Repo context. accensa-contracts holds the on-chain half of Accensa: ReceiptAnchor
(Merkle batch anchoring so an agent can verify it was charged correctly without trusting
the seller's API) and RefundVault (policy-bounded refunds without the merchant becoming
a custodian). Both are deployed on testnet. soroban-sdk 27.0.4, MIT. Read README.md,
docs/SECURITY_MODEL.md and DEPLOYMENTS.md before starting.
Problem
Two gaps in .github/workflows/ci.yml, both small and both the kind that only bite once.
release-with-logs is never built. The root Cargo.toml defines it:
[profile.release-with-logs]
inherits = "release"
debug-assertions = true
Nothing in CI builds it. debug-assertions = true re-enables overflow panics and SDK debug
paths that the plain release profile compiles out, so this profile can stop compiling — or start
tripping an assertion — and nobody finds out until the one time somebody reaches for it to debug
a live problem, which is the worst possible moment.
No dependency audit. There is no cargo audit or cargo deny job, so a published advisory
against anything in the tree lands with no signal.
What to do
- Add a CI step that builds
--profile release-with-logs --target wasm32v1-none. It does not
need its own job; appending to build-wasm is fine.
- Add a job running
cargo audit (or cargo deny check advisories bans licenses sources).
Commit the config file if you use cargo-deny.
Note on scope
--locked is tracked separately in #171 — do not duplicate it here. If you want to take both,
say so on that issue and close this one's overlap explicitly.
Acceptance criteria
- CI builds
release-with-logs for wasm32v1-none on every PR.
- A dependency-advisory job runs on every PR and on a weekly schedule.
- Both jobs are required to pass, not
continue-on-error.
Problem
Two gaps in
.github/workflows/ci.yml, both small and both the kind that only bite once.release-with-logsis never built. The rootCargo.tomldefines it:Nothing in CI builds it.
debug-assertions = truere-enables overflow panics and SDK debugpaths that the plain release profile compiles out, so this profile can stop compiling — or start
tripping an assertion — and nobody finds out until the one time somebody reaches for it to debug
a live problem, which is the worst possible moment.
No dependency audit. There is no
cargo auditorcargo denyjob, so a published advisoryagainst anything in the tree lands with no signal.
What to do
--profile release-with-logs --target wasm32v1-none. It does notneed its own job; appending to
build-wasmis fine.cargo audit(orcargo deny check advisories bans licenses sources).Commit the config file if you use
cargo-deny.Note on scope
--lockedis tracked separately in #171 — do not duplicate it here. If you want to take both,say so on that issue and close this one's overlap explicitly.
Acceptance criteria
release-with-logsforwasm32v1-noneon every PR.continue-on-error.