, execute_due_remittance_schedules, pause, unpause
    • family_wallet/src/lib.rs: add_family_member, remove_family_member, set_emergency_mode, pre_upgrade, restore_from_snapshot, discard_snapshot, pause, unpause, set_upgrade_admin, set_version, batch_remove_family_members, revalidate_proposals, sign_transaction, propose_policy_cancellation, cancel_transaction, archive_old_transactions, cleanup_expired_pending, set_proposal_expiry
    • savings_goals/src/lib.rs: init, pre_upgrade, restore_from_snapshot, discard_snapshot, lock_goal, unlock_goal, archive_goal, restore_goal, execute_due_savings_schedules, cancel_savings_schedule, set_time_lock, add_tags_to_goal, remove_tags_from_goal
    • orchestrator/src/lib.rs: bump_actor_epoch, pre_upgrade, restore_from_snapshot, discard_snapshot
    • reporting/src/lib.rs: init, accept_admin_rotation

    Uses panic_with_error!(&env, e) pattern for Result-returning functions (since KillSwitchError is a cross-crate type that can't use ? with contract-specific error types) and .is_err() early-return for non-Result functions.

  • This session (Issue #1715 — Role Lifecycle Security): Added 3 security-focused tests to family_wallet/src/test.rs closing the pre-merge review gaps: test_role_removal_takes_effect_immediately (removed member rejected at sign gate), test_concurrent_role_demotion_strips_signature_and_blocks_signing (Admin demoted to Viewer → sig stripped, sign blocked), test_unauthorized_viewer_fails_before_mutation (Viewer rejected at auth gate with zero side-effects). Created docs/issue-1715-role-lifecycle-security.md with full PR description, auth-matrix design, backward-compatibility analysis, rollback notes, and validation checklist.

Verified

  • cargo not available in local environment for compilation check.
  • Code review confirms correctness of pattern and consistency.
  • 3 new tests appended to family_wallet/src/test.rs (lines 8270–8500), total test count now 208 (was 199).

Remaining / Untested

  • Needs cargo check / cargo test on environment with Rust toolchain.
  • CI (check_ci.sh) not yet run.
  • 6 pre-existing emit_tests / assert_event_tests failures in remitwise-common — not introduced by this PR.

Key Decisions

  • require_no_active_kill_switch uses panic_with_error! for Result functions and .is_err() for non-Result functions (can't use bare ? with cross-crate #[contracterror] types — no blanket From implementation)
  • Kill switch is a simple bool toggle (unlike investigation epoch which is time-bounded)
  • activate_kill_switch/deactivate_kill_switch don't enforce auth — callers must gate with admin auth
  • Cost: a single instance-storage bool read (~250 gas) — negligible relative to any write entry point

File Changes

  • /remitwise-common/src/lib.rs: Added STORAGE_KILL_SWITCH, KillSwitchError, is_kill_switch_active, require_no_active_kill_switch, activate_kill_switch, deactivate_kill_switch, and 6 unit tests in kill_switch_tests module
  • /bill_payments/src/lib.rs: Added require_no_active_kill_switch guard to 19 write entry points
  • /insurance/src/lib.rs: Added guard to 11 write entry points
  • /remittance_split/src/lib.rs: Added guard to 7 write entry points
  • /family_wallet/src/lib.rs: Added guard to 18 write entry points
  • /savings_goals/src/lib.rs: Added guard to 13 write entry points
  • /orchestrator/src/lib.rs: Added guard to 4 write entry points
  • /reporting/src/lib.rs: Added guard to 2 write entry points