register_cell asserts three things about a Cell ASA:

  :205  clawback == zero_address
  :206  freeze   == zero_address
  :207  manager  == zero_address

Only :205 had a test. test_register_rejects_clawback_cell's docstring claims
to cover "clawback (or freeze/manager)" but its fixture sets only `clawback`,
and the asserts are sequential, so it trips :205 and the other two are never
evaluated. The words freeze and manager appear in this file only in prose.
Deleting :206 and :207 turns nothing red.

Not cosmetic. A live freeze address can freeze the holder AFTER registration,
and a live manager can RE-ADD clawback and freeze afterwards - which restores
both AssetHoldingGet timing vectors the hardening closed at the source. The
manager guard is the load-bearing one: it is what makes the cell's config
immutable rather than merely clean at registration time.

Adds one fixture per guard and asserts WHICH guard fired, so a future
reordering of the three asserts cannot silently leave one uncovered again.

VERIFICATION IS INCOMPLETE, and deliberately not overstated: unlike the other
contract test added in this series, these two are NOT mutation-proved. Docker
Desktop on this machine wedged part-way through (orphaned runtime sockets that
cannot be deleted without a reboot - my own hard-kill of the process is the
likely cause), so LocalNet is unavailable and the suite cannot run here.

What HAS been checked:
  - both tests collect (24 collected, up from 22)
  - the asserted strings match the contract's messages exactly, one occurrence
    each in inscription.py and in the test
  - the fixtures mirror test_register_rejects_clawback_cell, which passes

What has NOT been checked: that they fail when :206/:207 are deleted. The CI
job in the contract-suite PR runs LocalNet successfully on a GitHub runner, so
that is where this should be confirmed.

Found by an adversarial claim-vs-enforcement sweep (TCE-19).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

release.yml had no test job. The graph was

    build -> provenance -> cosign-sign -> pypi-publish

with `build`'s only substantive step being `python -m build`, and no occurrence
of `pytest` or verify_pinned_digest anywhere in the file. A version tag
therefore produced a signed, SLSA-attested, Rekor-logged artifact without one
test having run.

The attestations were never WRONG about this. SLSA provenance attests to build
provenance and does not claim tests passed, and RELEASES.md's verify commands
say exactly that. The gap is that "signed, attested, transparency-logged" reads
as "vouched for" to essentially every downstream consumer, and here it vouched
only for where the bytes came from.

Adds a `test` job and makes `build` need it, so nothing is built, signed or
attested until the suite is green.

Cross-workflow `needs:` does not exist in GitHub Actions, so ci.yml cannot gate
this workflow and the check has to be duplicated here. That is why this is a
small fast job rather than the full 3-OS matrix: a release gate has to be cheap
enough that nobody is tempted to route around it.

The step also asserts 15+ tests actually EXECUTED (17 locally). pytest exits 5
on "no tests collected", but a suite that silently shrank still exits 0 - and a
release gate that passes because nothing ran is worse than no gate at all,
because it ships a signature saying otherwise. Same reasoning as the guards in
the CI workflow, applied to the path that publishes.

Found by an adversarial claim-vs-enforcement sweep (TCE-23).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

- Introduced TopAssetsResponse model for top assets highlights.
- Added Trade model to represent trade details.
- Implemented TradePagedResult model for paginated trade results.
- Created TxState enum for transaction states.
- Developed AggregatedPoolService for managing aggregated pool data.
- Added AssetService for asset management and retrieval.
- Implemented AssetStatService for fetching asset statistics.
- Created AssetTimeseriesService for 7-day asset timeseries data.
- Developed GossipService for managing gossip relay statuses.
- Added IndexerService for retrieving indexer status.
- Implemented LiquidityService for managing liquidity updates.
- Created OhlcService for handling OHLC data requests.
- Developed PoolService for managing pool data and statistics.
- Added SearchService for searching assets and pools.
- Implemented SignalRTestService for testing SignalR connections.
- Created StatsService for fetching DEX statistics.
- Added TopAssetsService for retrieving top assets data.
- Implemented TradeService for managing trade data retrieval.

The real logic is already covered by the old tests we migrated

Adds @algorandfoundation/provider-migrations, a storage-agnostic engine that
lets packages ship a versioned, tracked, idempotent migration alongside a
breaking change instead of hand-rolling a startup fix-up pass.

WithMigrations is placed first in the extensions array, so provider.migrations
exists for every later extension, and the run is scheduled as a microtask so
the registry is complete before the first revision executes. Opted-in packages
import only `type { Migration }` and carry no runtime dependency on the engine.

- Storage-agnostic: each module declares its own opaque context type, so
  IndexedDB, MMKV and a sealed file all work without a shared interface.
- Ledger written per revision, never batched, so a killed run resumes exactly
  where it stopped.
- Forward-only and always from revision zero; migrations tolerate empty data.
- Per-module failure isolation: a failing revision halts only its own module,
  other modules still run, then `ready` rejects with an aggregate error.
- A ledger ahead of the installed code is reported and warned about, not
  thrown, since bricking an app on a downgrade is worse.
- Run-scoped SecretScratch for key material in flight: bytes only, zeroed in a
  finally, use-after-wipe throws, non-serializable. Hook payloads carry
  { module, revision } only.

react-native-keystore is the first adopter, with migrateLegacyPasskeys tracked
as revision 0001, and the react-native example wallet is wired up.

BREAKING CHANGE: legacy passkey flagging no longer runs automatically on engine
start. It is now revision 0001 of the package's migration manifest and requires
WithMigrations from @algorandfoundation/provider-migrations to be installed on
the provider. Applications that do not add it will never flag legacy passkeys.

AUDIT_READINESS.md:172 points an auditor at `sdk/ci/ci.yml` as the repo's CI
definition. That file does not exist:

  git ls-files sdk/ci/  ->  release.yml, verify_pinned_digest.py

scripts/verify_all.sh:10 makes the same reference, claiming to "mirror the
sdk/ci/ci.yml signature-kat job recipe EXACTLY". Both now point at
.github/workflows/ci.yml, which is the file that actually runs. An auditor
following the readiness doc hits a 404 on its first CI citation.

sdk/ci/release.yml is deleted. GitHub Actions only executes YAML under
.github/workflows/, so it never ran, and it had drifted into being the WORSE
copy: ad20b42 SHA-pinned every action in the live workflow while this one kept
floating tags -

  actions/checkout@v5                vs  @fbc6f39... # v5.0.1
  actions/setup-python@v6            vs  @ece7cb0... # v6.0.0
  actions/upload-artifact@v4         vs  @ea165f8... # v4.6.2
  actions/download-artifact@v4       vs  @d3f86a1... # v4.3.0
  sigstore/cosign-installer@v4.1.0   vs  @ba7bc0a... # v4.1.0
  softprops/action-gh-release@v2.6.2 vs  @3bb1273... # v2.6.2

19 differing lines, all pins. An inert file is harmless right until someone
copies it back - and this is the release workflow, the one that signs
artifacts and publishes them.

Also gitignores .venv-contracts/, the local virtualenv the contract suite
needs. It was untracked and unignored, which is how a `git add -A` in this
directory sweeps 1757 site-packages files into a commit.

Nothing references the deleted file; verify_all.sh still parses (bash -n).

Found by an adversarial claim-vs-enforcement sweep (TCE-15).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>