fix: gate sdk 27 storage compatibility

.github/actions/setup-rust-stellar/action.yml

@@ -7,9 +7,9 @@ runs:
       uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable (rust 1.97.1)
+      uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
       with:
-        toolchain: stable
+        toolchain: 1.93.0
         targets: wasm32v1-none
 
     - name: Add wasm32v1-none target

.github/workflows/rustfmt.yml

@@ -27,9 +27,9 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable (rust 1.97.1)
+        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
         with:
-          toolchain: stable
+          toolchain: 1.93.0
           components: rustfmt
 
       - name: Run rustfmt

.github/workflows/verify-build.yml

@@ -11,6 +11,8 @@ on:
       - 'Cargo.toml'
       - 'Cargo.lock'
       - 'rust-toolchain.toml'
+      - 'deploy_mainnet.sh'
+      - 'scripts/**'
       - '.github/actions/setup-rust-stellar/**'
       - '.github/workflows/verify-build.yml'
   # Use pull_request (not pull_request_target): the check must run the workflow
@@ -28,6 +30,8 @@ on:
       - 'Cargo.toml'
       - 'Cargo.lock'
       - 'rust-toolchain.toml'
+      - 'deploy_mainnet.sh'
+      - 'scripts/**'
       - '.github/actions/setup-rust-stellar/**'
       - '.github/workflows/verify-build.yml'
       - '.github/workflows/rustfmt.yml'
@@ -49,11 +53,19 @@ jobs:
       - name: Setup Rust and Stellar
         uses: ./.github/actions/setup-rust-stellar
 
-      - name: Build events contract
-        run: cd contracts/events && make build
+      - name: Check release script syntax
+        run: |
+          bash -n deploy_mainnet.sh
+          bash -n scripts/capture-mainnet-compat-snapshot.sh
+          bash -n scripts/test-sdk27-compat.sh
+          bash -n scripts/test-mainnet-upgrade-guards.sh
+          bash -n scripts/testdata/mock-stellar
+
+      - name: Verify mainnet upgrade guards
+        run: ./scripts/test-mainnet-upgrade-guards.sh
 
-      - name: Build profile contract
-        run: cd contracts/profile && make build
+      - name: Build contracts reproducibly
+        run: stellar contract build --locked
 
       - name: Check WASM sizes (64 KB ceiling)
         run: |
@@ -67,5 +79,10 @@ jobs:
             fi
           done
 
+      - name: Verify SDK 23 to SDK 27 storage compatibility
+        env:
+          VERIFY_SDK27_BUILD: "1"
+        run: ./scripts/test-sdk27-compat.sh
+
       - name: Run tests
         run: cargo test --release

BACKLOG.md

@@ -8,6 +8,7 @@ Legend: `[ ]` open, `[~]` in flight, `[x]` done.
 
 ## P0 (blocking mainnet)
 
+- [x] **SDK 23 to SDK 27 storage compatibility.** Exact mainnet and synthetic SDK 23 state upgrades through H6 to pinned SDK 27 artifacts. Tests cover every persisted layout; CI pins fixtures and snapshots; mainnet tooling verifies versions, admins, bindings, pause state, queued hashes, and live executable hashes.
 - [ ] Third-party security audit (events + profile). Cost ~$30-80k for a Soroban-experienced firm. Schedule blocker for the mainnet date.
 - [x] Non-USDC token end-to-end smoke. 2026-06-05: registered the testnet native XLM SAC (`CDLZFC3SYJYDZT7K67VZ75HPJVIEUVNIXF47ZG2FB2RMQQVU2HHGCYSC`) on the new events contract; ran `scripts/smoke/contract-non-usdc-token.ts`. Bounty published in XLM, alice applied + submitted + won + got paid; payout tx `a6c8daad…`. Smoke updated to tolerate native-asset tx fees (~143k stroops / 0.014 XLM for 3 alice-signed txs); for non-native tokens the assertion still demands exact-budget delta.
 - [ ] Mainnet admin multi-sig provisioned per `docs/admin-custody-policy.md` (3 signers, 2-of-3). 2026-06-05: launch baseline updated to software multi-sig (Freighter on 3 isolated machines) with a hardware-upgrade trigger codified in `admin-custody-policy.md` §10 (TVL $250k OR daily volume $50k/day for 7 days OR first signer-machine incident → mandatory Yubikey upgrade). Pre-flight gate codified for both paths — see `docs/multisig-preflight.md` (Section 1.A hardware, Section 1.B Freighter; everything else identical) and `scripts/admin/verify-multisig.sh` (chain-state gate, hardware-agnostic). The verify script was sanity-tested against a single-sig account and correctly fails with the per-check breakdown.
@@ -58,7 +59,7 @@ See `docs/audit-2026-06-stellar-skill.md` for full findings.
 
 ## Done
 
-- [x] 2026-07-17 — Cancellation liveness hardening. `add_funds` now maintains an O(1) per-event non-owner contribution total, `start_cancel` no longer scans up to 5,000 contributor rows, and `process_cancel_batch` / `finalize_cancel` are permissionless after cancellation starts. The guarded 1.1.0 → 1.2.0 mainnet flow pauses before proposal, proves the zero-event state, keeps it frozen through the timelock, and rechecks before apply. Older zero-contributor rows initialize the missing total lazily; a missing total with existing contributors fails closed. Tests cover a 220-contributor constant-footprint start and exact third-party-driven payout deltas.
+- [x] 2026-07-17 — Cancellation liveness hardening. `add_funds` now maintains an O(1) per-event non-owner contribution total, `start_cancel` no longer scans up to 5,000 contributor rows, and `process_cancel_batch` / `finalize_cancel` are permissionless after cancellation starts. The original guarded events 1.1.0 → 1.2.0 plan introduced the pause and zero-event checks; the current coordinated SDK 27 flow carries those checks forward to events 1.5.0 and profile 1.2.0. Older zero-contributor rows initialize the missing total lazily; a missing total with existing contributors fails closed. Tests cover a 220-contributor constant-footprint start and exact third-party-driven payout deltas.
 - [x] 2026-06-03 — `fee_bps_override` per-event field + `effective_fee_bps` resolver.
 - [x] 2026-06-03 — `WinnersAlreadySelected` replay lock on `select_winners`.
 - [x] 2026-06-03 — Grant last-milestone sweep (G4).

contracts/compatibility/Cargo.toml

@@ -0,0 +1,11 @@
+[package]
+name = "boundless-storage-compatibility"
+version = "0.1.0"
+edition = "2021"
+publish = false
+
+[lib]
+doctest = false
+
+[dependencies]
+soroban-sdk = { workspace = true, features = ["testutils"] }