A network safety guard exists, but contract-affecting write paths are spread across refunds, payments, Soroban tooling, registry deployment, and developer endpoints. A missed guard could submit writes to the wrong network or while a kill switch is active.
Affected areas: app/backend/src/feature-flags/network-safety.guard.ts, app/backend/src/payments/*, app/backend/src/refunds/*, app/backend/src/soroban-tooling/*, app/backend/src/contracts/*, app/backend/src/developer/*, tests/docs.
Implementation scope:
- Introduce a shared
ContractWritePolicyService.
- Require policy checks before every operation that can submit, deploy, upgrade, or mutate contract state.
- Record audit entries for blocked and allowed mainnet/testnet writes.
- Add route-level and service-level tests so guard bypasses are caught.
Acceptance criteria:
- Every backend contract write path declares a policy key.
- Kill switch blocks writes regardless of controller route.
- Audit logs identify actor, network, contract ID, operation, and decision.
A network safety guard exists, but contract-affecting write paths are spread across refunds, payments, Soroban tooling, registry deployment, and developer endpoints. A missed guard could submit writes to the wrong network or while a kill switch is active.
Affected areas:
app/backend/src/feature-flags/network-safety.guard.ts,app/backend/src/payments/*,app/backend/src/refunds/*,app/backend/src/soroban-tooling/*,app/backend/src/contracts/*,app/backend/src/developer/*, tests/docs.Implementation scope:
ContractWritePolicyService.Acceptance criteria: