Run a stored batch whose wait is over. Anyone may: what runs was fixed when the Prime approved it, so the caller chooses only when, within the window.
THE PRIME APPROVES THE RUN, THROUGH A RULE THIS ADAPTER SIGNS. A venue
that asks the Prime for authorization mid-batch - Blend's submit -
is answered by a rule whose signer is this adapter, and the smart
account checks a contract signer with require_auth_for_args, which a
contract passes only when it is the one that asked the Prime. At once,
execute asks, and the venue's request sits inside that approval. Here
nobody would have asked first, the venue would be asking, and the
adapter's signature would fail (measured on testnet:
Error(Auth, InvalidAction)). So run asks, for (id), and the Prime
answers it with a rule scoped to this adapter, signed by it, whose
predicate permits run and nothing else. No key signs; any submitter
can build the entry. The predicate is what keeps that rule from
approving an immediate execute or a cancel the same way.
fn run(env: soroban_sdk::Env, id: u32)Drop a stored batch, waiting or ready, before it runs. by is the
Prime or the custody the current gate answers to, and must approve.
A lapsed batch can be dropped the same way, to tidy it away; a number
with nothing stored under it is left as it was.
fn cancel(env: soroban_sdk::Env, id: u32, by: soroban_sdk::Address)Point this contract at a successor gate. Authorised by the custody the CURRENT gate answers to, which is the only party whose money is at stake. After this the address no longer derives from the binding; the derivation was only ever how custody found this contract before it existed, and what the gate actually checks is caller and code.
THE SUCCESSOR IS ASKED WHO IT ANSWERS TO BEFORE THE BINDING MOVES, and
that one call is what keeps this reversible. An address that cannot
answer custody could never be rebound away from either, so a single
mistyped argument left the adapter unusable AND unrebindable. Recovery
means abandoning it for a whole new gate generation, and every rule
scoped to the old adapter address dies with it. Measured on testnet:
rebound to a
SAC, both execute and the next rebind failed
Error(Value, InvalidInput) for good. Checking allowed too would buy
nothing: a successor missing THAT is merely unusable, and custody can
still rebind away from it.
fn rebind(env: soroban_sdk::Env, gate: soroban_sdk::Address)Run the batch now (wait zero) or store it to run once wait more
ledgers have closed, returning its number.
The Prime approves (calls, grants, wait): the batch keeps the first
two argument positions it has always had, so every rule's paths into it
are unchanged, and the wait is covered by the same approval.
fn execute(
env: soroban_sdk::Env,
calls: soroban_sdk::Vec,
grants: soroban_sdk::Vec,
wait: u32,
) -> Option min_wait is the fewest ledgers any batch waits, zero allowing none.
run_window is how many ledgers after its wait a batch may still run:
a move that sat unrun for longer was approved against a market that
has since moved, and perhaps by an agent since revoked, so it lapses.
fn __constructor(
env: soroban_sdk::Env,
prime: soroban_sdk::Address,
gate: soroban_sdk::Address,
min_wait: u32,
run_window: u32,
)