feat: implement direct soroban read layer and verification surface (#…

[sublime247]

Closes #85

Features & Enhancements

Direct Soroban Smart Contract Read Layer

• Built a direct, read-only Soroban service (src/services/soroban.service.ts) using @stellar/stellar-sdk rpc.Server.
• Fetches real deployed contract WASM bytecode via getContractWasmByContractId and calculates actual SHA-256 hashes client-side.
• Performs read-only transaction simulations for:
  • get_pool_stats (Liquidity Pool contract)
  • get_score (Reputation contract)
  • get_loan (Creditline contract)
• Added reconciliation logic (reconcilePoolStats) to compare API-reported values against direct Soroban contract state and compute mismatch flags.

Trust-Minimized Verification Surface (Contracts Page)

• Replaced fabricated mock SHA-256 hashes on Contracts.tsx with live on-chain WASM hashes.
• Added an On-Chain vs API Reconciliation section comparing API-served pool metrics against Soroban contract state.
• Highlights Mismatch warning flags if API numbers diverge from on-chain state.
• Graceful loading spinners, error alerts with a Retry Read button, and empty fallback handling.

Dynamic Pool Overview (Home Page)

• Replaced hardcoded static pool stats on Home.tsx with live reads fetched via sorobanService and poolService.

---

Verification & Testing

• Unit Tests: Added src/services/__tests__/soroban.service.test.ts. npm test passes with 27 tests (6 new tests added).
• Linting: npm run lint passes with 0 errors and 0 warnings.
• Production Build: npm run build compiles with 0 errors.
• Mobile Responsiveness: Verified layout on 375px mobile viewports.
• Code Standards: No hardcoded hex colors, icons from lucide-react only, no direct API/RPC calls in page components.

---

Related Issues

• Fixes fix: wire Home landing page pool stats to live API #60 (Home page hardcoded pool stats)
• Fixes fix: display real WASM hashes on contract verification page #61 (Contracts page fabricated SHA-256 hashes)

Closes #85

[EmeditWeb]

Review verdict: ✅ APPROVE with a minor correction

Good transparency feature. Verified locally: build passes, lint clean, tests pass (27). The new soroban.service.ts is read-only (no signing, submit, secret, or Keypair usage), so exposing a direct on-chain verification surface here is safe and appropriate. No hardcoded hex, no API calls in pages.

Minor correction: one any at src/services/soroban.service.ts:75 — const rawSim = simResult as any. Please give it a proper type (or cast to unknown and narrow) to satisfy the no-any standard; it's the only violation in the PR.

Otherwise merge-ready.

[sublime247]

@EmeditWeb any update as regards reviewing?

[EmeditWeb]

@EmeditWeb any update as regards reviewing?

I'm currently auditing it

[EmeditWeb]

Re-audited after today's update: the any cast at soroban.service.ts:75 is removed (commit 787f326), soroban read layer is read-only (no signing/submit), build passes, eslint . clean, 27 tests pass, CI green. Approving and merging. (Note: #88 was built on top of this branch and will be rebased onto main after this lands.)