#503 - feat: Phase 5 — UST1/wrap production ops hardening (alerts, pause playbooks, registries) - code/cl8y-dex-terraclassic

PlasticDigits commented

2026-07-29 02:07:49 +00:00

(Migrated from gitlab.com)

Summary

Production ops hardening for the UST1 oracle window, CMM treasury (vFDUSD inventory + wrap backing), wrap-mapper controls, and address registries after Phases 2–4 ship on / around dex.cl8y.com.

This issue is the cross-repo runbook + verification hub hosted on the live DEX repo. Implementation work for contracts/UI remains in Phase 2–4 issues; this issue tracks monitoring, alerting, pause playbooks, and registry completeness.

Phase 0 / 1: Approved architecture; Phase 1 prerequisites confirmed. Parameter targets: window fee 1%, 1000 UST1/tx, 10k UST1/24h; wrap fee 1% — all governance-updatable.

Current codebase / ops surface

Surface	Today
DEX prod	`dex.cl8y.com` + `indexer.dex.cl8y.com` (Coolify); soft-launch CW20 only
Oracle service	`ust1-window/oracle-service` — liveness alert if no broadcast ~8h; needs prod host + secrets
Treasury	Mainnet `terra16j5u6…` (pre-wrap until Phase 3 migrate); holds future vFDUSD + native wrap backing
Wrap pause / rate-limit UX	Implemented for LocalTerra patterns (#389, #463, SEC-B06 smoke scripts) — must be validated on mainnet
Address registries	Soft-launch under `deployments/mainnet-soft-launch/`; ust1-window `DEPLOYMENT.md` registry blank; ustr-cmm docs stale on wrap

Why this is needed

Always-on oracle mint/redeem fails closed on stale rates; wrap/unwrap fails closed on pause or insolvency. Without monitoring and rehearsed pause/allowance playbooks, production incidents become user-facing outages or stuck funds. Soft launch did not include these economic systems.

Constraints / guardrails

No mnemonics or private keys in git; Coolify/Render/host secrets only.
Prefer read-only monitoring dashboards + alerts; mutating ops via governance multisig / documented admin keys only.
Pause is the primary incident control (window, oracle governance, wrap-mapper, treasury wrapping_paused) — rehearse before public marketing push.
Do not “fix” oracle staleness by disabling age checks; restore operator / RPCs.
Treasury vFDUSD allowance and balances are a withdraw capacity constraint — monitor both.
Keep SL1 whitelist / economic token policy explicit; don’t silently widen factory whitelist in ops panic.
Cross-link Phase 2–4 issues; update registries in all three repos when addresses change.

Relevant files / systems

This repo

deployments/mainnet-soft-launch/ (+ new deployments/mainnet-ust1-wrap/ or extend registry)
docs/runbooks/ (add ust1-window + wrap mainnet runbook)
docs/user-incident-faq.md (wrap section; add UST1 window FAQ)
docs/qa-templates/wrap-unwrap-test-pass.md
scripts/smoke-wrap-mapper-pause.sh / make smoke-wrap-mapper-pause
Coolify indexer/frontend env docs

ust1-window

docs/DEPLOYMENT.md registry
oracle-service/ + scripts/verify_oracle_operator_env.sh
Alert: ORACLE_MAX_SILENCE_SECS (~8h)

ustr-cmm

docs/DEPLOYMENT.md / CONTRACTS.md post-migrate wrap addresses
Treasury / wrap-mapper governance pause msgs

Recommended direction

Address registry pack: single canonical table (DEX deployments dir) linking factory/router/window/oracle/vFDUSD/UST1/treasury/wrap-mapper/cLUNC/cUSTC + Coolify env keys; mirror into ust1-window + ustr-cmm docs.
Oracle ops: prod service deploy; multi-RPC; silence alert to on-call channel; weekly EffectiveSwap freshness check.
Treasury inventory: alerts for low vFDUSD balance and low allowance vs 24h limit; native uluna/uusd vs CW20 supply solvency check (W1).
Pause playbooks: step-by-step for window pause, wrap-mapper pause, treasury wrapping pause; who signs; user-facing status copy on /ust1 and Swap.
Rate-limit playbook: how to read wrap-mapper limits; when to raise caps; distinguish from indexer HTTP 429.
Incident FAQ: publish UST1 stale-oracle / limit / pause and wrap pause entries.
Drill: schedule tabletop + optional mainnet pause/unpause rehearsal off-peak.

Acceptance criteria

Canonical mainnet address registry committed (no secrets) covering Phase 2–4 contracts.
Oracle service verified live; silence alert delivers to a watched channel (or documented pager).
Documented checks for: oracle age, window pause, wrap pause, treasury vFDUSD balance/allowance, wrap solvency.
Pause playbooks written and linked from docs/runbooks/ + user FAQ updates.
verify_oracle_operator_env documented for prod; wrap pause smoke procedure recorded for columbus-5.
On-call ownership named (role/person) for oracle bot key + treasury governance.
Cross-links to Phase 2–4 issues present and kept updated through launch.

Test plan (happy / functional paths)

Run scripts/verify_oracle_operator_env.sh against production env (dry secret injection).
Confirm oracle state.last_update advances within policy window after deploy.
Query window effective_swap and wrap-mapper config / rate_limit from a monitored script or dashboard.
Execute wrap-mapper pause smoke on mainnet (or documented equivalent of make smoke-wrap-mapper-pause) then unpause.
Simulate low-balance alert threshold on staging/mock; confirm notification path.
Walk through FAQ + runbook in a tabletop: stale oracle, allowance exhausted, wrap pause.

Test plan (attack / hack / abuse vectors)

Vector	Expected ops response
Oracle operator key compromise	Rotate operator via governance; pause window if needed; revoke old key
BSC RPC poisoning / divergence	Multi-RPC consensus; remove bad endpoint; alert on update failures
Allowance drain grief (max withdraws)	Inventory alerts; temporary window pause; refill allowance/balance
Wrap solvency attack (inflate CW20)	Should be impossible without minter; monitor supply vs treasury; pause unwrap
Governance phishing / malicious migrate	Multisig dual-control; never accept unsolicited wasm migrate
Alert fatigue / silenced pager	Document escalation; periodic alert test
Public dump of mnemonic in logs	Log redaction review; rotate immediately if exposure suspected
UI showing healthy while chain paused	Frontend reads on-chain pause; ops verify CTA matches chain

Verification criteria

Registry PR merged; Coolify env matches registry.
Evidence of alert path test (screenshot/log) attached to this issue.
Pause drill notes attached (even if dry-run).
Phase 2–4 acceptance criteria not blocked by missing ops docs.
Launch go/no-go checklist includes oracle freshness + treasury capacity + wrap unpaused.

Phase 2: ust1-window deploy + oracle service
Phase 3: ustr-cmm treasury migrate + wrap-mapper
Phase 4: dex.cl8y.com /ust1 + wraps + secondary AMM

## Summary Production **ops hardening** for the UST1 oracle window, CMM treasury (vFDUSD inventory + wrap backing), wrap-mapper controls, and address registries after Phases 2–4 ship on / around `dex.cl8y.com`. This issue is the **cross-repo runbook + verification hub** hosted on the live DEX repo. Implementation work for contracts/UI remains in Phase 2–4 issues; this issue tracks monitoring, alerting, pause playbooks, and registry completeness. **Phase 0 / 1:** Approved architecture; Phase 1 prerequisites confirmed. Parameter targets: window fee 1%, 1000 UST1/tx, 10k UST1/24h; wrap fee 1% — all governance-updatable. --- ## Current codebase / ops surface | Surface | Today | |---------|-------| | DEX prod | `dex.cl8y.com` + `indexer.dex.cl8y.com` (Coolify); soft-launch CW20 only | | Oracle service | `ust1-window/oracle-service` — liveness alert if no broadcast ~8h; needs prod host + secrets | | Treasury | Mainnet `terra16j5u6…` (pre-wrap until Phase 3 migrate); holds future vFDUSD + native wrap backing | | Wrap pause / rate-limit UX | Implemented for LocalTerra patterns (#389, #463, SEC-B06 smoke scripts) — must be validated on mainnet | | Address registries | Soft-launch under `deployments/mainnet-soft-launch/`; ust1-window `DEPLOYMENT.md` registry blank; ustr-cmm docs stale on wrap | --- ## Why this is needed Always-on oracle mint/redeem fails closed on stale rates; wrap/unwrap fails closed on pause or insolvency. Without monitoring and rehearsed pause/allowance playbooks, production incidents become user-facing outages or stuck funds. Soft launch did not include these economic systems. --- ## Constraints / guardrails 1. No mnemonics or private keys in git; Coolify/Render/host secrets only. 2. Prefer **read-only** monitoring dashboards + alerts; mutating ops via governance multisig / documented admin keys only. 3. Pause is the primary incident control (window, oracle governance, wrap-mapper, treasury `wrapping_paused`) — rehearse before public marketing push. 4. Do not “fix” oracle staleness by disabling age checks; restore operator / RPCs. 5. Treasury vFDUSD allowance and balances are a **withdraw capacity** constraint — monitor both. 6. Keep SL1 whitelist / economic token policy explicit; don’t silently widen factory whitelist in ops panic. 7. Cross-link Phase 2–4 issues; update registries in **all three** repos when addresses change. --- ## Relevant files / systems **This repo** - `deployments/mainnet-soft-launch/` (+ new `deployments/mainnet-ust1-wrap/` or extend registry) - `docs/runbooks/` (add ust1-window + wrap mainnet runbook) - `docs/user-incident-faq.md` (wrap section; add UST1 window FAQ) - `docs/qa-templates/wrap-unwrap-test-pass.md` - `scripts/smoke-wrap-mapper-pause.sh` / `make smoke-wrap-mapper-pause` - Coolify indexer/frontend env docs **ust1-window** - `docs/DEPLOYMENT.md` registry - `oracle-service/` + `scripts/verify_oracle_operator_env.sh` - Alert: `ORACLE_MAX_SILENCE_SECS` (~8h) **ustr-cmm** - `docs/DEPLOYMENT.md` / `CONTRACTS.md` post-migrate wrap addresses - Treasury / wrap-mapper governance pause msgs --- ## Recommended direction 1. **Address registry pack:** single canonical table (DEX deployments dir) linking factory/router/window/oracle/vFDUSD/UST1/treasury/wrap-mapper/cLUNC/cUSTC + Coolify env keys; mirror into ust1-window + ustr-cmm docs. 2. **Oracle ops:** prod service deploy; multi-RPC; silence alert to on-call channel; weekly `EffectiveSwap` freshness check. 3. **Treasury inventory:** alerts for low vFDUSD balance and low allowance vs 24h limit; native `uluna`/`uusd` vs CW20 supply solvency check (W1). 4. **Pause playbooks:** step-by-step for window pause, wrap-mapper pause, treasury wrapping pause; who signs; user-facing status copy on `/ust1` and Swap. 5. **Rate-limit playbook:** how to read wrap-mapper limits; when to raise caps; distinguish from indexer HTTP 429. 6. **Incident FAQ:** publish UST1 stale-oracle / limit / pause and wrap pause entries. 7. **Drill:** schedule tabletop + optional mainnet pause/unpause rehearsal off-peak. --- ## Acceptance criteria - [ ] Canonical mainnet address registry committed (no secrets) covering Phase 2–4 contracts. - [ ] Oracle service verified live; silence alert delivers to a watched channel (or documented pager). - [ ] Documented checks for: oracle age, window pause, wrap pause, treasury vFDUSD balance/allowance, wrap solvency. - [ ] Pause playbooks written and linked from `docs/runbooks/` + user FAQ updates. - [ ] `verify_oracle_operator_env` documented for prod; wrap pause smoke procedure recorded for columbus-5. - [ ] On-call ownership named (role/person) for oracle bot key + treasury governance. - [ ] Cross-links to Phase 2–4 issues present and kept updated through launch. --- ## Test plan (happy / functional paths) 1. Run `scripts/verify_oracle_operator_env.sh` against production env (dry secret injection). 2. Confirm oracle `state.last_update` advances within policy window after deploy. 3. Query window `effective_swap` and wrap-mapper `config` / `rate_limit` from a monitored script or dashboard. 4. Execute wrap-mapper pause smoke on mainnet (or documented equivalent of `make smoke-wrap-mapper-pause`) then unpause. 5. Simulate low-balance alert threshold on staging/mock; confirm notification path. 6. Walk through FAQ + runbook in a tabletop: stale oracle, allowance exhausted, wrap pause. --- ## Test plan (attack / hack / abuse vectors) | Vector | Expected ops response | |--------|------------------------| | Oracle operator key compromise | Rotate operator via governance; pause window if needed; revoke old key | | BSC RPC poisoning / divergence | Multi-RPC consensus; remove bad endpoint; alert on update failures | | Allowance drain grief (max withdraws) | Inventory alerts; temporary window pause; refill allowance/balance | | Wrap solvency attack (inflate CW20) | Should be impossible without minter; monitor supply vs treasury; pause unwrap | | Governance phishing / malicious migrate | Multisig dual-control; never accept unsolicited wasm migrate | | Alert fatigue / silenced pager | Document escalation; periodic alert test | | Public dump of mnemonic in logs | Log redaction review; rotate immediately if exposure suspected | | UI showing healthy while chain paused | Frontend reads on-chain pause; ops verify CTA matches chain | --- ## Verification criteria - [ ] Registry PR merged; Coolify env matches registry. - [ ] Evidence of alert path test (screenshot/log) attached to this issue. - [ ] Pause drill notes attached (even if dry-run). - [ ] Phase 2–4 acceptance criteria not blocked by missing ops docs. - [ ] Launch go/no-go checklist includes oracle freshness + treasury capacity + wrap unpaused. ### Related - Phase 2: ust1-window deploy + oracle service - Phase 3: ustr-cmm treasury migrate + wrap-mapper - Phase 4: dex.cl8y.com `/ust1` + wraps + secondary AMM

PlasticDigits commented

2026-07-29 02:08:01 +00:00

(Migrated from gitlab.com)

mentioned in issue PlasticDigits2/ustr-cmm#5

PlasticDigits commented

2026-07-29 02:08:03 +00:00

(Migrated from gitlab.com)

mentioned in issue #502

PlasticDigits commented

2026-07-29 02:08:04 +00:00

(Migrated from gitlab.com)

Cross-repo tracking (Phase 0 approved)

Phase	Repo	Issue
2 — UST1↔vFDUSD window deploy	ust1-window	https://gitlab.com/PlasticDigits/ust1-window/-/work_items/19
3 — Treasury migrate + wrap-mapper	ustr-cmm	https://gitlab.com/PlasticDigits2/ustr-cmm/-/work_items/5
4 — `/ust1` UI + wraps + secondary AMM	cl8y-dex-terraclassic	https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/502
5 — Ops hardening	cl8y-dex-terraclassic	https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/503

Approved params: window fee_bps=100, per-tx 1000 UST1, 24h 10000 UST1; wrap fee_bps=100 (1%). UI at dex.cl8y.com/ust1. Skip cmm-native-wrap. Phase 1 prerequisites confirmed.

## Cross-repo tracking (Phase 0 approved) | Phase | Repo | Issue | |-------|------|-------| | 2 — UST1↔vFDUSD window deploy | ust1-window | https://gitlab.com/PlasticDigits/ust1-window/-/work_items/19 | | 3 — Treasury migrate + wrap-mapper | ustr-cmm | https://gitlab.com/PlasticDigits2/ustr-cmm/-/work_items/5 | | 4 — `/ust1` UI + wraps + secondary AMM | cl8y-dex-terraclassic | https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/502 | | 5 — Ops hardening | cl8y-dex-terraclassic | https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/503 | **Approved params:** window `fee_bps=100`, per-tx **1000** UST1, 24h **10000** UST1; wrap `fee_bps=100` (1%). UI at `dex.cl8y.com/ust1`. Skip `cmm-native-wrap`. Phase 1 prerequisites confirmed.

PlasticDigits commented

2026-07-29 05:21:23 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-07-29 05:21:24 +00:00

(Migrated from gitlab.com)

Naming update

Wrapped token symbols are cLUNC and cUSTC (not LUNC-C / USTC-C).

LocalTerra / existing DEX code may still say LUNC-C/USTC-C — Phase 3–4 implementation must mint and display cLUNC / cUSTC on mainnet and align frontend registry/env naming.

## Naming update Wrapped token symbols are **cLUNC** and **cUSTC** (not `LUNC-C` / `USTC-C`). LocalTerra / existing DEX code may still say `LUNC-C`/`USTC-C` — Phase 3–4 implementation must mint and display **cLUNC** / **cUSTC** on mainnet and align frontend registry/env naming.

PlasticDigits commented

2026-08-08 11:26:05 +00:00

(Migrated from gitlab.com)

mentioned in issue #506

PlasticDigits commented

2026-08-09 09:25:30 +00:00

(Migrated from gitlab.com)

mentioned in commit 25c48526d5

mentioned in commit 25c48526d51d2a050da19a69088fb7192184e355

PlasticDigits commented

2026-08-09 09:25:43 +00:00

(Migrated from gitlab.com)

mentioned in merge request !1047

PlasticDigits commented

2026-08-09 09:26:00 +00:00

(Migrated from gitlab.com)

mentioned in merge request !1048

PlasticDigits commented

2026-08-09 09:26:07 +00:00

(Migrated from gitlab.com)

In-repo Phase 5 ops pack (MR !1048)

Landed on feat/503-ust1-wrap-ops-hardening: https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/330

Acceptance criteria (this MR)

Canonical mainnet address registry committed (deployments/mainnet-ust1-wrap/REGISTRY.md + Coolify example) — no secrets
Oracle service verified live; silence alert delivers to watched channel — docs/checklist only; attach pager evidence here (upstream verify_oracle_operator_env in ust1-window)
Documented checks for oracle age, window/oracle pause, wrap pause, treasury wrapping pause, vFDUSD balance/allowance, wrap solvency — runbook + make check-ust1-wrap-ops-health
Pause playbooks + FAQ updates (ust1-wrap-production-ops.md, wrap-mapper-pause.md, user FAQ)
verify_oracle_operator_env documented for prod; columbus-5 wrap pause smoke procedure recorded (wrap-mapper-pause.md)
On-call ownership named by role (Oracle bot operator / Treasury-wrap governance / DEX governance / Coolify) — person fill privately
Cross-links to Phase 2–4 (#502/#506/#507/#508 + upstream) present

Live LCD probe (VERIFY503_MAINNET=1)

Hard checks green. WARN today: treasury vFDUSD balance very low + allowance→window = 0 (withdraw capacity). Wrap solvency OK. Wrap-mapper fee_bps=200 on-chain (UI must query).

Still for operators

Attach silence-alert test evidence
Columbus-5 pause drill (or dry-run) notes
Refill vFDUSD allowance/balance before marketing push
Confirm Coolify matches registry

## In-repo Phase 5 ops pack (MR !1048) Landed on `feat/503-ust1-wrap-ops-hardening`: https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/330 ### Acceptance criteria (this MR) - [x] Canonical mainnet address registry committed (`deployments/mainnet-ust1-wrap/REGISTRY.md` + Coolify example) — no secrets - [ ] Oracle service verified live; silence alert delivers to watched channel — **docs/checklist only**; attach pager evidence here (upstream `verify_oracle_operator_env` in ust1-window) - [x] Documented checks for oracle age, window/oracle pause, wrap pause, treasury wrapping pause, vFDUSD balance/allowance, wrap solvency — runbook + `make check-ust1-wrap-ops-health` - [x] Pause playbooks + FAQ updates (`ust1-wrap-production-ops.md`, `wrap-mapper-pause.md`, user FAQ) - [x] `verify_oracle_operator_env` documented for prod; columbus-5 wrap pause smoke procedure recorded (`wrap-mapper-pause.md`) - [x] On-call ownership named by **role** (Oracle bot operator / Treasury-wrap governance / DEX governance / Coolify) — person fill privately - [x] Cross-links to Phase 2–4 (#502/#506/#507/#508 + upstream) present ### Live LCD probe (VERIFY503_MAINNET=1) Hard checks green. **WARN** today: treasury vFDUSD balance very low + allowance→window = **0** (withdraw capacity). Wrap solvency OK. Wrap-mapper `fee_bps=200` on-chain (UI must query). ### Still for operators 1. Attach silence-alert test evidence 2. Columbus-5 pause drill (or dry-run) notes 3. Refill vFDUSD allowance/balance before marketing push 4. Confirm Coolify matches registry

PlasticDigits commented

2026-08-09 09:26:21 +00:00

(Migrated from gitlab.com)

Implementation update (in-repo)

MR: https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/330 (feat/503-ust1-wrap-ops-hardening)

Acceptance criteria checkoff

Canonical mainnet address registry committed (no secrets) — deployments/mainnet-ust1-wrap/REGISTRY.md + coolify.env.example
Oracle service verified live; silence alert to watched channel — docs/checklist only (verify_oracle_operator_env in ust1-window); needs operator evidence on this issue
Documented checks for oracle age, window/wrap pause, treasury vFDUSD balance/allowance, wrap solvency — runbook + scripts/check-ust1-wrap-ops-health.sh
Pause playbooks + FAQ updates — docs/runbooks/ust1-wrap-production-ops.md, wrap-mapper-pause.md, docs/user-incident-faq.md
verify_oracle_operator_env documented for prod; columbus-5 wrap pause smoke procedure recorded — procedure in runbooks (live drill still pending)
On-call ownership named by role (PlasticDigits maintainers) — person fill remains private on this issue
Cross-links to Phase 2–4 issues (#502/#506/#507/#508) + agent skill

Verification

make verify-issue-503 PASS (retested)
VERIFY503_MAINNET=1 make verify-issue-503 PASS with WARNs: treasury vFDUSD balance low + allowance to window = 0; wrap-mapper fee_bps=200 on-chain

Follow-ups (ops, not blocked on this MR)

Attach silence-alert evidence / pager test
Refill vFDUSD inventory + window allowance before marketing withdraw capacity
Optional off-peak columbus-5 wrap pause drill (or dry-run notes)
Confirm Coolify env matches registry

## Implementation update (in-repo) MR: https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/330 (`feat/503-ust1-wrap-ops-hardening`) ### Acceptance criteria checkoff - [x] Canonical mainnet address registry committed (no secrets) — `deployments/mainnet-ust1-wrap/REGISTRY.md` + `coolify.env.example` - [ ] Oracle service verified live; silence alert to watched channel — **docs/checklist only** (`verify_oracle_operator_env` in ust1-window); needs operator evidence on this issue - [x] Documented checks for oracle age, window/wrap pause, treasury vFDUSD balance/allowance, wrap solvency — runbook + `scripts/check-ust1-wrap-ops-health.sh` - [x] Pause playbooks + FAQ updates — `docs/runbooks/ust1-wrap-production-ops.md`, `wrap-mapper-pause.md`, `docs/user-incident-faq.md` - [x] `verify_oracle_operator_env` documented for prod; columbus-5 wrap pause smoke procedure recorded — procedure in runbooks (live drill still pending) - [x] On-call ownership named by **role** (PlasticDigits maintainers) — person fill remains private on this issue - [x] Cross-links to Phase 2–4 issues (#502/#506/#507/#508) + agent skill ### Verification - `make verify-issue-503` PASS (retested) - `VERIFY503_MAINNET=1 make verify-issue-503` PASS with WARNs: treasury vFDUSD balance low + allowance to window = 0; wrap-mapper `fee_bps=200` on-chain ### Follow-ups (ops, not blocked on this MR) 1. Attach silence-alert evidence / pager test 2. Refill vFDUSD inventory + window allowance before marketing withdraw capacity 3. Optional off-peak columbus-5 wrap pause drill (or dry-run notes) 4. Confirm Coolify env matches registry

PlasticDigits commented

2026-08-09 09:34:14 +00:00

(Migrated from gitlab.com)

mentioned in commit f8bc750665

mentioned in commit f8bc7506659e3859c6829c2bc70cd68c17b3a4bc

PlasticDigits commented

2026-08-09 09:35:59 +00:00

(Migrated from gitlab.com)

mentioned in commit 19e12121ad

mentioned in commit 19e12121ad7aa3597b192070d88859920d13cb96

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-08-09 09:37:29 +00:00

PlasticDigits commented

2026-08-15 12:05:43 +00:00

(Migrated from gitlab.com)

mentioned in issue #523

PlasticDigits commented

2026-08-15 12:35:42 +00:00

(Migrated from gitlab.com)

mentioned in issue #525

PlasticDigits commented

2026-08-15 12:35:42 +00:00

(Migrated from gitlab.com)

marked as related to #525

PlasticDigits commented

2026-08-15 12:43:43 +00:00

(Migrated from gitlab.com)

marked as related to #526

PlasticDigits commented

2026-08-16 13:26:57 +00:00

(Migrated from gitlab.com)

mentioned in merge request ust1-window!731

PlasticDigits commented

2026-08-19 11:49:49 +00:00

(Migrated from gitlab.com)

mentioned in issue #574

PlasticDigits commented

2026-08-19 11:49:50 +00:00

(Migrated from gitlab.com)

marked as related to #574

PlasticDigits commented

2026-08-19 11:49:56 +00:00

(Migrated from gitlab.com)

mentioned in issue #575

PlasticDigits commented

2026-08-19 11:49:57 +00:00

(Migrated from gitlab.com)

marked as related to #575

PlasticDigits commented

2026-08-24 00:30:20 +00:00

(Migrated from gitlab.com)

mentioned in issue #614

PlasticDigits commented

2026-08-24 00:30:21 +00:00

(Migrated from gitlab.com)

marked as related to #614

PlasticDigits commented

2026-08-25 05:56:59 +00:00

(Migrated from gitlab.com)

O6 update after #525/#526 accepts (2026-08-25): wrap-mapper + CMM treasury app governance is now the DEX 2-of-3 terra1zlmv2…hep7. ust1-window / oracle stay cl8y2_admin. Mapper/treasury wasm admin still the EOA.

Pause / set_fees / set_wrapping_paused on mapper + treasury require scripts/multisig-2of3-host-tx.sh. Registry + pause playbooks updated in-repo.

O6 update after #525/#526 accepts (2026-08-25): wrap-mapper + CMM treasury app governance is now the DEX 2-of-3 terra1zlmv2…hep7. ust1-window / oracle stay cl8y2_admin. Mapper/treasury wasm admin still the EOA. Pause / set_fees / set_wrapping_paused on mapper + treasury require scripts/multisig-2of3-host-tx.sh. Registry + pause playbooks updated in-repo.

Rows
Columns

feat: Phase 5 — UST1/wrap production ops hardening (alerts, pause playbooks, registries) #503

Summary

Current codebase / ops surface

Why this is needed

Constraints / guardrails

Relevant files / systems

Recommended direction

Acceptance criteria

Test plan (happy / functional paths)

Test plan (attack / hack / abuse vectors)

Verification criteria

Related

Cross-repo tracking (Phase 0 approved)

Naming update

In-repo Phase 5 ops pack (MR !1048)

Acceptance criteria (this MR)

Live LCD probe (VERIFY503_MAINNET=1)

Still for operators

Implementation update (in-repo)

Acceptance criteria checkoff

Verification

Follow-ups (ops, not blocked on this MR)