Summary
The upgrade-governance contract approves WASM binary upgrades but does not validate that the new binary is backward-compatible with the existing on-chain storage schema. A schema-breaking upgrade can corrupt all patient data silently.
Proposed Design
- Add a
schema_version: u32 field to each contract's storage
- Require the new WASM to declare its minimum compatible schema version
- Reject upgrade proposals where the new binary's minimum schema version is greater than the currently stored version (migration required first)
- Add a
migrate_schema(from_version, to_version) entry point pattern for contracts with schema changes
Acceptance Criteria
Summary
The
upgrade-governancecontract approves WASM binary upgrades but does not validate that the new binary is backward-compatible with the existing on-chain storage schema. A schema-breaking upgrade can corrupt all patient data silently.Proposed Design
schema_version: u32field to each contract's storagemigrate_schema(from_version, to_version)entry point pattern for contracts with schema changesAcceptance Criteria