SPIKE: Protocol 28 (CAP-0085)

[sisuresh]

Adds Protocol 28 (CAP-0085, externally managed contract executables) support to the CLI. There was none — upstream's most recent protocol bump is #2613 (p27).

Dependencies.stellar-xdr moves to the CAP-85 rev with cap_0085_executable_ref. Patching it alone doesn't work: crates.io soroban-env-common 27.0.0 fails to build against CAP-85 XDR (its ScVal/ScValType matches don't cover ExecutableTag), and leaving it unpatched resolves a second, CAP-85-blind stellar-xdr that then mismatches types at every crate boundary. So [patch.crates-io] moves env and the SDK family together. The env and xdr revs are already upstream stellar revs; the soroban-* patches track rs-soroban-sdk#1929 and are fork-hosted only while that PR is open.

Reference resolution.utils::rpc::resolve_executable_ref reads the Wasm hash out of the owner's persistent entry keyed by the tag. This isn't cosmetic — without it the CLI cannot invoke an external-ref contract at all, because argument parsing needs the spec, which needs the code. Wired into get_spec, wasm::fetch_from_contract and wasm::fetch_wasm_hash_from_contract. Spec caching stays keyed on the resolved hash, so re-pointing a reference misses the cache rather than serving a stale spec.

Deploy.--executable-owner / --executable-tag build a CREATE_CONTRACT(_V2) whose executable is CONTRACT_EXECUTABLE_EXTERNAL_REF.

Display.ScVal::ExecutableTag renders as a tagged object so it stays distinguishable from ScVal::String, which shares its payload. An external-ref instance renders as its reference. The auth log deliberately shows the reference unresolved — what's being signed is a contract whose code the owner can replace at will, and a resolved hash would misrepresent that as fixed.

Testing

Built and used as the driver for CAP-0085 validation against a locally built stellar/quickstart:nightly-next at protocol 28 (core c444c073, rpc protocol-next, horizon protocol-next). It drove the full matrix: atomic fleet upgrade, the protocol-enforced storage invariants, self-update and deferred application, TTL scoping, get_address_executable, and the classic-op deploy path above. 28 transactions, all successful.

Not yet run: this repo's own test suite. cargo check -p soroban-cli --all-targets is clean, but build_create_contract_tx changed signature and soroban-spec-tools gained match arms, so CI is worth watching.

Draft until rs-soroban-sdk#1929 lands and the soroban-* patches can re-point at a stellar/ rev.

[sisuresh]

Adds Protocol 28 (CAP-0085, externally managed contract executables) support to the CLI. There was none — upstream's most recent protocol bump is #2613 (p27).

Dependencies.stellar-xdr moves to the CAP-85 rev with cap_0085_executable_ref. Patching it alone doesn't work: crates.io soroban-env-common 27.0.0 fails to build against CAP-85 XDR (its ScVal/ScValType matches don't cover ExecutableTag), and leaving it unpatched resolves a second, CAP-85-blind stellar-xdr that then mismatches types at every crate boundary. So [patch.crates-io] moves env and the SDK family together. The env and xdr revs are already upstream stellar revs; the soroban-* patches track rs-soroban-sdk#1929 and are fork-hosted only while that PR is open.

Reference resolution.utils::rpc::resolve_executable_ref reads the Wasm hash out of the owner's persistent entry keyed by the tag. This isn't cosmetic — without it the CLI cannot invoke an external-ref contract at all, because argument parsing needs the spec, which needs the code. Wired into get_spec, wasm::fetch_from_contract and wasm::fetch_wasm_hash_from_contract. Spec caching stays keyed on the resolved hash, so re-pointing a reference misses the cache rather than serving a stale spec.

Deploy.--executable-owner / --executable-tag build a CREATE_CONTRACT(_V2) whose executable is CONTRACT_EXECUTABLE_EXTERNAL_REF.

Display.ScVal::ExecutableTag renders as a tagged object so it stays distinguishable from ScVal::String, which shares its payload. An external-ref instance renders as its reference. The auth log deliberately shows the reference unresolved — what's being signed is a contract whose code the owner can replace at will, and a resolved hash would misrepresent that as fixed.

Testing

Built and used as the driver for CAP-0085 validation against a locally built stellar/quickstart:nightly-next at protocol 28 (core c444c073, rpc protocol-next, horizon protocol-next). It drove the full matrix: atomic fleet upgrade, the protocol-enforced storage invariants, self-update and deferred application, TTL scoping, get_address_executable, and the classic-op deploy path above. 28 transactions, all successful.

Not yet run: this repo's own test suite. cargo check -p soroban-cli --all-targets is clean, but build_create_contract_tx changed signature and soroban-spec-tools gained match arms, so CI is worth watching.

Draft until rs-soroban-sdk#1929 lands and the soroban-* patches can re-point at a stellar/ rev.

[sisuresh]

Adds Protocol 28 (CAP-0085, externally managed contract executables) support to the CLI. There was none — upstream's most recent protocol bump is #2613 (p27).

Dependencies.stellar-xdr moves to the CAP-85 rev with cap_0085_executable_ref. Patching it alone doesn't work: crates.io soroban-env-common 27.0.0 fails to build against CAP-85 XDR (its ScVal/ScValType matches don't cover ExecutableTag), and leaving it unpatched resolves a second, CAP-85-blind stellar-xdr that then mismatches types at every crate boundary. So [patch.crates-io] moves env and the SDK family together. The env and xdr revs are already upstream stellar revs; the soroban-* patches track rs-soroban-sdk#1929 and are fork-hosted only while that PR is open.

Reference resolution.utils::rpc::resolve_executable_ref reads the Wasm hash out of the owner's persistent entry keyed by the tag. This isn't cosmetic — without it the CLI cannot invoke an external-ref contract at all, because argument parsing needs the spec, which needs the code. Wired into get_spec, wasm::fetch_from_contract and wasm::fetch_wasm_hash_from_contract. Spec caching stays keyed on the resolved hash, so re-pointing a reference misses the cache rather than serving a stale spec.

Deploy.--executable-owner / --executable-tag build a CREATE_CONTRACT(_V2) whose executable is CONTRACT_EXECUTABLE_EXTERNAL_REF.

Display.ScVal::ExecutableTag renders as a tagged object so it stays distinguishable from ScVal::String, which shares its payload. An external-ref instance renders as its reference. The auth log deliberately shows the reference unresolved — what's being signed is a contract whose code the owner can replace at will, and a resolved hash would misrepresent that as fixed.

Testing

Built and used as the driver for CAP-0085 validation against a locally built stellar/quickstart:nightly-next at protocol 28 (core c444c073, rpc protocol-next, horizon protocol-next). It drove the full matrix: atomic fleet upgrade, the protocol-enforced storage invariants, self-update and deferred application, TTL scoping, get_address_executable, and the classic-op deploy path above. 28 transactions, all successful.

Not yet run: this repo's own test suite. cargo check -p soroban-cli --all-targets is clean, but build_create_contract_tx changed signature and soroban-spec-tools gained match arms, so CI is worth watching.

Draft until rs-soroban-sdk#1929 lands and the soroban-* patches can re-point at a stellar/ rev.

[sisuresh]

Adds Protocol 28 (CAP-0085, externally managed contract executables) support to the CLI. There was none — upstream's most recent protocol bump is #2613 (p27).

Dependencies.stellar-xdr moves to the CAP-85 rev with cap_0085_executable_ref. Patching it alone doesn't work: crates.io soroban-env-common 27.0.0 fails to build against CAP-85 XDR (its ScVal/ScValType matches don't cover ExecutableTag), and leaving it unpatched resolves a second, CAP-85-blind stellar-xdr that then mismatches types at every crate boundary. So [patch.crates-io] moves env and the SDK family together. The env and xdr revs are already upstream stellar revs; the soroban-* patches track rs-soroban-sdk#1929 and are fork-hosted only while that PR is open.

Reference resolution.utils::rpc::resolve_executable_ref reads the Wasm hash out of the owner's persistent entry keyed by the tag. This isn't cosmetic — without it the CLI cannot invoke an external-ref contract at all, because argument parsing needs the spec, which needs the code. Wired into get_spec, wasm::fetch_from_contract and wasm::fetch_wasm_hash_from_contract. Spec caching stays keyed on the resolved hash, so re-pointing a reference misses the cache rather than serving a stale spec.

Deploy.--executable-owner / --executable-tag build a CREATE_CONTRACT(_V2) whose executable is CONTRACT_EXECUTABLE_EXTERNAL_REF.

Display.ScVal::ExecutableTag renders as a tagged object so it stays distinguishable from ScVal::String, which shares its payload. An external-ref instance renders as its reference. The auth log deliberately shows the reference unresolved — what's being signed is a contract whose code the owner can replace at will, and a resolved hash would misrepresent that as fixed.

Testing

Built and used as the driver for CAP-0085 validation against a locally built stellar/quickstart:nightly-next at protocol 28 (core c444c073, rpc protocol-next, horizon protocol-next). It drove the full matrix: atomic fleet upgrade, the protocol-enforced storage invariants, self-update and deferred application, TTL scoping, get_address_executable, and the classic-op deploy path above. 28 transactions, all successful.

Not yet run: this repo's own test suite. cargo check -p soroban-cli --all-targets is clean, but build_create_contract_tx changed signature and soroban-spec-tools gained match arms, so CI is worth watching.

Draft until rs-soroban-sdk#1929 lands and the soroban-* patches can re-point at a stellar/ rev.

[sisuresh]

Adds Protocol 28 (CAP-0085, externally managed contract executables) support to the CLI. There was none — upstream's most recent protocol bump is #2613 (p27).

Dependencies.stellar-xdr moves to the CAP-85 rev with cap_0085_executable_ref. Patching it alone doesn't work: crates.io soroban-env-common 27.0.0 fails to build against CAP-85 XDR (its ScVal/ScValType matches don't cover ExecutableTag), and leaving it unpatched resolves a second, CAP-85-blind stellar-xdr that then mismatches types at every crate boundary. So [patch.crates-io] moves env and the SDK family together. The env and xdr revs are already upstream stellar revs; the soroban-* patches track rs-soroban-sdk#1929 and are fork-hosted only while that PR is open.

Reference resolution.utils::rpc::resolve_executable_ref reads the Wasm hash out of the owner's persistent entry keyed by the tag. This isn't cosmetic — without it the CLI cannot invoke an external-ref contract at all, because argument parsing needs the spec, which needs the code. Wired into get_spec, wasm::fetch_from_contract and wasm::fetch_wasm_hash_from_contract. Spec caching stays keyed on the resolved hash, so re-pointing a reference misses the cache rather than serving a stale spec.

Deploy.--executable-owner / --executable-tag build a CREATE_CONTRACT(_V2) whose executable is CONTRACT_EXECUTABLE_EXTERNAL_REF.

Display.ScVal::ExecutableTag renders as a tagged object so it stays distinguishable from ScVal::String, which shares its payload. An external-ref instance renders as its reference. The auth log deliberately shows the reference unresolved — what's being signed is a contract whose code the owner can replace at will, and a resolved hash would misrepresent that as fixed.

Testing

Built and used as the driver for CAP-0085 validation against a locally built stellar/quickstart:nightly-next at protocol 28 (core c444c073, rpc protocol-next, horizon protocol-next). It drove the full matrix: atomic fleet upgrade, the protocol-enforced storage invariants, self-update and deferred application, TTL scoping, get_address_executable, and the classic-op deploy path above. 28 transactions, all successful.

Not yet run: this repo's own test suite. cargo check -p soroban-cli --all-targets is clean, but build_create_contract_tx changed signature and soroban-spec-tools gained match arms, so CI is worth watching.

Draft until rs-soroban-sdk#1929 lands and the soroban-* patches can re-point at a stellar/ rev.

[sisuresh]

Adds Protocol 28 (CAP-0085, externally managed contract executables) support to the CLI. There was none — upstream's most recent protocol bump is #2613 (p27).

Dependencies.stellar-xdr moves to the CAP-85 rev with cap_0085_executable_ref. Patching it alone doesn't work: crates.io soroban-env-common 27.0.0 fails to build against CAP-85 XDR (its ScVal/ScValType matches don't cover ExecutableTag), and leaving it unpatched resolves a second, CAP-85-blind stellar-xdr that then mismatches types at every crate boundary. So [patch.crates-io] moves env and the SDK family together. The env and xdr revs are already upstream stellar revs; the soroban-* patches track rs-soroban-sdk#1929 and are fork-hosted only while that PR is open.

Reference resolution.utils::rpc::resolve_executable_ref reads the Wasm hash out of the owner's persistent entry keyed by the tag. This isn't cosmetic — without it the CLI cannot invoke an external-ref contract at all, because argument parsing needs the spec, which needs the code. Wired into get_spec, wasm::fetch_from_contract and wasm::fetch_wasm_hash_from_contract. Spec caching stays keyed on the resolved hash, so re-pointing a reference misses the cache rather than serving a stale spec.

Deploy.--executable-owner / --executable-tag build a CREATE_CONTRACT(_V2) whose executable is CONTRACT_EXECUTABLE_EXTERNAL_REF.

Display.ScVal::ExecutableTag renders as a tagged object so it stays distinguishable from ScVal::String, which shares its payload. An external-ref instance renders as its reference. The auth log deliberately shows the reference unresolved — what's being signed is a contract whose code the owner can replace at will, and a resolved hash would misrepresent that as fixed.

Testing

Built and used as the driver for CAP-0085 validation against a locally built stellar/quickstart:nightly-next at protocol 28 (core c444c073, rpc protocol-next, horizon protocol-next). It drove the full matrix: atomic fleet upgrade, the protocol-enforced storage invariants, self-update and deferred application, TTL scoping, get_address_executable, and the classic-op deploy path above. 28 transactions, all successful.

Not yet run: this repo's own test suite. cargo check -p soroban-cli --all-targets is clean, but build_create_contract_tx changed signature and soroban-spec-tools gained match arms, so CI is worth watching.

Draft until rs-soroban-sdk#1929 lands and the soroban-* patches can re-point at a stellar/ rev.

[sisuresh]

Adds Protocol 28 (CAP-0085, externally managed contract executables) support to the CLI. There was none — upstream's most recent protocol bump is #2613 (p27).

Dependencies.stellar-xdr moves to the CAP-85 rev with cap_0085_executable_ref. Patching it alone doesn't work: crates.io soroban-env-common 27.0.0 fails to build against CAP-85 XDR (its ScVal/ScValType matches don't cover ExecutableTag), and leaving it unpatched resolves a second, CAP-85-blind stellar-xdr that then mismatches types at every crate boundary. So [patch.crates-io] moves env and the SDK family together. The env and xdr revs are already upstream stellar revs; the soroban-* patches track rs-soroban-sdk#1929 and are fork-hosted only while that PR is open.

Reference resolution.utils::rpc::resolve_executable_ref reads the Wasm hash out of the owner's persistent entry keyed by the tag. This isn't cosmetic — without it the CLI cannot invoke an external-ref contract at all, because argument parsing needs the spec, which needs the code. Wired into get_spec, wasm::fetch_from_contract and wasm::fetch_wasm_hash_from_contract. Spec caching stays keyed on the resolved hash, so re-pointing a reference misses the cache rather than serving a stale spec.

Deploy.--executable-owner / --executable-tag build a CREATE_CONTRACT(_V2) whose executable is CONTRACT_EXECUTABLE_EXTERNAL_REF.

Display.ScVal::ExecutableTag renders as a tagged object so it stays distinguishable from ScVal::String, which shares its payload. An external-ref instance renders as its reference. The auth log deliberately shows the reference unresolved — what's being signed is a contract whose code the owner can replace at will, and a resolved hash would misrepresent that as fixed.

Testing

Built and used as the driver for CAP-0085 validation against a locally built stellar/quickstart:nightly-next at protocol 28 (core c444c073, rpc protocol-next, horizon protocol-next). It drove the full matrix: atomic fleet upgrade, the protocol-enforced storage invariants, self-update and deferred application, TTL scoping, get_address_executable, and the classic-op deploy path above. 28 transactions, all successful.

Not yet run: this repo's own test suite. cargo check -p soroban-cli --all-targets is clean, but build_create_contract_tx changed signature and soroban-spec-tools gained match arms, so CI is worth watching.

Draft until rs-soroban-sdk#1929 lands and the soroban-* patches can re-point at a stellar/ rev.

[sisuresh]

Adds Protocol 28 (CAP-0085, externally managed contract executables) support to the CLI. There was none — upstream's most recent protocol bump is #2613 (p27).

Dependencies.stellar-xdr moves to the CAP-85 rev with cap_0085_executable_ref. Patching it alone doesn't work: crates.io soroban-env-common 27.0.0 fails to build against CAP-85 XDR (its ScVal/ScValType matches don't cover ExecutableTag), and leaving it unpatched resolves a second, CAP-85-blind stellar-xdr that then mismatches types at every crate boundary. So [patch.crates-io] moves env and the SDK family together. The env and xdr revs are already upstream stellar revs; the soroban-* patches track rs-soroban-sdk#1929 and are fork-hosted only while that PR is open.

Reference resolution.utils::rpc::resolve_executable_ref reads the Wasm hash out of the owner's persistent entry keyed by the tag. This isn't cosmetic — without it the CLI cannot invoke an external-ref contract at all, because argument parsing needs the spec, which needs the code. Wired into get_spec, wasm::fetch_from_contract and wasm::fetch_wasm_hash_from_contract. Spec caching stays keyed on the resolved hash, so re-pointing a reference misses the cache rather than serving a stale spec.

Deploy.--executable-owner / --executable-tag build a CREATE_CONTRACT(_V2) whose executable is CONTRACT_EXECUTABLE_EXTERNAL_REF.

Display.ScVal::ExecutableTag renders as a tagged object so it stays distinguishable from ScVal::String, which shares its payload. An external-ref instance renders as its reference. The auth log deliberately shows the reference unresolved — what's being signed is a contract whose code the owner can replace at will, and a resolved hash would misrepresent that as fixed.

Testing

Built and used as the driver for CAP-0085 validation against a locally built stellar/quickstart:nightly-next at protocol 28 (core c444c073, rpc protocol-next, horizon protocol-next). It drove the full matrix: atomic fleet upgrade, the protocol-enforced storage invariants, self-update and deferred application, TTL scoping, get_address_executable, and the classic-op deploy path above. 28 transactions, all successful.

Not yet run: this repo's own test suite. cargo check -p soroban-cli --all-targets is clean, but build_create_contract_tx changed signature and soroban-spec-tools gained match arms, so CI is worth watching.

Draft until rs-soroban-sdk#1929 lands and the soroban-* patches can re-point at a stellar/ rev.