feat(vault): swap the oracle through the timelock

[hpmaxi]

Summary

Governance swaps the vault's oracle under the same timelock as every other change, with no instant setter. It ships as a VaultChange::Oracle change on the shared queue (propose_change / apply_change) rather than separate propose_oracle / apply_oracle entrypoints, so the console lists it with every other pending change.

Changes

• Governance proposes a new feed; it lands after the timelock, and the next fulfilment prices from it
• Only a feed bound to this vault with its setup finished is accepted, at proposal and again at apply, so its own changes keep waiting for this vault's clock
• A feed that cannot answer state() is never installed

Deviations

• propose_oracle / apply_oracle ship as one change kind on the shared queue rather than as two new entrypoints
• The check reads the feed's binding through bindings::VaultBindingClient (vault(), setup_open()), not the plan's timelock::Bound, which does not exist in this base
• Documented the oracle alongside the other changes that wait for the timelock in docs/AUTHORIZATION_MATRIX.md §5.1's summary paragraph, for accuracy

Acceptance criteria

• The swap waits for the timelock and has no instant path
• A feed that does not name this vault, or whose setup is still open, is refused when proposed and again when applied
• A feed that cannot answer state() is never installed
• The next fulfilment prices from the new feed, including an epoch sealed before the swap

Test plan

Automated tests

1. cargo test -p async-vault oracle_swap: 5 passed.
2. cargo test -p async-vault: 364 passed.
3. cargo test --locked (whole workspace): all green.

Manual verification

None; no entrypoint signature, event or error the harness currently exercises changed (see report).

Breaking changes

None.

Checklist

• Self-reviewed my own diff
• Tests added or updated
• Docs updated (if applicable)
• No unrelated changes bundled in

Screenshots

None.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
strata-vault-kit-app	Ready	Preview	Oct 19, 2026 5:32pm UTC