[Halisky]

Summary

Adds four read-only inspection commands under the Transaction/XDR and Soroban diagnostics epics.

Command	Issue	Notes
operation-count-audit	Closes #197	Validates operation count against MAX_OPS_PER_TX = 100. Soroban resource budget reported separately.
soroban-event-ordering-audit	Closes #196	Ordering + overlap checks on event result sets. Does not duplicate soroban-event-decoder or soroban-event-retention-audit.
network-fingerprint	Closes #195	Stable (network + protocol) and detailed (with software) SHA-256 fingerprints. --compare mode.
xdr-roundtrip-audit	Closes #194	Decode/re-encode round-trip integrity across 8 XDR types. Distinguishes byte-diff from semantic drift.

Closes #197
Closes #196
Closes #195
Closes #194

---

Files

New (17):

• src/services/operation-count-audit.ts
• src/services/soroban-event-ordering-audit.ts
• src/services/network-fingerprint.ts
• src/services/xdr-roundtrip-audit.ts
• src/output/operation-count-audit-report.ts
• src/output/soroban-event-ordering-audit-report.ts
• src/output/network-fingerprint-report.ts
• src/output/xdr-roundtrip-audit-report.ts
• src/cli/commands/sep-compliance-4.ts
• tests/operation-count-audit.test.ts
• tests/soroban-event-ordering-audit.test.ts
• tests/network-fingerprint.test.ts
• tests/xdr-roundtrip-audit.test.ts
• docs/operation-count-audit.md
• docs/soroban-event-ordering-audit.md
• docs/network-fingerprint.md
• docs/xdr-roundtrip-audit.md

Modified (1):

• src/cli/index.ts — 2-line addition (import + registerSepCompliance4Commands(program)).

---

Design decisions worth highlighting

1. operation-count-audit — Soroban resources are separate, always

The audit reads the envelope once. If invokeHostFunction operations exist, a SOROBAN_RESOURCES_PRESENT info finding is emitted and a sorobanResources section is populated. The MAX_OPS_PER_TX = 100 check is applied independently. The test suite asserts that a plain transaction has no sorobanResources field.

2. soroban-event-ordering-audit — explicit non-duplication

Two existing services already cover adjacent concerns:

• soroban-event-decoder decodes ScVal topics/values (used elsewhere).
• soroban-event-retention-audit audits pagination (cursors, missing metadata, duplicate ids across pages, page gaps, termination).

This new audit focuses only on ordering within a flat set and overlap between two sets. ORDERING_DELEGATED is emitted as an inconclusive finding on every run. The audit never falls back to ledger for ordering — if pagingToken/id is missing on any record, the check is inconclusive.

3. network-fingerprint — stable vs detailed, equivalence-proof disclaimer

The stable fingerprint excludes software versions so it remains stable across operator upgrades. The detailed fingerprint includes them. The audit never claims fingerprint matching proves complete network equivalence — FINGERPRINT_NOT_EQUIVALENCE_PROOF is emitted on every result.

Comparison mode handles three states distinctly: matching (info), differing stable (warning — real identity change), differing detailed only (info — expected across upgrades). Added / removed / unavailable fields are reported separately from changes.

4. xdr-roundtrip-audit — no false "corruption" claims

The audit compares SHA-256 hashes. If they differ, it re-decodes the re-encoded bytes and compares structural JSON. Only a structural difference is reported as SEMANTIC_DRIFT (error). A byte difference that re-decodes to the same structure is reported as DIFFERS_BUT_SEMANTICALLY_EQUAL (warning) — explicitly not corruption. This is the comparison strategy documented in the ACs.

---

Testing

npm run typecheck
npm run lint
npm test
npm run build

[drips-wave]

@Halisky Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits