Merge branch 'main' into main

Author: Toromo7

.github/workflows/backend-governance.yml

@@ -42,4 +42,7 @@ jobs:
             echo "❌ openapi.json is out of date. Run 'npm run generate:openapi' locally and commit the changes."
             git diff openapi.json
             exit 1
-          fi
+          fi
+
+      - name: Check for database schema drift
+        run: npm run db:check-drift

.github/workflows/cypress.yml

@@ -0,0 +1,47 @@
+name: Cypress Smoke Tests
+
+on:
+  pull_request:
+    paths:
+      - 'frontend/**'
+  push:
+    branches:
+      - main
+    paths:
+      - 'frontend/**'
+
+jobs:
+  cypress-run:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        working-directory: frontend
+        run: npm ci
+
+      - name: Cypress run
+        uses: cypress-io/github-action@v6
+        with:
+          working-directory: frontend
+          start: npm run dev
+          wait-on: 'http://localhost:5173'
+          browser: chrome
+          spec: cypress/e2e/smoke.cy.ts
+        env:
+          CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}
+
+      - name: Upload screenshots on failure
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-screenshots
+          path: frontend/cypress/screenshots

.github/workflows/rust-wasm.yml

@@ -83,4 +83,40 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: wasm-artifacts
-          path: artifacts/wasm
+          path: artifacts/wasm
+
+  testnet-deploy:
+    name: Testnet deploy & smoke test
+    runs-on: ubuntu-latest
+    needs: wasm-build
+    # Only run on push to main — not on pull requests
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download WASM artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: wasm-artifacts
+          path: artifacts/wasm
+
+      - name: Verify vault WASM is present
+        run: ls -la artifacts/wasm/
+
+      - name: Install Stellar CLI
+        uses: stellar/stellar-cli@v23.0.1
+
+      - name: Deploy contract and run smoke test
+        env:
+          TESTNET_SECRET_KEY: ${{ secrets.TESTNET_SECRET_KEY }}
+          TESTNET_TOKEN_ADDRESS: ${{ secrets.TESTNET_TOKEN_ADDRESS }}
+          GIT_SHA: ${{ github.sha }}
+        run: bash contracts/vault/scripts/smoke-test.sh
+
+      - name: Upload deployment artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: testnet-deployment
+          path: deployment.json
+          retention-days: 7

.kiro/specs/redis-rate-limiting/.config.kiro

@@ -0,0 +1 @@
+{"specId": "1e0f4317-5877-48ed-83d6-8c0622026c5f", "workflowType": "requirements-first", "specType": "feature"}