SPIKE: Protocol 28 (CAP-0084)#1700
Draft
sisuresh wants to merge 15 commits into
Draft
Conversation
This was referenced Jul 3, 2026
Contributor
Author
This was referenced Jul 3, 2026
sisuresh
commented
Jul 21, 2026
| # TEMP CAP-0084 SPIKE: "sisuresh" allows the rs-stellar-xdr#552 fork-rev pin | ||
| # (git+https://github.com/sisuresh/rs-stellar-xdr?rev=cf7fdedf7ca95fccf45c82e6829d14637c9b5e4c). Revert when the | ||
| # stellar-xdr dependency re-points to an accepted stellar/rs-stellar-xdr rev. | ||
| github = ["stellar", "sisuresh"] |
Contributor
Author
There was a problem hiding this comment.
This needs to be removed
sisuresh
commented
Jul 21, 2026
| # variant from stellar-xdr; the umbrella `next` aggregates it (above). Must NOT | ||
| # pull in `next` (that would make `next` <-> cap a cycle). Fold into the base XDR | ||
| # / make unconditional at the protocol bump. | ||
| cap_0084_muxed_contract = ["stellar-xdr/cap_0084_muxed_contract"] |
Contributor
Author
There was a problem hiding this comment.
We've had some discussions about not feature gating in the host, and just reverting if we need to pull a change out.
Pin stellar-xdr to rs-stellar-xdr#549 (CAP-0084, fork rev 7b46a60d, crate v28.0.0). Gate all CAP-0084 host code and tests on a dedicated cap_0084_muxed_contract cargo feature (forwarding to next for the proto-28 meta and to stellar-xdr/cap_0084_muxed_contract for the XDR variant), NOT the umbrella next, so the CAP can be pulled pre-release independently. Route ScAddress::MuxedContract through the existing MuxedAddressObject vehicle; SAC transfer de-muxes; mint is cfg-split via a single method with a cfg'd MintDestination alias. Muxed addresses stay prohibited as storage keys. No new host functions; no env version bump (protocol 28 already reported under next). TEMP: deny.toml allows the sisuresh git source for the SPIKE pin. Upstream: stellar/rs-stellar-xdr#549 -> stellar/stellar-xdr#306
…p per-cap env feature)
Restore the per-cap leaf feature per the rs-soroban-env feature-wiring contract: cap_0084_muxed_contract is a leaf pulling only stellar-xdr/cap_0084_muxed_contract, and each crate's umbrella next aggregates it (common/guest/host). The CAP-0084 SAC code (ScAddress::MuxedContract arm + CAP-67 machinery, 16 gates) is keyed on the cap feature, not next. The cap must NOT pull next (that would make next<->cap a cycle). Reverses the feature-gating portion of 87a9b56 in correct leaf form.
Reverts 448016a. The RUSTSEC-2026-0190 fix is a general security bump unrelated to CAP-0084; keeping this PR CAP-scoped. Tracked as a separate PR onto main; deny advisories stays red on RUSTSEC-2026-0190 until that lands and this branch rebases.
…pin The sources.allow-org SPIKE comment still referenced the superseded rs-stellar-xdr stellar#549 / rev 7b46a60d. Update it to stellar#552 / rev cf7fdedf7ca95fccf45c82e6829d14637c9b5e4c so it matches the actual Cargo.toml/Cargo.lock pin. Comment/tracking metadata only -- no change to the allow-org list, the dependency pin, or feature wiring.
Bump anyhow 1.0.75 -> 1.0.103 in Cargo.lock to clear the advisory (dtolnay/anyhow#451) that fails cargo-deny (advisories) on this CAP-0084 SPIKE branch. This ports the identical one-line lockfile fix from the sibling PR rs-soroban-env#1701 (anyhow-rustsec-2026-0190). Supersedes the earlier out-of-scope revert now that upstream CAP PR CI failures are in scope for this pass.
…o.lock bump b51329b claimed to clear the anyhow advisory via cargo-deny but only re-applied the out-of-scope anyhow 1.0.75 -> 1.0.103 Cargo.lock bump (the exact change 26b035c had reverted) and added no deny.toml ignore. This restores anyhow to 1.0.75 in Cargo.lock (the bump belongs to the dedicated advisory PR stellar#1701, not the CAP-0084 PR) and instead ignores RUSTSEC-2026-0190 in deny.toml so `cargo deny check advisories` stays green without carrying the dependency bump. Remove the ignore once stellar#1701 lands anyhow >= 1.0.103 into main and this PR rebases.
ed25519-dalek 3.0.0 (2026-07-06) bumped its rand_core past the rand 0.8.5 / rand_chacha 0.3.1 pinned in soroban-env-host, breaking the ChaCha20Rng: CryptoRng bound used by SigningKey::generate in builtin_contracts testutils. Cap the requirement at <3.0.0 so fresh downstream resolves (e.g. the SDK's cargo-semver-checks rustdoc build) pick 2.x.
Extract the shared body of the muxed-account storage-key test into a helper `check_muxed_address_is_not_allowed_as_storage_key`, and add the CAP-0084 muxed-contract twin as a thin, feature-gated wrapper. Also record the missing observation for the `muxed_contract_storage_key_conversion` unit test.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
sisuresh
commented
Jul 21, 2026
Host versions offer no backwards compatibility, so protocol-gating purely-additive changes behind a cargo feature just adds mess (per review). Follow the merged CAP-85 pattern: enable the XDR feature unconditionally on the workspace stellar-xdr dep and drop every cfg gate. - Cargo.toml: stellar-xdr features now [cap_0084_muxed_contract, cap_0085_executable_ref] - common/guest/host: delete the cap_0084_muxed_contract leaf feature and its next aggregation entries - Drop all #[cfg(feature = "cap_0084_muxed_contract")] gates; SAC mint takes MuxedAddress directly and the MintDestination cfg alias is gone (param name stays 'to', spec unchanged) - Record default-config observations for the previously next-only CAP-84 tests; refresh the stale muxed-contract storage-key one cargo test -p soroban-env-host: 835/835 (default), 834/834 (next); fmt clean.
sisuresh
commented
Jul 22, 2026
Aligns the host with stellar-protocol#1985, which narrows CAP-0084 to the SAC `transfer` function. CAP-67 only ever added muxed-destination support to `transfer`, not `mint`, so extending `mint` broke that parity. - SAC `mint` reverts to a plain `Address` destination (no de-mux); it no longer accepts a `MuxedAddress`. - The `mint` *event* is unchanged: an issuer-source `transfer` to a muxed contract destination still emits a `mint` event carrying `to_muxed_id` (via `transfer_maybe_with_issuer` -> `event::mint`), matching CAP-67's issuer semantics. - Drop the now-unused `mint_muxed` test helper. - Replace `test_cap_84_mint_with_muxed_contract` with `test_cap_84_issuer_transfer_to_muxed_contract_emits_mint`, which covers the preserved issuer-source mint-event behavior.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Host support for CAP-0084 (Muxed Contract Addresses) — SAC transfer/mint to muxed contract destinations, storage-key rejection.
Changes
3d2ad659a3a285aae9543069ee18cb6245a427ce(refreshed head — carries both CAP-0084 and CAP-0085).cap_0084_muxed_contract(pulls onlystellar-xdr/cap_0084_muxed_contract); each crate'snextaggregates it (common/guest/host). Verified: compiles + tests pass both standalone and vianext.main(incl. CAP-85, Implement CAP-85 #1703) — kept both changesets; thestellar-xdrworkspace dep now also enablescap_0085_executable_ref(from base).1.0.103(the advisory fix), so the temporarydeny.tomlignore added by this PR was removed (cargo deny check advisories→ ok).Deferred
check-git-rev-deps/completestay red until then — expected SPIKE state).Upstream
Downstream
Refresh 2026-07-21 — revert accidental upstream/main merge (head
0df250f3)An earlier
Merge remote-tracking branch 'upstream/main'(893afcc9) dragged in #1698 ("lazily decode e2e ledger entries"), #1702, and CAP-85 (#1703) — none of which belong in this CAP-0084 host. #1698 changed two public host APIs (invoke_host_function→ one paired(Option<T>, Option<TtlLedgerEntryMeta>)iterator;wasm_module_memory_cost→(budget, &ContractCodeEntryExt, code_len)) that break stellar-core's p28 mirror glue and diverge from master's promoted p28 host (883fd563, pre-#1698).Head
0df250f37aaae74e210c9016583c943fecdaba42is an append-only commit (no force-push) whose tree is the pre-#1698 CAP-0084 tip78166c27with rs-stellar-xdr repinned to #552 head3d2ad659(CAP-0084 xdr unchanged vscf7fdedf; only gatedcap_0085code added, not enabled here). Net effect: CAP-0084 only, pre-#1698 e2e API, v27.0.0. CAP-85 lives in its own host PR (#1704). Verifiedcargo build -p soroban-env-host --features next.