code/cl8y-dex-terraclassic

Fork 0

Security: incident template has no timeline table capturing time, tx hash, wallet, token, pair, admin action, and user impact [SEC-G06] #439

New issue

Closed

opened 2026-06-29 16:13:59 +00:00 by totdking · 10 comments

totdking commented

2026-06-29 16:13:59 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-29 16:14:40 +00:00

(Migrated from gitlab.com)

Summary

The incident template (docs/templates/incident-dex-indexer.md) includes a Metadata table (severity, started UTC, commander, channels), a Triage checklist, a Mitigation section, a blank Communications section, and a Post-incident section. There is no blank incident timeline table with columns for: time, tx hash, wallet, token, pair, admin action, and user impact. The checklist requires this specific template structure so that operators can build a time-ordered audit trail as events unfold during an incident.

What Was Checked

docs/templates/incident-dex-indexer.md read in full (confirmed by direct read above): Metadata table has severity, started UTC, commander, channels. No timeline table with the required columns.
docs/runbooks/blacklist-decision.md rollback checklist step 4: "Log in incident timeline -- entry with reversal approver, checklist completion UTC, and planned Unblacklist tx" -- references an incident timeline but no template for it exists in either doc.
docs/runbooks/emergency-commands.md step 4: "Record tx hashes -- paste into your incident tracker for audit trail" -- references an audit trail but no blank template exists.

Expected (per checklist)

The incident template runbook must include a blank timeline table with at minimum these columns: UTC time, tx hash, wallet address, token address, pair address, admin action taken, and user impact. Rows are filled in as events occur during the incident.

Actual

No timeline table exists in any runbook or template. Multiple docs reference "recording tx hashes" and "incident timeline" but provide no blank table for operators to fill in.

Evidence

docs/templates/incident-dex-indexer.md: no timeline table (confirmed by full read)
docs/runbooks/blacklist-decision.md step 4: references "incident timeline" without providing a template
docs/runbooks/emergency-commands.md step 4: references "audit trail" without providing a template

Suggested Fix

Add a Incident timeline section to docs/templates/incident-dex-indexer.md with a blank Markdown table:

| UTC Time | Tx Hash | Wallet | Token | Pair | Admin Action | User Impact |
|----------|---------|--------|-------|------|--------------|-------------|
|          |         |        |       |      |              |             |

Operators fill in rows as events unfold. Link this table from the blacklist-decision.md rollback checklist step 4 and the emergency-commands.md "Record tx hashes" step.

Verification Checklist

docs/templates/incident-dex-indexer.md contains a blank timeline table with columns for: UTC time, tx hash, wallet, token, pair, admin action, user impact
The blacklist-decision.md rollback checklist step 4 links to this table or the template section

Labels

security, pre-launch

Cc: @PlasticDigits

### Summary The incident template (`docs/templates/incident-dex-indexer.md`) includes a **Metadata** table (severity, started UTC, commander, channels), a **Triage** checklist, a **Mitigation** section, a blank **Communications** section, and a **Post-incident** section. There is no blank incident timeline table with columns for: time, tx hash, wallet, token, pair, admin action, and user impact. The checklist requires this specific template structure so that operators can build a time-ordered audit trail as events unfold during an incident. --- ### What Was Checked - `docs/templates/incident-dex-indexer.md` read in full (confirmed by direct read above): Metadata table has severity, started UTC, commander, channels. No timeline table with the required columns. - `docs/runbooks/blacklist-decision.md` rollback checklist step 4: "Log in incident timeline -- entry with reversal approver, checklist completion UTC, and planned Unblacklist tx" -- references an incident timeline but no template for it exists in either doc. - `docs/runbooks/emergency-commands.md` step 4: "Record tx hashes -- paste into your incident tracker for audit trail" -- references an audit trail but no blank template exists. --- ### Expected (per checklist) The incident template runbook must include a blank timeline table with at minimum these columns: UTC time, tx hash, wallet address, token address, pair address, admin action taken, and user impact. Rows are filled in as events occur during the incident. --- ### Actual No timeline table exists in any runbook or template. Multiple docs reference "recording tx hashes" and "incident timeline" but provide no blank table for operators to fill in. --- ### Evidence - `docs/templates/incident-dex-indexer.md`: no timeline table (confirmed by full read) - `docs/runbooks/blacklist-decision.md` step 4: references "incident timeline" without providing a template - `docs/runbooks/emergency-commands.md` step 4: references "audit trail" without providing a template --- ### Suggested Fix Add a **Incident timeline** section to `docs/templates/incident-dex-indexer.md` with a blank Markdown table: ``` | UTC Time | Tx Hash | Wallet | Token | Pair | Admin Action | User Impact | |----------|---------|--------|-------|------|--------------|-------------| | | | | | | | | ``` Operators fill in rows as events unfold. Link this table from the `blacklist-decision.md` rollback checklist step 4 and the `emergency-commands.md` "Record tx hashes" step. --- ### Verification Checklist - [ ] `docs/templates/incident-dex-indexer.md` contains a blank timeline table with columns for: UTC time, tx hash, wallet, token, pair, admin action, user impact - [ ] The blacklist-decision.md rollback checklist step 4 links to this table or the template section --- ### Labels `security`, `pre-launch` Cc: @PlasticDigits

totdking commented

2026-06-29 16:15:51 +00:00

(Migrated from gitlab.com)

mentioned in issue #381

PlasticDigits commented

2026-06-30 02:21:45 +00:00

(Migrated from gitlab.com)

mentioned in merge request !965

Brouie commented

2026-06-30 02:59:09 +00:00

(Migrated from gitlab.com)

Verified #439 (issue-439-incident-timeline-sec-g06).

check_incident_template_docs.py -> OK
verify-issue-439.sh -> PASS 5 / FAIL 0

The incident template gains a "## Incident timeline" section with the blank table carrying exactly the seven required columns (UTC Time | Tx Hash | Wallet | Token | Pair | Admin Action | User Impact) + a blank starter row. blacklist-decision.md rollback step 4 (and 5) link ...#incident-timeline, emergency-commands.md step 4 links the same anchor, and the heading slug matches all three inbound links.

Small non-blocking nit: the checker matches the blank starter row by an exact whitespace literal, so re-flowing the column widths later would trip the invariant — worth tightening, not a hold.

Docs-only. Good to close from my side — @PlasticDigits merge !965 + close.

Verified #439 (issue-439-incident-timeline-sec-g06). - check_incident_template_docs.py -> OK - verify-issue-439.sh -> PASS 5 / FAIL 0 The incident template gains a "## Incident timeline" section with the blank table carrying exactly the seven required columns (UTC Time | Tx Hash | Wallet | Token | Pair | Admin Action | User Impact) + a blank starter row. blacklist-decision.md rollback step 4 (and 5) link ...#incident-timeline, emergency-commands.md step 4 links the same anchor, and the heading slug matches all three inbound links. Small non-blocking nit: the checker matches the blank starter row by an exact whitespace literal, so re-flowing the column widths later would trip the invariant — worth tightening, not a hold. Docs-only. Good to close from my side — @PlasticDigits merge !965 + close.

PlasticDigits commented

2026-06-30 03:55:11 +00:00

(Migrated from gitlab.com)

mentioned in commit 114d10b79d

mentioned in commit 114d10b79dbf0c285b8f4fd13565dfcf492bc456

PlasticDigits commented

2026-06-30 05:04:18 +00:00

(Migrated from gitlab.com)

mentioned in commit 1921c81f7f

mentioned in commit 1921c81f7f2782398230fbcb6a3013f78c2e6e56

PlasticDigits commented

2026-06-30 05:08:11 +00:00

(Migrated from gitlab.com)

mentioned in commit 11666a0059

mentioned in commit 11666a0059604777c00023628d12ed3e86ad6cc3

PlasticDigits commented

2026-06-30 05:08:14 +00:00

(Migrated from gitlab.com)

mentioned in merge request !969

PlasticDigits commented

2026-06-30 05:08:33 +00:00

(Migrated from gitlab.com)

mentioned in merge request !968

PlasticDigits commented

2026-06-30 06:49:24 +00:00

(Migrated from gitlab.com)

Verification — #439 (SEC-G06)

Verified incident template timeline table and cross-links. All acceptance criteria PASS.

Checklist

Criterion	Result	How verified
`docs/templates/incident-dex-indexer.md` has blank timeline table with UTC Time, Tx Hash, Wallet, Token, Pair, Admin Action, User Impact	PASS	Manual read of `## Incident timeline` section (lines 48–54); seven column headers + blank starter row present
`blacklist-decision.md` rollback checklist step 4 links to timeline	PASS	Step 4 and 5 link to `../templates/incident-dex-indexer.md#incident-timeline`
`emergency-commands.md` "Record tx hashes" links to timeline	PASS	"Before you broadcast" step 4 links to `#incident-timeline`
Doc invariant / CI guard	PASS	`python3 scripts/check_incident_template_docs.py` → OK
Issue verification script	PASS	`bash scripts/qa/verify-issue-439.sh` → PASS 5 / FAIL 0
Agent skill present	PASS	`skills/AGENTS_INCIDENT_TEMPLATE.md` documents required columns and `make verify-issue-439`

Notes

Heading slug incident-timeline matches inbound anchors from both runbooks.
No repo changes required from this verification pass (implementation already on main).

Closing as verified.

## Verification — #439 (SEC-G06) Verified incident template timeline table and cross-links. **All acceptance criteria PASS.** ### Checklist | Criterion | Result | How verified | |-----------|--------|--------------| | `docs/templates/incident-dex-indexer.md` has blank timeline table with UTC Time, Tx Hash, Wallet, Token, Pair, Admin Action, User Impact | **PASS** | Manual read of `## Incident timeline` section (lines 48–54); seven column headers + blank starter row present | | `blacklist-decision.md` rollback checklist step 4 links to timeline | **PASS** | Step 4 and 5 link to `../templates/incident-dex-indexer.md#incident-timeline` | | `emergency-commands.md` "Record tx hashes" links to timeline | **PASS** | "Before you broadcast" step 4 links to `#incident-timeline` | | Doc invariant / CI guard | **PASS** | `python3 scripts/check_incident_template_docs.py` → OK | | Issue verification script | **PASS** | `bash scripts/qa/verify-issue-439.sh` → PASS 5 / FAIL 0 | | Agent skill present | **PASS** | `skills/AGENTS_INCIDENT_TEMPLATE.md` documents required columns and `make verify-issue-439` | ### Notes - Heading slug `incident-timeline` matches inbound anchors from both runbooks. - No repo changes required from this verification pass (implementation already on `main`). Closing as verified.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-06-30 06:49:25 +00:00