Merge branch 'main' into feat/appeal-window

Author: jhayniffy

.claude/settings.json

@@ -0,0 +1,10 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(find /home/ljtwp/Desktop/drips/niff -type f -name *.sol -o -name *.rs -o -name *.ts -o -name *.tsx -o -name *.js -o -name *.jsx)",
+      "Bash(cargo test:*)",
+      "Bash(cargo fmt:*)",
+      "Bash(cargo clippy:*)"
+    ]
+  }
+}

contracts/niffyinsure/src/claim.rs

@@ -468,6 +468,7 @@ impl NiffyInsure {
             terminated_at_ledger: 0,
             termination_reason: TerminationReason::None,
             terminated_by_admin: false,
+            strike_count: 0,
         };
         env.storage().persistent().set(
             &storage::DataKey::Policy(holder.clone(), policy_id),

contracts/niffyinsure/src/lib.rs

@@ -272,6 +272,7 @@ pub fn initiate_policy(
         terminated_at_ledger: 0,
         termination_reason: crate::types::TerminationReason::None,
         terminated_by_admin: false,
+        strike_count: 0,
     };
 
     validate::check_policy(&policy).map_err(|_| PolicyError::PolicyValidation)?;

contracts/niffyinsure/src/policy.rs

@@ -66,6 +66,7 @@ pub fn initiate_policy(
         terminated_at_ledger: 0,
         termination_reason: TerminationReason::None,
         terminated_by_admin: false,
+        strike_count: 0,
     };
 
     validate::check_policy(&policy).map_err(|e| match e {
@@ -212,5 +213,10 @@ fn termination_reason_tag(reason: TerminationReason) -> u32 {
         TerminationReason::FraudOrMisrepresentation => 4,
         TerminationReason::RegulatoryAction => 5,
         TerminationReason::AdminOverride => 6,
+        // 7 = ExcessiveRejections: set by the claims engine via on_reject,
+        // not by the policy-lifecycle termination flow. Included here for
+        // completeness; PolicyTerminated is not normally emitted for this
+        // reason — PolicyDeactivated (from claim.rs) is the canonical event.
+        TerminationReason::ExcessiveRejections => 7,
     }
 }

contracts/niffyinsure/src/policy_lifecycle.rs

@@ -7,6 +7,25 @@ pub const IMAGE_URLS_MAX: u32 = 5;
 pub const REASON_MAX_LEN: u32 = 128;
 pub const SAFETY_SCORE_MAX: u32 = 100;
 
+// ── Rejection side-effect thresholds ─────────────────────────────────────────
+//
+// GOVERNANCE NOTE: This constant is the only on-chain parameter controlling
+// automatic policy deactivation. Changing it requires a contract upgrade and
+// cannot be altered by the admin at runtime — removing an avenue for
+// admin-only extraction via strike-count manipulation.
+//
+// LEGAL NOTE: Product/legal must sign off on the strike threshold before
+// mainnet deployment. Three rejections is a conservative starting point.
+// The threshold intentionally errs toward coverage preservation; false
+// positives (legitimate holders de-activated) are harder to recover from
+// than false negatives (fraudulent holders retained until human review).
+//
+// APPEAL INTERACTION: If an appeal window is added later, auto-deactivation
+// should be deferred until the appeal deadline passes. Implement by adding a
+// `deactivation_pending_until_ledger: u32` field to Policy and skipping the
+// `is_active = false` write until that ledger is reached.
+pub const STRIKE_DEACTIVATION_THRESHOLD: u32 = 3;
+
 // ── Ledger window constants (re-exported from ledger.rs for ABI visibility) ───
 //
 // These are the canonical values used by on-chain checks.  The frontend and
@@ -124,6 +143,15 @@ pub enum VoteOption {
 }
 
 /// Reason for policy termination.
+///
+/// GOVERNANCE NOTE: `ExcessiveRejections` is set by the claims engine
+/// automatically when `strike_count` reaches `STRIKE_DEACTIVATION_THRESHOLD`.
+/// All other variants require an explicit holder or admin action.
+///
+/// CENTRALIZATION RISK: `AdminOverride` allows the admin to terminate any
+/// policy for any reason at any time. This is a privileged operation that
+/// bypasses normal holder protections. Consider a time-lock or multi-sig
+/// requirement before using this variant in production.
 #[contracttype]
 #[derive(Clone, PartialEq, Eq, Debug)]
 pub enum TerminationReason {
@@ -134,9 +162,15 @@ pub enum TerminationReason {
     FraudOrMisrepresentation,
     RegulatoryAction,
     AdminOverride,
-    /// Policy deactivated automatically by `on_reject` when `strike_count` reached
-    /// `STRIKE_DEACTIVATION_THRESHOLD`.  Not set by admin.
-    /// **XDR append-safe:** appended at end of enum; existing serialised values unchanged.
+    /// Automatically set when `Policy.strike_count` reaches
+    /// `STRIKE_DEACTIVATION_THRESHOLD` consecutive rejections.
+    /// No admin intervention is required or possible to prevent this;
+    /// the transition is deterministic and trustless.
+    ///
+    /// APPEAL NOTE: If an appeal window is introduced, deactivation should be
+    /// deferred until the appeal window closes. The `PolicyDeactivated` event
+    /// (emitted in `claim.rs`) is the authoritative signal for indexers; it
+    /// will carry a `reason_code = 1` identifying this variant.
     ExcessiveRejections,
 }
 
@@ -199,11 +233,21 @@ pub struct Policy {
     pub terminated_by_admin: bool,
     /// Running count of rejected claims against this policy.
     ///
-    /// Incremented by `claim::on_reject`.  When `strike_count >= STRIKE_DEACTIVATION_THRESHOLD`
-    /// the policy is automatically deactivated (`is_active = false`) and a `PolicyDeactivated`
-    /// event is emitted.  A successful appeal decrements this counter.
+    /// Incremented by `claim::on_reject` every time a claim on this policy
+    /// reaches `ClaimStatus::Rejected` (whether via majority vote or deadline
+    /// finalization). Never decremented; exists purely for accumulation.
+    ///
+    /// When `strike_count >= STRIKE_DEACTIVATION_THRESHOLD`, the policy is
+    /// automatically deactivated (`is_active = false`) and the
+    /// `PolicyDeactivated` event is emitted. No admin action is required.
+    ///
+    /// RENEWAL GATE: Any future `renew_policy` implementation MUST check
+    /// `strike_count` before allowing renewal. A policy with strikes at or
+    /// near the threshold should be blocked or require admin review.
     ///
-    /// **Renewal gate:** any future `renew_policy` implementation MUST gate on this field.
+    /// DATA VISIBILITY: This field is stored on-chain and permanently
+    /// readable via `get_policy`. It carries only a count — no allegation
+    /// narratives, no claimant-identifying data.
     pub strike_count: u32,
 }
 

contracts/niffyinsure/src/types.rs

@@ -236,6 +236,14 @@
                         "u32": 1
                       }
                     },
+                    {
+                      "key": {
+                        "symbol": "strike_count"
+                      },
+                      "val": {
+                        "u32": 0
+                      }
+                    },
                     {
                       "key": {
                         "symbol": "terminated_at_ledger"

contracts/niffyinsure/test_snapshots/admin_may_bypass_open_claim_guard_when_explicitly_flagged.1.json

@@ -172,6 +172,14 @@
                         "u32": 1
                       }
                     },
+                    {
+                      "key": {
+                        "symbol": "strike_count"
+                      },
+                      "val": {
+                        "u32": 0
+                      }
+                    },
                     {
                       "key": {
                         "symbol": "terminated_at_ledger"

contracts/niffyinsure/test_snapshots/cannot_terminate_policy_under_wrong_holder_address.1.json

@@ -201,6 +201,14 @@
                         "u32": 1
                       }
                     },
+                    {
+                      "key": {
+                        "symbol": "strike_count"
+                      },
+                      "val": {
+                        "u32": 0
+                      }
+                    },
                     {
                       "key": {
                         "symbol": "terminated_at_ledger"

contracts/niffyinsure/test_snapshots/double_terminate_fails.1.json

@@ -467,6 +467,14 @@
                         "u32": 0
                       }
                     },
+                    {
+                      "key": {
+                        "symbol": "strike_count"
+                      },
+                      "val": {
+                        "u32": 0
+                      }
+                    },
                     {
                       "key": {
                         "symbol": "terminated_at_ledger"