docs(security): add time manipulation analysis and non-monotonic timestamp tests

.github/workflows/ci.yml

@@ -34,13 +34,13 @@ jobs:
           restore-keys: ${{ runner.os }}-cargo-
 
       - name: Check formatting
-        run: cargo fmt --check
+        run: make fmt-check
 
       - name: Clippy
-        run: cargo clippy --all-targets -- -D warnings
+        run: make lint
 
       - name: Test
-        run: cargo test
+        run: make test
 
   coverage:
     name: Coverage

.github/workflows/staging.yml

@@ -0,0 +1,111 @@
+name: Deploy Staging
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: staging-deploy
+  cancel-in-progress: false
+
+jobs:
+  deploy-staging:
+    name: Deploy to Stellar Testnet (Staging)
+    runs-on: ubuntu-latest
+    environment: staging
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            ~/.cargo/bin
+            target
+          key: ${{ runner.os }}-cargo-staging-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-staging-
+
+      - name: Install Stellar CLI
+        run: cargo install --locked stellar-cli --features opt
+
+      - name: Build contracts
+        run: stellar contract build
+
+      - name: Configure Stellar CLI for testnet
+        run: |
+          stellar network add testnet \
+            --rpc-url https://soroban-testnet.stellar.org \
+            --network-passphrase "Test SDF Network ; September 2015" || true
+
+      - name: Import staging deployer key
+        run: |
+          echo "${{ secrets.STAGING_DEPLOYER_SECRET }}" | \
+            stellar keys add staging-deployer --secret-key
+
+      - name: Deploy token contract
+        id: deploy-token
+        run: |
+          TOKEN_ID=$(stellar contract deploy \
+            --wasm target/wasm32-unknown-unknown/release/paystream_token.wasm \
+            --source staging-deployer \
+            --network testnet)
+          echo "token_id=$TOKEN_ID" >> "$GITHUB_OUTPUT"
+          echo "Deployed token: $TOKEN_ID"
+
+      - name: Deploy stream contract
+        id: deploy-stream
+        run: |
+          STREAM_ID=$(stellar contract deploy \
+            --wasm target/wasm32-unknown-unknown/release/paystream_stream.wasm \
+            --source staging-deployer \
+            --network testnet)
+          echo "stream_id=$STREAM_ID" >> "$GITHUB_OUTPUT"
+          echo "Deployed stream: $STREAM_ID"
+
+      - name: Initialise contracts
+        env:
+          STAGING_ADMIN: ${{ secrets.STAGING_ADMIN_ADDRESS }}
+        run: |
+          stellar contract invoke \
+            --id "${{ steps.deploy-token.outputs.token_id }}" \
+            --source staging-deployer \
+            --network testnet \
+            -- initialize \
+              --admin "$STAGING_ADMIN" \
+              --initial_supply 1000000000000
+
+          stellar contract invoke \
+            --id "${{ steps.deploy-stream.outputs.stream_id }}" \
+            --source staging-deployer \
+            --network testnet \
+            -- initialize \
+              --admin "$STAGING_ADMIN"
+
+      - name: Smoke test — stream_count returns 0
+        run: |
+          COUNT=$(stellar contract invoke \
+            --id "${{ steps.deploy-stream.outputs.stream_id }}" \
+            --source staging-deployer \
+            --network testnet \
+            -- stream_count)
+          echo "stream_count=$COUNT"
+          [ "$COUNT" = "0" ] || (echo "Expected 0, got $COUNT" && exit 1)
+
+      - name: Write staging contract IDs to summary
+        run: |
+          echo "## Staging Deployment" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Contract | ID |" >> "$GITHUB_STEP_SUMMARY"
+          echo "|---|---|" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Token | \`${{ steps.deploy-token.outputs.token_id }}\` |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Stream | \`${{ steps.deploy-stream.outputs.stream_id }}\` |" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "Network: Stellar Testnet" >> "$GITHUB_STEP_SUMMARY"

.gitignore

@@ -4,4 +4,10 @@ target/
 .agents/
 .claude/
 skills-lock.json
-issue.md
+issue.md
+
+# Node.js
+node_modules/
+dist/
+build/
+.tsbuildinfo