code/cl8y-dex-terraclassic

Fork 0

Security: release checklist does not explicitly gate deploy on pasted test outputs for contracts, indexer, and frontend [SEC-H08] #444

New issue

Closed

opened 2026-06-30 10:21:43 +00:00 by totdking · 8 comments

totdking commented

2026-06-30 10:21:43 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-30 10:22:52 +00:00

(Migrated from gitlab.com)

Summary

docs/runbooks/launch-checklist.md Phase 3 includes scripts/smoke-pool-swap.sh and scripts/smoke-wrap-mapper-pause.sh as post-deploy smoke steps (satisfying the LocalTerra smoke requirement), but no phase explicitly requires running make test-contracts, make test-indexer-integration, or make test-frontend and pasting their output on the release issue before proceeding to mainnet. CI gates (test-contracts, test-indexer-lib, test-indexer-integration, test-frontend) run on every default-branch commit and MR, so tests do pass before any code can be deployed from CI. However, the release issue has no explicit step for operators to paste test command output, and an operator deploying outside CI (e.g., from a local build) has no explicit checklist gate requiring test passage evidence.

What Was Checked

docs/runbooks/launch-checklist.md read in full (181 lines): Phase 0 references make build-optimized wasm policy; Phase 3 lists smoke-pool-swap.sh and smoke-wrap-mapper-pause.sh as post-deploy steps; Phase 5 references QA_TEMPLATE.md sign-off. No phase explicitly says "run make test-contracts && paste output" or "run make test-indexer-integration && paste output" or "run make test-frontend && paste output" as a pre-deploy gate.
.gitlab-ci.yml lines 133-256: test-contracts, test-indexer-lib, test-indexer-integration, and test-frontend all run on default branch and MRs. Tests pass before any merge. CI is the implicit gate, not the release checklist.
docs/templates/deploy-trace.md lines 37-59: post-deploy verification template shows factory get_config and pool smoke. No test output section.

Expected (per checklist)

The release checklist has an explicit pre-deploy step requiring: (1) make test-contracts output pasted or linked on the release issue; (2) make test-indexer-integration output pasted or linked; (3) make test-frontend output pasted or linked; (4) at least one LocalTerra swap smoke (smoke-pool-swap.sh) output. The release issue template or deploy-trace template includes a "Test results" section for this evidence.

Actual

LocalTerra swap smoke is in Phase 3 of the checklist. Contract, indexer, and frontend test passage are handled by CI only. No checklist step requires pasting test outputs on the release issue before mainnet deploy. An operator deploying outside CI could skip these with no checklist gate.

Evidence

docs/runbooks/launch-checklist.md Phase 3 (lines 80-89): smoke-pool-swap.sh and smoke-wrap-mapper-pause.sh present; no contract/indexer/frontend test steps
.gitlab-ci.yml lines 133-256: CI test jobs exist but are not referenced as explicit release issue gates in launch-checklist.md

Suggested Fix

Add a Test evidence gate section to docs/runbooks/launch-checklist.md Phase 0 or Phase 5 requiring operators to paste or link: (1) make test-contracts output; (2) make test-indexer-integration output; (3) make test-frontend output; (4) smoke-pool-swap.sh output (already in Phase 3). Update the docs/templates/deploy-trace.md template with a "Test results" section for these pastes. Note that CI provides this evidence automatically when deploying from a CI-built artifact.

Verification Checklist

docs/runbooks/launch-checklist.md has an explicit step requiring contract, indexer, and frontend test output pasted or linked on the release issue before mainnet deploy
docs/templates/deploy-trace.md includes a "Test results" section for this evidence
The checklist notes that CI-built artifacts satisfy this requirement automatically

Labels

security, pre-launch

Cc: @PlasticDigits

### Summary `docs/runbooks/launch-checklist.md` Phase 3 includes `scripts/smoke-pool-swap.sh` and `scripts/smoke-wrap-mapper-pause.sh` as post-deploy smoke steps (satisfying the LocalTerra smoke requirement), but no phase explicitly requires running `make test-contracts`, `make test-indexer-integration`, or `make test-frontend` and pasting their output on the release issue before proceeding to mainnet. CI gates (test-contracts, test-indexer-lib, test-indexer-integration, test-frontend) run on every default-branch commit and MR, so tests do pass before any code can be deployed from CI. However, the release issue has no explicit step for operators to paste test command output, and an operator deploying outside CI (e.g., from a local build) has no explicit checklist gate requiring test passage evidence. --- ### What Was Checked - `docs/runbooks/launch-checklist.md` read in full (181 lines): Phase 0 references `make build-optimized` wasm policy; Phase 3 lists smoke-pool-swap.sh and smoke-wrap-mapper-pause.sh as post-deploy steps; Phase 5 references QA_TEMPLATE.md sign-off. No phase explicitly says "run make test-contracts && paste output" or "run make test-indexer-integration && paste output" or "run make test-frontend && paste output" as a pre-deploy gate. - `.gitlab-ci.yml` lines 133-256: test-contracts, test-indexer-lib, test-indexer-integration, and test-frontend all run on default branch and MRs. Tests pass before any merge. CI is the implicit gate, not the release checklist. - `docs/templates/deploy-trace.md` lines 37-59: post-deploy verification template shows factory get_config and pool smoke. No test output section. --- ### Expected (per checklist) The release checklist has an explicit pre-deploy step requiring: (1) `make test-contracts` output pasted or linked on the release issue; (2) `make test-indexer-integration` output pasted or linked; (3) `make test-frontend` output pasted or linked; (4) at least one LocalTerra swap smoke (smoke-pool-swap.sh) output. The release issue template or deploy-trace template includes a "Test results" section for this evidence. --- ### Actual LocalTerra swap smoke is in Phase 3 of the checklist. Contract, indexer, and frontend test passage are handled by CI only. No checklist step requires pasting test outputs on the release issue before mainnet deploy. An operator deploying outside CI could skip these with no checklist gate. --- ### Evidence - `docs/runbooks/launch-checklist.md` Phase 3 (lines 80-89): smoke-pool-swap.sh and smoke-wrap-mapper-pause.sh present; no contract/indexer/frontend test steps - `.gitlab-ci.yml` lines 133-256: CI test jobs exist but are not referenced as explicit release issue gates in launch-checklist.md --- ### Suggested Fix Add a **Test evidence gate** section to `docs/runbooks/launch-checklist.md` Phase 0 or Phase 5 requiring operators to paste or link: (1) `make test-contracts` output; (2) `make test-indexer-integration` output; (3) `make test-frontend` output; (4) `smoke-pool-swap.sh` output (already in Phase 3). Update the `docs/templates/deploy-trace.md` template with a "Test results" section for these pastes. Note that CI provides this evidence automatically when deploying from a CI-built artifact. --- ### Verification Checklist - [ ] `docs/runbooks/launch-checklist.md` has an explicit step requiring contract, indexer, and frontend test output pasted or linked on the release issue before mainnet deploy - [ ] `docs/templates/deploy-trace.md` includes a "Test results" section for this evidence - [ ] The checklist notes that CI-built artifacts satisfy this requirement automatically --- ### Labels `security`, `pre-launch` Cc: @PlasticDigits

totdking commented

2026-06-30 10:24:13 +00:00

(Migrated from gitlab.com)

mentioned in issue #381

PlasticDigits commented

2026-06-30 11:00:07 +00:00

(Migrated from gitlab.com)

mentioned in merge request !974

PlasticDigits commented

2026-06-30 11:11:11 +00:00

(Migrated from gitlab.com)

mentioned in commit 71ae2d02b1

mentioned in commit 71ae2d02b1298844583ad2cde927cb1326812aff

PlasticDigits commented

2026-06-30 11:15:57 +00:00

(Migrated from gitlab.com)

mentioned in commit 5058c61b95

mentioned in commit 5058c61b9595a1381fdd408b7a4b60efbd2c7a20

PlasticDigits commented

2026-06-30 11:15:59 +00:00

(Migrated from gitlab.com)

mentioned in merge request !975

PlasticDigits commented

2026-06-30 11:20:01 +00:00

(Migrated from gitlab.com)

Verification — SEC-H08 pre-deploy test evidence gate (#444)

Result: PASS (all acceptance criteria satisfied on main; no repo changes required)

Acceptance criteria

Criterion	Result	How verified
`docs/runbooks/launch-checklist.md` has an explicit step requiring contract, indexer, and frontend test output pasted or linked on the release issue before mainnet deploy	PASS	Phase 0 Test evidence gate (SEC-H08) (lines 36–53) requires `make test-contracts`, `make test-indexer-integration`, `make test-frontend`, and pool smoke output on the launch/release issue at the deployed SHA. Phase 5 P0 table also references SEC-H08.
`docs/templates/deploy-trace.md` includes a "Test results" section for this evidence	PASS	§ Test results (pre-deploy evidence — SEC-H08) with table for contracts, indexer integration, frontend, and pool smoke; paste-or-link block present.
The checklist notes that CI-built artifacts satisfy this requirement automatically	PASS	Phase 0 states CI-built deploys satisfy the gate when the pipeline shows green `test-contracts`, `test-indexer-integration`, and `test-frontend` — link pipeline URL instead of re-pasting. Same note in deploy-trace template and `skills/AGENTS_TEST_EVIDENCE_GATE.md`.

Automated verification

make verify-issue-444
  PASS: 8   FAIL: 0

make check-test-evidence-gate-docs
  OK: pre-deploy test evidence gate (SEC-H08) documented in launch runbook,
      deployment guide, deploy trace template, and qa-invariants

Cross-links confirmed

docs/deployment-guide.md — pre-deploy test evidence checklist item
docs/qa-invariants.md — invariant Q3
skills/AGENTS_TEST_EVIDENCE_GATE.md — agent playbook
skills/AGENTS_LAUNCH_GO_NO_GO.md — links SEC-H08
docs/testing.md — issue #444 row in test matrix

Closing as verified on current main.

## Verification — SEC-H08 pre-deploy test evidence gate (#444) **Result: PASS** (all acceptance criteria satisfied on `main`; no repo changes required) ### Acceptance criteria | Criterion | Result | How verified | |-----------|--------|--------------| | `docs/runbooks/launch-checklist.md` has an explicit step requiring contract, indexer, and frontend test output pasted or linked on the release issue before mainnet deploy | **PASS** | Phase 0 **Test evidence gate (SEC-H08)** (lines 36–53) requires `make test-contracts`, `make test-indexer-integration`, `make test-frontend`, and pool smoke output on the launch/release issue at the deployed SHA. Phase 5 P0 table also references SEC-H08. | | `docs/templates/deploy-trace.md` includes a "Test results" section for this evidence | **PASS** | § **Test results (pre-deploy evidence — SEC-H08)** with table for contracts, indexer integration, frontend, and pool smoke; paste-or-link block present. | | The checklist notes that CI-built artifacts satisfy this requirement automatically | **PASS** | Phase 0 states CI-built deploys satisfy the gate when the pipeline shows green `test-contracts`, `test-indexer-integration`, and `test-frontend` — link pipeline URL instead of re-pasting. Same note in deploy-trace template and `skills/AGENTS_TEST_EVIDENCE_GATE.md`. | ### Automated verification ```text make verify-issue-444 PASS: 8 FAIL: 0 make check-test-evidence-gate-docs OK: pre-deploy test evidence gate (SEC-H08) documented in launch runbook, deployment guide, deploy trace template, and qa-invariants ``` ### Cross-links confirmed - `docs/deployment-guide.md` — pre-deploy test evidence checklist item - `docs/qa-invariants.md` — invariant **Q3** - `skills/AGENTS_TEST_EVIDENCE_GATE.md` — agent playbook - `skills/AGENTS_LAUNCH_GO_NO_GO.md` — links SEC-H08 - `docs/testing.md` — issue #444 row in test matrix Closing as verified on current `main`.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-06-30 11:20:02 +00:00

Brouie commented

2026-06-30 11:24:02 +00:00

(Migrated from gitlab.com)

Verified the SEC-H08 test-evidence gate on main (it's already merged in, 4aabd71d).

make verify-issue-444 → 8/8 PASS. The gate landed where it needs to:

launch-checklist Phase 0 now requires pasting/linking make test-contracts + make test-indexer-integration + make test-frontend output (plus the pool smoke) on the release issue at the same git SHA as the deployed wasm, before mainnet
it explicitly lets CI-built artifacts satisfy the gate by linking the green pipeline (test-contracts / test-indexer-integration / test-frontend) instead of re-pasting
deploy-trace.md carries the matching "Test results (pre-deploy evidence — SEC-H08)" section
and it's wired into the go/no-go BLOCK table (SEC-H08 row → make verify-issue-444)

All three checklist items covered. Good to close from my side.

@PlasticDigits

Verified the SEC-H08 test-evidence gate on main (it's already merged in, 4aabd71d). `make verify-issue-444` → 8/8 PASS. The gate landed where it needs to: - launch-checklist Phase 0 now requires pasting/linking `make test-contracts` + `make test-indexer-integration` + `make test-frontend` output (plus the pool smoke) on the release issue at the same git SHA as the deployed wasm, before mainnet - it explicitly lets CI-built artifacts satisfy the gate by linking the green pipeline (test-contracts / test-indexer-integration / test-frontend) instead of re-pasting - deploy-trace.md carries the matching "Test results (pre-deploy evidence — SEC-H08)" section - and it's wired into the go/no-go BLOCK table (SEC-H08 row → `make verify-issue-444`) All three checklist items covered. Good to close from my side. @PlasticDigits