Implement CAP-0085 create-contract admission validation

Thread ledgerVersion through TransactionFrameBase::validateHostFn and
accept CONTRACT_EXECUTABLE_EXTERNAL_REF for FROM_ADDRESS CREATE_CONTRACT /
CREATE_CONTRACT_V2 starting at EXTERNAL_EXECUTABLE_REF_PROTOCOL_VERSION
(protocol 28), matching CAP-0085 ("InvokeHostFunctionOp update") and the
p28 host (rs-soroban-env#1703). Removes the SPIKE TODO that had left
external-ref creates rejected core-side. FROM_ASSET still requires
STELLAR_ASSET; non-next behavior unchanged.

Adds a gated TransactionQueue section covering both host-fn variants
(external-ref accepted at p28 / rejected below it, FROM_ASSET+external-ref
rejected).

Author: sisuresh

src/herder/TransactionQueue.cpp

@@ -526,7 +526,7 @@ TransactionQueue::canAdd(
                          txSOROBAN_INVALID, diagnosticEvents.finalize());
     }
 
-    if (!tx->validateHostFn())
+    if (!tx->validateHostFn(ledgerVersion))
     {
         return AddResult(TransactionQueue::AddResultCode::ADD_STATUS_ERROR, *tx,
                          txSOROBAN_INVALID, diagnosticEvents.finalize());

src/herder/test/TransactionQueueTests.cpp

@@ -24,6 +24,7 @@
 #include "transactions/TransactionBridge.h"
 #include "transactions/TransactionUtils.h"
 #include "transactions/test/SorobanTxTestUtils.h"
+#include "util/ProtocolVersion.h"
 #include "util/Timer.h"
 #include "util/numeric128.h"
 #include "xdr/Stellar-transaction.h"
@@ -1264,7 +1265,7 @@ TEST_CASE("Soroban tx filtering", "[soroban][transactionqueue]")
                 TransactionQueue::AddResultCode::ADD_STATUS_ERROR);
     }
 
-    auto runInvalidCreateContractTest =
+    auto makeCreateContractTx =
         [&](HostFunctionType hostFnType, ContractIDPreimageType preimageType,
             ContractExecutableType executableType) {
             Operation createOp;
@@ -1290,6 +1291,14 @@ TEST_CASE("Soroban tx filtering", "[soroban][transactionqueue]")
                 {
                     exec.wasm_hash() = sha256(wasm.data);
                 }
+#ifdef CAP_0085_EXECUTABLE_REF
+                else if (executableType == CONTRACT_EXECUTABLE_EXTERNAL_REF)
+                {
+                    exec.external_ref().executable_owner =
+                        makeContractAddress(sha256("owner"));
+                    exec.external_ref().tag = "tag";
+                }
+#endif
             };
 
             if (hostFnType == HOST_FUNCTION_TYPE_CREATE_CONTRACT)
@@ -1305,9 +1314,16 @@ TEST_CASE("Soroban tx filtering", "[soroban][transactionqueue]")
                     createHF.createContractV2().executable);
             }
 
-            auto tx = sorobanTransactionFrameFromOpsWithTotalFee(
+            return sorobanTransactionFrameFromOpsWithTotalFee(
                 app->getNetworkID(), a1, {createOp}, {}, resources,
                 uploadResourceFee + 100, uploadResourceFee);
+        };
+
+    auto runInvalidCreateContractTest =
+        [&](HostFunctionType hostFnType, ContractIDPreimageType preimageType,
+            ContractExecutableType executableType) {
+            auto tx =
+                makeCreateContractTx(hostFnType, preimageType, executableType);
             auto feeBumpTx =
                 feeBump(*app, feeBumper, tx, uploadResourceFee + 200);
 
@@ -1336,6 +1352,35 @@ TEST_CASE("Soroban tx filtering", "[soroban][transactionqueue]")
                                      CONTRACT_ID_PREIMAGE_FROM_ADDRESS,
                                      CONTRACT_EXECUTABLE_STELLAR_ASSET);
     }
+
+#ifdef CAP_0085_EXECUTABLE_REF
+    SECTION("CAP-0085 external ref executable")
+    {
+        uint32_t const gate =
+            static_cast<uint32_t>(EXTERNAL_EXECUTABLE_REF_PROTOCOL_VERSION);
+
+        // FROM_ADDRESS + external ref is accepted starting at the CAP-0085
+        // protocol version and rejected just below it, for both host-fn
+        // variants.
+        for (auto hostFnType : {HOST_FUNCTION_TYPE_CREATE_CONTRACT,
+                                HOST_FUNCTION_TYPE_CREATE_CONTRACT_V2})
+        {
+            auto tx = makeCreateContractTx(hostFnType,
+                                           CONTRACT_ID_PREIMAGE_FROM_ADDRESS,
+                                           CONTRACT_EXECUTABLE_EXTERNAL_REF);
+            REQUIRE(tx->validateHostFn(gate));
+            REQUIRE_FALSE(tx->validateHostFn(gate - 1));
+        }
+
+        // FROM_ASSET + external ref stays rejected.
+        runInvalidCreateContractTest(HOST_FUNCTION_TYPE_CREATE_CONTRACT,
+                                     CONTRACT_ID_PREIMAGE_FROM_ASSET,
+                                     CONTRACT_EXECUTABLE_EXTERNAL_REF);
+        runInvalidCreateContractTest(HOST_FUNCTION_TYPE_CREATE_CONTRACT_V2,
+                                     CONTRACT_ID_PREIMAGE_FROM_ASSET,
+                                     CONTRACT_EXECUTABLE_EXTERNAL_REF);
+    }
+#endif
 }
 
 TEST_CASE("TransactionQueue Key Filtering", "[soroban][transactionqueue]")

src/transactions/FeeBumpTransactionFrame.cpp

@@ -544,9 +544,9 @@ FeeBumpTransactionFrame::validateSorobanMemo() const
 }
 
 bool
-FeeBumpTransactionFrame::validateHostFn() const
+FeeBumpTransactionFrame::validateHostFn(uint32_t ledgerVersion) const
 {
-    return mInnerTx->validateHostFn();
+    return mInnerTx->validateHostFn(ledgerVersion);
 }
 
 int64_t

src/transactions/FeeBumpTransactionFrame.h

@@ -149,7 +149,7 @@ class FeeBumpTransactionFrame : public TransactionFrameBase
     bool validateAccountFilterForFlooding(
         std::set<AccountID> const& filteredAccounts) const override;
     bool validateSorobanMemo() const override;
-    bool validateHostFn() const override;
+    bool validateHostFn(uint32_t ledgerVersion) const override;
 
     int64_t getFullFee() const override;
     int64_t getInclusionFee() const override;

src/transactions/TransactionFrame.cpp

@@ -354,7 +354,7 @@ TransactionFrame::validateAccountFilterForFlooding(
 }
 
 bool
-TransactionFrame::validateHostFn() const
+TransactionFrame::validateHostFn(uint32_t ledgerVersion) const
 {
     if (!isSoroban())
     {
@@ -376,28 +376,35 @@ TransactionFrame::validateHostFn() const
     auto const& hostFn = op.body.invokeHostFunctionOp().hostFunction;
 
     auto validateCreateContract =
-        [](ContractIDPreimage const& preimage,
-           ContractExecutable const& executable) -> bool {
+        [ledgerVersion](ContractIDPreimage const& preimage,
+                        ContractExecutable const& executable) -> bool {
         if (preimage.type() == CONTRACT_ID_PREIMAGE_FROM_ASSET &&
             executable.type() != CONTRACT_EXECUTABLE_STELLAR_ASSET)
         {
             return false;
         }
-        // TODO(CAP-0085, SPIKE): once the p28 host acceptance logic
-        // (rs-soroban-env#1703) and the CAP-0085 spec are cross-checked, relax
-        // this to also accept CONTRACT_EXECUTABLE_EXTERNAL_REF for FROM_ADDRESS
-        // creates when
-        //   protocolVersionStartsFrom(ledgerVersion,
-        //                             EXTERNAL_EXECUTABLE_REF_PROTOCOL_VERSION).
-        // That requires threading ledgerVersion (from the current LCL header)
-        // through the virtual validateHostFn() interface
-        // (TransactionFrameBase.h + the FeeBump/TestFrame overrides + the
-        // TransactionQueue caller). Deferred for this SPIKE: external-ref creates
-        // stay rejected core-side, which keeps existing behavior/tests intact.
-        if (preimage.type() == CONTRACT_ID_PREIMAGE_FROM_ADDRESS &&
-            executable.type() != CONTRACT_EXECUTABLE_WASM)
-        {
-            return false;
+        if (preimage.type() == CONTRACT_ID_PREIMAGE_FROM_ADDRESS)
+        {
+            bool validExecutable =
+                executable.type() == CONTRACT_EXECUTABLE_WASM;
+#ifdef CAP_0085_EXECUTABLE_REF
+            // CAP-0085: FROM_ADDRESS creates may also target an external
+            // executable reference starting at the CAP-0085 protocol version.
+            // CREATE_CONTRACT / CREATE_CONTRACT_V2 resolve
+            // CONTRACT_EXECUTABLE_EXTERNAL_REF with the same semantics as
+            // create_external_ref_contract (CAP-0085 spec, InvokeHostFunctionOp
+            // update). The host enforces reference validity (rs-soroban-env
+            // frame.rs); this admission check only gates the executable type.
+            validExecutable =
+                validExecutable ||
+                (protocolVersionStartsFrom(
+                     ledgerVersion, EXTERNAL_EXECUTABLE_REF_PROTOCOL_VERSION) &&
+                 executable.type() == CONTRACT_EXECUTABLE_EXTERNAL_REF);
+#endif
+            if (!validExecutable)
+            {
+                return false;
+            }
         }
         return true;
     };

src/transactions/TransactionFrame.h

@@ -224,7 +224,7 @@ class TransactionFrame : public TransactionFrameBase
     bool validateAccountFilterForFlooding(
         std::set<AccountID> const& filteredAccounts) const override;
     bool validateSorobanMemo() const override;
-    bool validateHostFn() const override;
+    bool validateHostFn(uint32_t ledgerVersion) const override;
 
     int64_t getFullFee() const override;
     int64_t getInclusionFee() const override;

src/transactions/TransactionFrameBase.h

@@ -230,7 +230,7 @@ class TransactionFrameBase
     virtual bool validateAccountFilterForFlooding(
         std::set<AccountID> const& filteredAccounts) const = 0;
     virtual bool validateSorobanMemo() const = 0;
-    virtual bool validateHostFn() const = 0;
+    virtual bool validateHostFn(uint32_t ledgerVersion) const = 0;
 
     // Returns the total fee of this transaction, including the 'flat',
     // non-market part.

src/transactions/test/TransactionTestFrame.cpp

@@ -219,9 +219,9 @@ TransactionTestFrame::validateSorobanMemo() const
 }
 
 bool
-TransactionTestFrame::validateHostFn() const
+TransactionTestFrame::validateHostFn(uint32_t ledgerVersion) const
 {
-    return mTransactionFrame->validateHostFn();
+    return mTransactionFrame->validateHostFn(ledgerVersion);
 }
 
 int64_t

src/transactions/test/TransactionTestFrame.h

@@ -108,7 +108,7 @@ class TransactionTestFrame : public TransactionFrameBase
     bool validateAccountFilterForFlooding(
         std::set<AccountID> const& filteredAccounts) const override;
     bool validateSorobanMemo() const override;
-    bool validateHostFn() const override;
+    bool validateHostFn(uint32_t ledgerVersion) const override;
 
     // Returns the total fee of this transaction, including the 'flat',
     // non-market part.