MCMS Refactor: Replace Solidity-ABI-over-XDR leaf encoding with domain-separated byte layout

[JohnChangUK]

Summary

Replaces the Solidity-ABI-over-XDR leaf encoding with an explicit, versioned, domain-separated byte layout, and reshapes the MCMS operation/metadata types to describe the actual Soroban call.

Key changes

• abi_encoding.rs deleted → encoding.rs added: length-prefixed, domain-separated preimages (metadata 125 bytes, operation 184 in the golden vector); encoding_version checked before hashing; contract_id() rejects account addresses.
• stellar_golden_vectors.json added — normative cross-language fixture, asserted from Rust (and Go once the deployment adapter is fixed).
• StellarOp: chain_id→network_id, multisig/to become Address, data splits into function: Symbol + args_xdr: Bytes, value removed, encoding_version added.
• StellarRootMetadata: same address/naming changes, plus config_version and encoding_version.

[Copilot]

Pull request overview

Refactors MCMS-Stellar leaf hashing away from “Solidity ABI over XDR” into an explicit, versioned, domain-separated byte layout, and updates on-chain types/bindings/tests to represent Soroban invocations directly (contract Address + function Symbol + argument XDR bytes).

Changes:

• Introduces encoding.rs with domain-separated, versioned preimages for StellarRootMetadata and StellarOp (and removes abi_encoding.rs).
• Reshapes MCMS operation/metadata types (network_id, Address fields, function/args_xdr, encoding_version, config_version) and enforces these in set_root / execute.
• Adds a normative golden vector fixture and updates Rust tests plus Go bindings to match the new API/encoding.

Reviewed changes

Copilot reviewed 12 out of 14 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
contracts/mcms/testdata/stellar_golden_vectors.json	Adds normative cross-language golden vectors for the new encoding and hashes.
contracts/mcms/test_snapshots/test/test_execute_reverted_call_does_not_consume_nonce.1.json	Removes an outdated snapshot tied to the pre-refactor behavior/format.
contracts/mcms/src/types.rs	Updates on-chain structs to use Address/Symbol, add encoding_version and config_version, and split function vs args.
contracts/mcms/src/test.rs	Reworks tests to build new StellarOp/metadata shapes, adds new revert/abort/config-version behaviors, and aligns with new encoding.
contracts/mcms/src/lib.rs	Switches contract logic to new encoding, adds config versioning + instance label storage, updates validation and emitted events.
contracts/mcms/src/events.rs	Updates emitted event payloads (config_version, target/function/args_hash) and removes min-secs-per-ledger event.
contracts/mcms/src/error.rs	Adds new error variants for version/config/address/XDR validation and distinguishes CallAborted.
contracts/mcms/src/encoding.rs	New encoding + hashing module with domain-separated, length-prefixed preimages and golden-vector tests.
contracts/mcms/src/constants.rs	Adds ENCODING_VERSION and removes dynamic-validity/min-secs-per-ledger constants in favor of a fixed policy horizon.
contracts/mcms/src/abi_encoding.rs	Deleted legacy Solidity ABI encoding implementation.
contracts/mcms/Cargo.toml	Moves stellar-strkey to dev-dependencies for encoding test support.
contracts/common/interfaces/src/mcms.rs	Updates interface types and contract events to match new structs/API and new error codes.
bindings/contracts/mcms/types.go	Updates Go struct/SCVal conversions for new op/metadata layouts and error codes.
bindings/contracts/mcms/client.go	Updates Go client initialize signature and adds getters for config version / instance label; removes min-secs-per-ledger calls and event helpers.

Files not reviewed (2)

• bindings/contracts/mcms/client.go: Generated file
• bindings/contracts/mcms/types.go: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[JohnChangUK]

Not true, these tests prove the opposite

• test_execute_reverted_call_does_not_consume_nonce_and_can_retry sets the callee (ExecFailureMock::maybe_fail) to return Err(ExecMockError::Rejected) — a typed contract error — and asserts Err(Ok(McmsError::CallReverted)). ✅ passes.
• test_execute_aborted_call_is_distinct_and_does_not_consume_nonce calls ExecFailureMock::abort() (a panic!/host trap) and asserts Err(Ok(McmsError::CallAborted)). ✅ passes.