Upgrade-authority timelock (48h delay)

[truthixify]

Extra labels: security, governance
Tier: L (5-7 days) | Type: security + governance

Context. set_upgrade_authority and upgrade are single-tx today. Users can't audit an incoming upgrade. Introduce a 48h queue so any upgrade is publicly announced first. Admin can cancel during the window.

Scope.

• Timelock struct queuing upgrade + authority-rotation ops.
• Cancel path available to admin.
• Adversarial tests: cancelled-then-replayed upgrade, timelock bypass attempt, admin rotation during pending upgrade.
• Update GOVERNANCE.md + MAINNET_READINESS.md.

Acceptance.

• Timelock enforces 48h in cargo test --workspace
• Adversarial replay / bypass / rotation tests pass
• MAINNET_READINESS.md reflects timelock as checked
• Emits UpgradeQueued, UpgradeCancelled, UpgradeApplied events

Files. contracts/*/src/upgrade.rs, integration-tests/upgrade_auth.rs, GOVERNANCE.md, MAINNET_READINESS.md.

[drips-wave]

Congratulations, @1MAGNOVA! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @1MAGNOVA: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[6akola]

@6akola has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Please, I would like to work on this issue.
Thank you.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @6akola to this issue.

[Faree-code]

@Faree-code has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello Maintainer! I’ve reviewed the requirements and understand the timelocked upgrade governance flow. I’m confident I can implement the 48-hour timelock, cancellation path, required events, adversarial tests, and documentation updates. Please assign it to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Faree-code to this issue.

[OlaBakare]

@OlaBakare has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi, I would like to work on this issue. I can handle it.
Thank you.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @OlaBakare to this issue.

[Hunterly01]

@Hunterly01 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I would love to work on this issue professionally, please assign it to me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Hunterly01 to this issue.

[MoscowDev]

@MoscowDev has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I'd be happy to take this issue on. I have experience building production-ready applications and collaborating effectively through GitHub workflows, including implementing features, resolving bugs, and submitting well-documented pull requests.

I'll carefully review the existing implementation, identify the root cause, and deliver a robust, maintainable solution that aligns with the project's architecture and coding standards. Before submitting my PR, I'll thoroughly test the changes to ensure reliability and avoid regressions.

My goal is to contribute high-quality, clean, and maintainable code while communicating clearly throughout the process and delivering a dependable solution in a timely manner.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @MoscowDev to this issue.

[Kaybee973]

@Kaybee973 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I’m interested in working on this issue and have experience fixing similar problems. I’d be happy to contribute.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Kaybee973 to this issue.