feat(ops): add ELK logging scaffold for issue #572

.commitlintrc.json

@@ -0,0 +1,3 @@
+{
+  "extends": ["@commitlint/config-conventional"]
+}

.env.example

@@ -0,0 +1,51 @@
+# Server Configuration
+PORT=3000
+NODE_ENV=development
+CORS_ALLOWED_ORIGINS=http://localhost:3000,http://localhost:5173
+
+# API Keys (comma-separated for multiple keys, legacy auth)
+API_KEYS=your-api-key-here,another-api-key
+
+# JWT Authentication (#245)
+JWT_SECRET=change-me-use-a-long-random-secret
+
+# Stellar Configuration
+# Default network when X-Network header is absent (testnet | mainnet)
+STELLAR_NETWORK=testnet
+
+# Testnet
+TESTNET_RPC_URL=https://soroban-testnet.stellar.org
+TESTNET_STREAM_CONTRACT_ID=your-testnet-stream-contract-id
+TESTNET_TOKEN_CONTRACT_ID=your-testnet-token-contract-id
+TESTNET_DATABASE_URL=postgres://paystream:password@localhost:5432/paystream_testnet
+
+# Mainnet
+MAINNET_RPC_URL=https://mainnet.stellar.validationcloud.io/v1/soroban/rpc
+MAINNET_STREAM_CONTRACT_ID=your-mainnet-stream-contract-id
+MAINNET_TOKEN_CONTRACT_ID=your-mainnet-token-contract-id
+MAINNET_DATABASE_URL=postgres://paystream:password@localhost:5432/paystream_mainnet
+
+# Redis Configuration (for BullMQ job queue)
+REDIS_URL=redis://localhost:6379
+
+# Optional dependency probes
+DATABASE_URL=postgres://paystream:password@localhost:5432/paystream
+REDIS_URL=redis://127.0.0.1:6379
+
+# AWS Secrets Manager
+USE_AWS_SECRETS_MANAGER=false
+AWS_SECRETS_MANAGER_SECRET_NAME=paystream/secrets
+AWS_REGION=us-east-1
+
+# Rate Limiting
+RATE_LIMIT_WINDOW_MS=900000
+RATE_LIMIT_MAX_REQUESTS=100
+
+# Logging
+LOG_LEVEL=info
+
+# APM — Application Performance Monitoring (#300)
+# Alert threshold: p99 latency above this value (ms) triggers a log alert
+APM_ALERT_P99_MS=2000
+# Rolling window size for latency percentile calculation (samples per route)
+APM_MAX_SAMPLES=1000

.github/CODEOWNERS

@@ -0,0 +1,20 @@
+# Smart contract files
+/contracts/ @security-team
+src/lib.rs @security-team
+src/contract*.rs @security-team
+
+# CI/CD pipelines and configuration
+.github/workflows/ @devops-team
+Dockerfile @devops-team
+docker-compose.yml @devops-team
+Makefile @devops-team
+
+# Root configuration files
+Cargo.toml @devops-team
+Cargo.lock @devops-team
+rust-toolchain.toml @devops-team
+
+# Documentation and policies
+SECURITY.md @security-team
+CONTRIBUTING.md @security-team
+DEPLOYMENT_CHECKLIST.md @devops-team

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,33 @@
+---
+name: Bug Report
+about: Report a bug to help us improve
+title: "[BUG] "
+labels: bug
+assignees: ''
+
+---
+
+## Description
+A clear and concise description of what the bug is.
+
+## Steps to Reproduce
+1. Go to '...'
+2. Click on '...'
+3. See error
+
+## Expected Behavior
+A clear description of what you expected to happen.
+
+## Actual Behavior
+What actually happened instead.
+
+## Environment
+- OS: [e.g., macOS, Linux]
+- Rust version: [output of `rustc --version`]
+- Soroban SDK version: [e.g., 22.0.0]
+
+## Additional Context
+Any other context about the problem here.
+
+## References
+See [CONTRIBUTING.md](../CONTRIBUTING.md) for contribution guidelines.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,26 @@
+---
+name: Feature Request
+about: Suggest an idea for this project
+title: "[FEATURE] "
+labels: enhancement
+assignees: ''
+
+---
+
+## Description
+A clear and concise description of the feature you'd like to see.
+
+## Use Case
+Explain the problem your feature solves. What's the user benefit?
+
+## Proposed Solution
+How do you think this feature should work?
+
+## Alternatives Considered
+Any alternative approaches you've considered.
+
+## Additional Context
+Any other context or screenshots.
+
+## References
+See [CONTRIBUTING.md](../CONTRIBUTING.md) for contribution guidelines.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,31 @@
+## Description
+Brief description of the changes in this PR.
+
+## Type of Change
+- [ ] Bug fix (non-breaking change that fixes an issue)
+- [ ] New feature (non-breaking change that adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to change)
+- [ ] Documentation update
+- [ ] Chore (dependency updates, configuration changes)
+
+## Changes Checklist
+- [ ] My code follows the style guidelines of this project
+- [ ] I have performed a self-review of my own code
+- [ ] I have commented my code, particularly in hard-to-understand areas
+- [ ] I have made corresponding changes to the documentation
+- [ ] My changes generate no new warnings
+- [ ] I have added tests that prove my fix is effective or that my feature works
+- [ ] New and existing unit tests pass locally with my changes
+- [ ] Any dependent changes have been merged and published
+
+## Testing
+Describe the tests you ran and how to reproduce them.
+
+## Breaking Changes
+Describe any breaking changes and migration path for users.
+
+## References
+Closes #
+
+---
+See [CONTRIBUTING.md](../CONTRIBUTING.md) for more details.

.github/dependabot.yml

@@ -0,0 +1,61 @@
+version: 2
+updates:
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      patch-updates:
+        update-types:
+          - "patch"
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      patch-updates:
+        update-types:
+          - "patch"
+
+  - package-ecosystem: "npm"
+    directory: "/demo"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      patch-updates:
+        update-types:
+          - "patch"
+
+  - package-ecosystem: "npm"
+    directory: "/sdk"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      patch-updates:
+        update-types:
+          - "patch"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore"
+      include: "scope"

.github/workflows/audit.yml

@@ -0,0 +1,32 @@
+name: Security Audit
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly scan every Monday at 08:00 UTC
+    - cron: "0 8 * * 1"
+
+jobs:
+  audit:
+    name: cargo audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo audit binary
+        uses: actions/cache@v5
+        with:
+          path: ~/.cargo/bin/cargo-audit
+          key: cargo-audit-${{ runner.os }}-v0.21
+
+      - name: Install cargo-audit
+        run: cargo install --locked cargo-audit
+
+      - name: Run cargo audit
+        run: cargo audit --deny warnings

.github/workflows/canary-deploy.yml

@@ -0,0 +1,93 @@
+name: Canary Deployment
+
+on:
+  workflow_dispatch:
+    inputs:
+      new_wasm_hash:
+        description: "WASM hash of the new contract version to canary"
+        required: true
+      network:
+        description: "Target network (testnet or mainnet)"
+        required: true
+        default: testnet
+
+env:
+  CANARY_TRAFFIC_PERCENT: 5
+  HEALTHY_DURATION_SECONDS: 3600   # 1 hour of healthy canary before full rollout
+  ERROR_RATE_THRESHOLD: 0.01       # 1% error rate triggers rollback
+
+jobs:
+  canary:
+    name: Canary Rollout
+    runs-on: ubuntu-latest
+    environment: ${{ github.event.inputs.network }}
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install Stellar CLI
+        run: |
+          curl -sSL https://github.com/stellar/stellar-cli/releases/latest/download/stellar-cli-x86_64-unknown-linux-gnu.tar.gz | tar xz
+          sudo mv stellar /usr/local/bin/
+
+      - name: Route 5% traffic to canary
+        env:
+          STELLAR_SECRET_KEY: ${{ secrets.STELLAR_SECRET_KEY }}
+          STREAM_CONTRACT_ID: ${{ secrets.STREAM_CONTRACT_ID }}
+        run: |
+          echo "Routing ${CANARY_TRAFFIC_PERCENT}% traffic to new WASM hash: ${{ github.event.inputs.new_wasm_hash }}"
+          stellar contract invoke \
+            --id "$STREAM_CONTRACT_ID" \
+            --source "$STELLAR_SECRET_KEY" \
+            --network ${{ github.event.inputs.network }} \
+            -- set_canary \
+            --wasm_hash "${{ github.event.inputs.new_wasm_hash }}" \
+            --traffic_percent "$CANARY_TRAFFIC_PERCENT"
+
+      - name: Monitor canary for 1 hour
+        env:
+          STELLAR_SECRET_KEY: ${{ secrets.STELLAR_SECRET_KEY }}
+          STREAM_CONTRACT_ID: ${{ secrets.STREAM_CONTRACT_ID }}
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          END=$((SECONDS + HEALTHY_DURATION_SECONDS))
+          while [ $SECONDS -lt $END ]; do
+            ERROR_RATE=$(stellar contract invoke \
+              --id "$STREAM_CONTRACT_ID" \
+              --source "$STELLAR_SECRET_KEY" \
+              --network ${{ github.event.inputs.network }} \
+              -- canary_error_rate 2>/dev/null || echo "1")
+
+            echo "Current canary error rate: $ERROR_RATE"
+
+            # Rollback if error rate exceeds threshold
+            if awk "BEGIN {exit !($ERROR_RATE > $ERROR_RATE_THRESHOLD)}"; then
+              echo "Error rate $ERROR_RATE exceeds threshold $ERROR_RATE_THRESHOLD — rolling back"
+              stellar contract invoke \
+                --id "$STREAM_CONTRACT_ID" \
+                --source "$STELLAR_SECRET_KEY" \
+                --network ${{ github.event.inputs.network }} \
+                -- rollback_canary
+              curl -s -X POST "$SLACK_WEBHOOK_URL" \
+                -H 'Content-type: application/json' \
+                --data "{\"text\":\"🚨 Canary rollback triggered: error rate $ERROR_RATE exceeded threshold $ERROR_RATE_THRESHOLD\"}"
+              exit 1
+            fi
+
+            sleep 60
+          done
+          echo "Canary healthy for ${HEALTHY_DURATION_SECONDS}s"
+
+      - name: Full rollout
+        env:
+          STELLAR_SECRET_KEY: ${{ secrets.STELLAR_SECRET_KEY }}
+          STREAM_CONTRACT_ID: ${{ secrets.STREAM_CONTRACT_ID }}
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          stellar contract invoke \
+            --id "$STREAM_CONTRACT_ID" \
+            --source "$STELLAR_SECRET_KEY" \
+            --network ${{ github.event.inputs.network }} \
+            -- promote_canary
+          curl -s -X POST "$SLACK_WEBHOOK_URL" \
+            -H 'Content-type: application/json' \
+            --data "{\"text\":\"✅ Canary promoted to full rollout: ${{ github.event.inputs.new_wasm_hash }}\"}"