docs: SPDX headers, rustdoc coverage, audit workflow, proxy runbook

.github/workflows/nightly-security-audit.yml

@@ -8,6 +8,7 @@ on:
 
 permissions:
   contents: write
+  pull-requests: write
 
 jobs:
   audit:
@@ -84,11 +85,47 @@ jobs:
           cargo mutants -p oracle --timeout 120 2>&1 | tee -a AUDIT_LOG.md
           echo "\`\`\`" >> AUDIT_LOG.md
 
-      - name: Commit and Push Security Results to Repo
+      - name: Commit and Push Security Results to Branch
+        id: commit
         if: always()
         run: |
+          BRANCH="audit/$(date -u +%Y-%m-%d)"
           git config --global user.name "github-actions[bot]"
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
           git add AUDIT_LOG.md
-          git diff-index --quiet HEAD || git commit -m "chore(ci): update nightly AUDIT_LOG.md validation tracking profiles [skip ci]"
-          git push origin HEAD:${{ github.ref }}
+          if git diff-index --quiet HEAD; then
+            echo "No changes to commit."
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+          git checkout -B "$BRANCH"
+          git commit -m "chore(ci): update nightly AUDIT_LOG.md validation tracking profiles [skip ci]"
+          git push origin "$BRANCH"
+          echo "has_changes=true" >> $GITHUB_OUTPUT
+          echo "branch=$BRANCH" >> $GITHUB_OUTPUT
+
+      - name: Create Pull Request
+        if: steps.commit.outputs.has_changes == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh pr create \
+            --base main \
+            --head "${{ steps.commit.outputs.branch }}" \
+            --title "chore(ci): nightly AUDIT_LOG.md update — $(date -u +%Y-%m-%d)" \
+            --body "Automated daily security audit log update." \
+            --repo "${{ github.repository }}"
+
+      - name: Enable Auto-Merge on PR
+        if: steps.commit.outputs.has_changes == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          PR_URL=$(gh pr list \
+            --head "${{ steps.commit.outputs.branch }}" \
+            --json url \
+            --jq '.[0].url' \
+            --repo "${{ github.repository }}")
+          if [ -n "$PR_URL" ]; then
+            gh pr merge "$PR_URL" --auto --squash
+          fi

add-spdx.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+find "$(dirname "$0")" -name "*.rs" -type f | while read f; do
+  firstline=$(head -n 1 "$f")
+  if [ "$firstline" != "// SPDX-License-Identifier: MIT" ]; then
+    sed -i '1i // SPDX-License-Identifier: MIT' "$f"
+  fi
+done

contracts/analytics/src/lib.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg_attr(not(feature = "std"), no_std)]
 #![allow(unexpected_cfgs)]
 #![allow(clippy::new_without_default)]

contracts/analytics/src/staking_dashboard.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 use ink::primitives::AccountId;
 use ink::storage::Mapping;
 use scale::{Decode, Encode};

contracts/bridge/src/audit_log_bounded.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 pub struct BoundedAuditLog {
     pub max_records: usize,
 }

contracts/bridge/src/bridge_history_pagination.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 pub struct PaginatedBridgeHistory {
     pub max_entries_per_account: usize,
 }

contracts/bridge/src/errors.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Error types for the bridge contract (Issue #101 - extracted from lib.rs)
 
 // ---------------------------------------------------------------------------

contracts/bridge/src/lib.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg_attr(not(feature = "std"), no_std)]
 #![allow(unexpected_cfgs)]
 #![allow(

contracts/bridge/src/submodules.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 pub mod travel_rule {
     pub fn verify_travel_rule(amount: u128) -> bool {
         amount > 0

contracts/bridge/src/tests.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Unit tests for the bridge contract (Issue #101 - extracted from lib.rs)
 
 #[cfg(test)]

contracts/bridge/src/token_freeze.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 use ink::storage::Mapping;
 
 pub struct TokenFreezeManager {

contracts/bridge/src/validator_bitmap_fix.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 pub struct ValidatorBitmapSigner {
     pub max_validators: u32,
 }

contracts/bridge/src/validator_staking.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 use ink::prelude::vec::Vec;
 use ink::storage::Mapping;
 use ink::primitives::AccountId;

contracts/compliance_registry/lib.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg_attr(not(feature = "std"), no_std, no_main)]
 #![allow(
     clippy::needless_borrows_for_generic_args,

contracts/crowdfunding/src/lib.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg_attr(not(feature = "std"), no_std, no_main)]
 #![allow(
     clippy::arithmetic_side_effects,

contracts/crowdfunding/src/line.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg_attr(not(feature = "std"), no_std, no_main)]
 #![allow(
     clippy::arithmetic_side_effects,

contracts/crowdfunding/src/sequence.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg_attr(not(feature = "std"), no_std)]
 #![allow(clippy::needless_borrows_for_generic_args)]
 #![allow(clippy::too_many_arguments)]

contracts/database/src/errors.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Error types for the database contract (Issue #101 - extracted from lib.rs)
 
 #[derive(Debug, PartialEq, Eq, scale::Encode, scale::Decode)]

contracts/database/src/lib.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg_attr(not(feature = "std"), no_std)]
 #![allow(unexpected_cfgs)]
 #![allow(clippy::new_without_default)]

contracts/database/src/tests.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Unit tests for the database contract (Issue #101 - extracted from lib.rs)
 
 #[cfg(test)]

contracts/database/src/types.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Data types for the database contract (Issue #101 - extracted from lib.rs)
 
 pub type SyncId = u64;

contracts/dex/src/concentrated_liquidity.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #[derive(Clone, Debug, PartialEq)]
 pub struct LiquidityPosition {
     pub owner: [u8; 32],

contracts/dex/src/errors.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Error types for the DEX contract (Issue #101 - extracted from lib.rs)
 
 #[derive(Debug, PartialEq, Eq, scale::Encode, scale::Decode)]

contracts/dex/src/fuzz_tests.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Property-based fuzz tests for DEX swap functions (Issue #480)
 
 #[cfg(test)]

contracts/dex/src/lib.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg_attr(not(feature = "std"), no_std)]
 #![allow(unexpected_cfgs)]
 #![allow(

contracts/dex/src/path_cache.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct PathKey { pub from_token: u64, pub to_token: u64 }
 

contracts/dex/src/slippage_guard.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 pub fn check_slippage(expected_out: u128, actual_out: u128, max_bps: u32) -> Result<(), SlippageError> {
     if expected_out == 0 { return Err(SlippageError::ZeroExpected); }
     let loss = expected_out.saturating_mul(max_bps as u128).saturating_div(10_000);

contracts/dex/src/swap_invariant_tests.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #[cfg(test)]
 mod swap_invariant {
     fn cpf_swap(rx: u128, ry: u128, amt_in: u128, fee_bps: u128) -> (u128, u128, u128) {

contracts/dex/src/tests.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Unit tests for the DEX contract (Issue #101 - extracted from lib.rs)
 
 #[cfg(test)]

contracts/factory/src/builder.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Builder module for the contract factory.
 //
 // Loaded via `pub mod builder;` in `lib.rs`. The `deploy_contract` ink! message

contracts/factory/src/lib.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg_attr(not(feature = "std"), no_std)]
 
 use ink::prelude::string::String;

contracts/factory/src/templates.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 use ink::prelude::string::String;
 use ink::prelude::vec::Vec;
 use scale::{Decode, Encode};

contracts/factory/src/tests.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 use crate::contract_factory::*;
 use ink::env::test;
 use ink::primitives::Hash;

contracts/fees/src/errors.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Error types for the fees contract (Issue #101 - extracted from lib.rs)
 //
 // Enhancements over v1:

contracts/fees/src/lib.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg_attr(not(feature = "std"), no_std)]
 #![allow(unexpected_cfgs)]
 

contracts/fees/src/rounding.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 pub fn round_fee_up(amount: u128, fee_bps: u128, denominator: u128) -> u128 {
     if denominator == 0 { return 0; }
     let n = amount.saturating_mul(fee_bps);

contracts/fees/src/strategies.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Strategy implementations for fee calculation (Issue #186)
 
 pub trait FeeStrategy {

contracts/fees/src/tests.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Unit tests for the fees contract (Issue #101 - extracted from lib.rs)
 
 #[cfg(test)]

contracts/fees/src/types.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 use propchain_traits::BasisPoints;
 
 // Data types for the fees contract (Issue #101 - extracted from lib.rs)

contracts/fractional/src/lib.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg_attr(not(feature = "std"), no_std, no_main)]
 #![allow(
     clippy::needless_borrows_for_generic_args,

contracts/gdpr/lib.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg_attr(not(feature = "std"), no_std, no_main)]
 #![allow(
     clippy::needless_borrows_for_generic_args,

contracts/governance/src/delegation.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #[derive(Clone, Debug, PartialEq)]
 pub struct Delegation { pub delegator: [u8; 32], pub delegate: [u8; 32] }
 

contracts/governance/src/errors.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Error types for the governance contract (Issue #101 - extracted from lib.rs)
 
 #[derive(Debug, PartialEq, Eq, scale::Encode, scale::Decode)]

contracts/governance/src/lib.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg_attr(not(feature = "std"), no_std, no_main)]
 #![allow(
     clippy::too_many_arguments,

contracts/governance/src/snapshot_tests.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #[cfg(test)]
 mod snapshot_voting_tests {
     #[derive(Clone)]

contracts/governance/src/tests.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Unit tests for the governance contract (Issue #101 - extracted from lib.rs)
 
 #[cfg(test)]

contracts/governance/src/treasury.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #[derive(Debug, PartialEq)]
 pub enum TreasuryError { NotApproved, ExceedsSpendLimit, InsufficientFunds }
 

contracts/governance/src/types.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Data types for the governance contract (Issue #101 - extracted from lib.rs)
 
 #[derive(

contracts/hello-world/src/lib.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg_attr(target_family = "wasm", no_std)]
 use soroban_sdk::{contract, contractimpl, contracttype, symbol_short, Env, Symbol};
 

contracts/hello-world/src/test.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg(test)]
 #![allow(dead_code, unused_imports, deprecated)]
 

contracts/identity/lib.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg_attr(not(feature = "std"), no_std)]
 #![allow(unexpected_cfgs)]
 #![allow(clippy::needless_borrows_for_generic_args)]

contracts/identity/src/cross_contract_helper.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 pub struct CrossContractCaller;
 
 impl CrossContractCaller {

contracts/identity/src/dashboard.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 //! Identity Management Dashboard Interface
 //! 
 //! This module provides a high-level interface for identity management operations

contracts/identity/tests/identity_tests.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg(test)]
 #![allow(unused_variables)]
 

contracts/insurance/src/claim_evidence.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #[derive(Clone, Debug, PartialEq)]
 pub struct ClaimEvidence {
     pub claim_id: u64,

contracts/insurance/src/errors.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Error types for the insurance contract (Issue #101 - extracted from types.rs)
 
 #[derive(Debug, PartialEq, Eq, scale::Encode, scale::Decode)]

contracts/insurance/src/fraud_detection.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![allow(clippy::module_inception, dead_code, clippy::manual_checked_ops)]
 
 // Fraud Detection Implementation (Task #258)

contracts/insurance/src/lazy_reinsurance.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #[derive(Clone, Default)]
 pub struct ReinsurancePoolCache {
     loaded: bool,

contracts/insurance/src/lib.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg_attr(not(feature = "std"), no_std, no_main)]
 #![allow(
     clippy::arithmetic_side_effects,

contracts/insurance/src/premium_engine.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Dynamic premium calculation engine based on risk assessment
 // Implements actuarial pricing with real-time adjustments
 // Claim-frequency adjustment added (rolling-window surcharge)

contracts/insurance/src/premium_property_tests.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #[cfg(test)]
 mod premium_properties {
     fn calc_premium(base_rate: u128, risk_factor: u128, coverage: u128) -> u128 {

contracts/insurance/src/premium_tests.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Tests for dynamic premium calculation engine
 
 #![cfg(test)]

contracts/insurance/src/risk_assessment.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![allow(
     clippy::module_inception,
     dead_code,

contracts/insurance/src/submodules.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 pub mod claim_pipeline {
     pub fn process_claim(claim_id: u64) -> bool {
         claim_id > 0

contracts/insurance/src/sybil_tests.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #[cfg(test)]
 mod sybil_resistance {
     const MAX_CLAIMS_PER_WINDOW: u32 = 3;

contracts/insurance/src/tests.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg(test)]
 #![allow(
     dead_code,

contracts/insurance/src/types.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 // Data types for the insurance contract (Issue #101 - extracted from lib.rs)
 // Parametric insurance types added for Issue #249
 // Circuit breaker types added for Issue #494

contracts/ipfs-metadata/src/lib.rs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 #![cfg_attr(not(feature = "std"), no_std)]
 #![allow(unexpected_cfgs)]