code/cl8y-dex-terraclassic
4
0
Fork 0
Code Issues 35 Pull requests 6 Projects Releases Packages Wiki Activity

feat(#503): UST1/wrap production ops registry, health checks, pause playbooks #1048

Merged
PlasticDigits merged 2 commits from feat/503-ust1-wrap-ops-hardening into main 2026-08-09 09:35:58 +00:00
Conversation 8 Commits 2 Files changed 24 +1047 -10
PlasticDigits commented 2026-08-09 09:25:59 +00:00 (Migrated from gitlab.com)
Copy link

Summary

  • Canonical columbus-5 Phase 2–4 address registry + Coolify env pack under deployments/mainnet-ust1-wrap/ (no secrets).
  • Ops hub runbook + wrap-mapper pause playbook with invariants O1–O8, on-call roles, oracle silence-alert checklist, and pause recipes (window / oracle circuit breaker / mapper / treasury).
  • Read-only LCD health probe (make check-ust1-wrap-ops-health) covering oracle age/pause, wrap pause, treasury wrapping pause, vFDUSD balance/allowance, wrap solvency, wrap-mapper rate_limit.
  • User FAQ sections for UST1 stale/pause and wrap pause; agent skill AGENTS_UST1_WRAP_PRODUCTION_OPS.md; make verify-issue-503.

Refs #503 for in-repo acceptance. Do not treat merge as full issue close — live oracle pager evidence, columbus-5 pause drill, and Coolify frontend VITE_* parity still need operator attach on the issue.

Test plan

  • make verify-issue-503 (docs/script gates, O1–O8)
  • VERIFY503_MAINNET=1 make verify-issue-503 (live LCD; WARNs on low vFDUSD balance/allowance expected today)
  • make check-ust1-wrap-ops-health
  • Operator: attach oracle silence-alert evidence on #503
  • Operator: columbus-5 wrap pause drill (or dry-run notes) per wrap-mapper-pause.md
  • Coolify frontend env matches deployments/mainnet-ust1-wrap/coolify.env.example
  • Coolify oracle-service: silence alert delivery proof (env alone is not enough)

Review follow-ups landed (f8bc750)

  • Oracle set_paused playbook (A2) + treasury privilege label fix
  • Silence default 21600 (aligned with Coolify / on-chain max age)
  • UST1_OPS_STRICT_INVENTORY=1, empty bank LCD hard-fail, rate_limit probe
  • launch-checklist.md UST1/wrap go/no-go extras; fee_bps doc drift (live 200)
## Summary - Canonical columbus-5 Phase 2–4 address registry + Coolify env pack under `deployments/mainnet-ust1-wrap/` (no secrets). - Ops hub runbook + wrap-mapper pause playbook with invariants **O1–O8**, on-call roles, oracle silence-alert checklist, and pause recipes (window / **oracle circuit breaker** / mapper / treasury). - Read-only LCD health probe (`make check-ust1-wrap-ops-health`) covering oracle age/pause, wrap pause, treasury wrapping pause, vFDUSD balance/allowance, wrap solvency, wrap-mapper `rate_limit`. - User FAQ sections for UST1 stale/pause and wrap pause; agent skill `AGENTS_UST1_WRAP_PRODUCTION_OPS.md`; `make verify-issue-503`. **Refs #503** for in-repo acceptance. Do **not** treat merge as full issue close — live oracle pager evidence, columbus-5 pause drill, and Coolify frontend `VITE_*` parity still need operator attach on the issue. ## Test plan - [x] `make verify-issue-503` (docs/script gates, O1–O8) - [x] `VERIFY503_MAINNET=1 make verify-issue-503` (live LCD; WARNs on low vFDUSD balance/allowance expected today) - [x] `make check-ust1-wrap-ops-health` - [ ] Operator: attach oracle silence-alert evidence on #503 - [ ] Operator: columbus-5 wrap pause drill (or dry-run notes) per `wrap-mapper-pause.md` - [ ] Coolify frontend env matches `deployments/mainnet-ust1-wrap/coolify.env.example` - [ ] Coolify oracle-service: silence alert delivery proof (env alone is not enough) ## Review follow-ups landed (`f8bc750`) - Oracle `set_paused` playbook (A2) + treasury privilege label fix - Silence default **21600** (aligned with Coolify / on-chain max age) - `UST1_OPS_STRICT_INVENTORY=1`, empty bank LCD hard-fail, rate_limit probe - `launch-checklist.md` UST1/wrap go/no-go extras; fee_bps doc drift (live 200)
PlasticDigits commented 2026-08-09 09:26:07 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in issue #503

mentioned in issue #503
PlasticDigits commented 2026-08-09 09:30:43 +00:00 (Migrated from gitlab.com)
Copy link

RECOMMEND: FIX

Thorough review of MR 330 (feat/503-ust1-wrap-ops-hardening) against #503 acceptance/verification criteria, security surfaces (secrets, access control, agent prompt injection, health-script attack surface, DeFi/ops attack response coverage), and gap analysis (features, testing, DRY, UX, packages).

Scope note: This MR is docs/scripts/deployments only (+922 / 23 files). No smart-contract, indexer, or frontend code changes — appropriate for Phase 5 ops hardening. Live contract/economic security of UST1/wrap is out of band except where this MR documents operator response.

Verification performed

Check Result
make verify-issue-503 PASS (7 gates)
VERIFY503_MAINNET=1 make verify-issue-503 PASS (8 gates; health 12 PASS / 2 WARN / 0 FAIL)
Secrets grep on registry pack Clean (no mnemonics/keys)
Pause JSON vs in-repo schemas wrap-mapper SetPaused + treasury SetWrappingPaused match; ust1-window unverified upstream (doc caveat OK)
Live LCD (columbus-5) Oracle fresh, all pause flags false, wrap treasury/gov match registry, solvency OK; vFDUSD bal≈48506 raw, allowance=0 (WARN)

#503 acceptance / verification checklist

Criterion Status Notes
Canonical Phase 2–4 registry (no secrets) DONE deployments/mainnet-ust1-wrap/
Documented checks (oracle age, pauses, vFDUSD, solvency) DONE Runbook + check-ust1-wrap-ops-health.sh
Pause playbooks + user FAQ DONE (gap below) Window / wrap-mapper / treasury; FAQ § UST1 + wrap pause
Cross-links #502/#506/#507/#508 DONE
verify_oracle_operator_env documented PARTIAL Points to ust1-window (correct); not run/evidenced here
On-call ownership PARTIAL Roles named; people deferred to #503 (privacy OK)
Oracle silence-alert evidence MISSING Operator — MR test plan unchecked
Columbus-5 wrap pause drill MISSING Documented; not executed
Coolify env matches example MISSING Operator post-merge
Launch go/no-go wired PARTIAL Checklist in ops runbook; not linked from launch-checklist.md

“Closes #503” is premature for full issue sign-off. In-repo acceptance is close, but leave #503 open (or use a non-closing reference) until operator evidence is attached. Prefer Refs #503 / issue comment for remaining gates, or keep Closes only if GitLab workflow intentionally closes and reopens — currently the description overclaims.

Security audit

No BLOCK findings

  • No secrets in git; Coolify example is public VITE_* only
  • Health script is read-only LCD (set -euo pipefail, jq-built messages, no eval); no DB strings
  • Agent skill AGENTS_UST1_WRAP_PRODUCTION_OPS.md prioritizes read-only probes / no secrets — low prompt-injection risk
  • O6 DEX vs wrap-stack governance split documented; emergency-commands.md scope guard is correct
  • Common DeFi/ops vectors partially mapped (key compromise, allowance grief, solvency, phishing migrate, UI vs chain pause)

FIX before merge (doc correctness / ops safety)

  1. Missing oracle pause playbook (MEDIUM) — O3 lists ust1-oracle pause as a primary control, but there is no execute JSON / signer preflight / upstream schema link. Under incident, operators may guess wrong msg or wrong key.
  2. Treasury privilege mislabel (MEDIUM) — On-call row says treasury signs set_paused / set_wrapping_paused. Treasury uses set_wrapping_paused only; set_paused is window/wrap-mapper. Fix the table.
  3. Rate-limit ops depth (MEDIUM) — #503 asks how to read wrap-mapper limits and when to raise caps. MR only distinguishes indexer 429 vs on-chain limits; add rate_limit query (+ raise-cap pointer or explicit deferral to ustr-cmm).
  4. O1–O8 vs O1–O7 drift (LOW) — Runbook/skill define O8; verify-issue-503.sh / Makefile / commit framing still say O1–O7 and only grep O1–O7. Align automation + docs.
  5. Bank LCD failure → balance 0 (LOW) — empty bank response coerced to 0 can false-pass solvency if CW20 supply also fails to 0. Treat empty bank as hard FAIL.
  6. launch-checklist.md cross-link (LOW) — wire #503 go/no-go extras so launch gates are discoverable from the canonical checklist.

Residual / out-of-MR (not merge blockers for docs, but launch blockers)

  • Live vFDUSD allowance = 0 (balance far below warn) — UST1 withdraw capacity effectively blocked; refill before marketing. Consider UST1_OPS_STRICT_INVENTORY=1 for launch gates (today WARN still exits 0).
  • Attack-vector table from #503 only partially operationalized (BSC RPC poisoning, mnemonic-in-logs rotation, mint-inflation narrative).
  • Cross-repo registry mirrors (ust1-window / ustr-cmm) still operator work.
  • No cron/Prometheus/webhook wiring for the health script (expected future hardening).

Surfaces correctly N/A for this diff

  • Smart-contract design / gas opts / reentrancy / SC unit tests — no wasm changes
  • Indexer DB leaks / Rust API auth — untouched
  • Frontend E2E / Playwright — untouched (appropriate); LocalTerra wrap pause remains make smoke-wrap-mapper-pause
  • Tokenomic/oracle manipulation protocol fixes — ops response docs only; do not disable age checks (O2) is correct

Gap analysis (non-security)

Area Verdict
Features vs operator expectations Strong registry + probe + pause recipes; weak automated alerting / strict inventory / rate-limit playbook
UI/UX FAQ Good retail copy; UST1 ≠ faucet; 429 ≠ wrap rate limit
Testing Doc/grep gates + optional live LCD useful; no unit/mocked bad-path tests for health script
Packages Docs/scripts/deployments only — correct for #503
DRY / readability Shared defaults lib is good; O7/O8 + fee_bps 100 vs live 200 doc drift elsewhere (AGENTS_MAINNET_WRAP_ENABLEMENT W4 / QA template)
User-expected features Cron examples, multi-LCD failover, Slack templates, strict launch inventory — missing (P2)

Required fixes for ACCEPT

  1. Add ust1-oracle pause/unpause playbook section (or hard link to ust1-window schema) with governance preflight.
  2. Correct treasury on-call row to set_wrapping_paused only.
  3. Align O8 in verify-issue-503.sh / Makefile comments (and AGENTS blurb if needed).
  4. Soften GitLab autoclose language: do not claim full #503 closure until operator test-plan boxes are checked (pager + pause drill + Coolify).
  5. (Recommended) Link ops go/no-go from launch-checklist.md; harden empty bank LCD to FAIL; add wrap rate_limit read example.

After those doc/script nits, this is merge-ready for in-repo Phase 5 ops hardening. Not a security BLOCK.

RECOMMEND: FIX Thorough review of MR 330 (`feat/503-ust1-wrap-ops-hardening`) against #503 acceptance/verification criteria, security surfaces (secrets, access control, agent prompt injection, health-script attack surface, DeFi/ops attack response coverage), and gap analysis (features, testing, DRY, UX, packages). **Scope note:** This MR is docs/scripts/deployments only (+922 / 23 files). No smart-contract, indexer, or frontend code changes — appropriate for Phase 5 ops hardening. Live contract/economic security of UST1/wrap is out of band except where this MR documents operator response. --- ## Verification performed | Check | Result | |-------|--------| | `make verify-issue-503` | PASS (7 gates) | | `VERIFY503_MAINNET=1 make verify-issue-503` | PASS (8 gates; health 12 PASS / 2 WARN / 0 FAIL) | | Secrets grep on registry pack | Clean (no mnemonics/keys) | | Pause JSON vs in-repo schemas | wrap-mapper `SetPaused` + treasury `SetWrappingPaused` match; ust1-window unverified upstream (doc caveat OK) | | Live LCD (columbus-5) | Oracle fresh, all pause flags false, wrap treasury/gov match registry, solvency OK; **vFDUSD bal≈48506 raw, allowance=0** (WARN) | --- ## #503 acceptance / verification checklist | Criterion | Status | Notes | |-----------|--------|-------| | Canonical Phase 2–4 registry (no secrets) | **DONE** | `deployments/mainnet-ust1-wrap/` | | Documented checks (oracle age, pauses, vFDUSD, solvency) | **DONE** | Runbook + `check-ust1-wrap-ops-health.sh` | | Pause playbooks + user FAQ | **DONE** (gap below) | Window / wrap-mapper / treasury; FAQ § UST1 + wrap pause | | Cross-links #502/#506/#507/#508 | **DONE** | | | `verify_oracle_operator_env` documented | **PARTIAL** | Points to ust1-window (correct); not run/evidenced here | | On-call ownership | **PARTIAL** | Roles named; people deferred to #503 (privacy OK) | | Oracle silence-alert evidence | **MISSING** | Operator — MR test plan unchecked | | Columbus-5 wrap pause drill | **MISSING** | Documented; not executed | | Coolify env matches example | **MISSING** | Operator post-merge | | Launch go/no-go wired | **PARTIAL** | Checklist in ops runbook; **not** linked from `launch-checklist.md` | **“Closes #503” is premature for full issue sign-off.** In-repo acceptance is close, but leave #503 open (or use a non-closing reference) until operator evidence is attached. Prefer `Refs #503` / issue comment for remaining gates, or keep Closes only if GitLab workflow intentionally closes and reopens — currently the description overclaims. --- ## Security audit ### No BLOCK findings - No secrets in git; Coolify example is public `VITE_*` only - Health script is read-only LCD (`set -euo pipefail`, jq-built messages, no eval); no DB strings - Agent skill `AGENTS_UST1_WRAP_PRODUCTION_OPS.md` prioritizes read-only probes / no secrets — low prompt-injection risk - O6 DEX vs wrap-stack governance split documented; `emergency-commands.md` scope guard is correct - Common DeFi/ops vectors partially mapped (key compromise, allowance grief, solvency, phishing migrate, UI vs chain pause) ### FIX before merge (doc correctness / ops safety) 1. **Missing oracle pause playbook (MEDIUM)** — O3 lists ust1-oracle pause as a primary control, but there is no execute JSON / signer preflight / upstream schema link. Under incident, operators may guess wrong msg or wrong key. 2. **Treasury privilege mislabel (MEDIUM)** — On-call row says treasury signs `set_paused` / `set_wrapping_paused`. Treasury uses **`set_wrapping_paused` only**; `set_paused` is window/wrap-mapper. Fix the table. 3. **Rate-limit ops depth (MEDIUM)** — #503 asks how to read wrap-mapper limits and when to raise caps. MR only distinguishes indexer 429 vs on-chain limits; add `rate_limit` query (+ raise-cap pointer or explicit deferral to ustr-cmm). 4. **O1–O8 vs O1–O7 drift (LOW)** — Runbook/skill define **O8**; `verify-issue-503.sh` / Makefile / commit framing still say **O1–O7** and only grep O1–O7. Align automation + docs. 5. **Bank LCD failure → balance `0` (LOW)** — empty bank response coerced to `0` can false-pass solvency if CW20 supply also fails to `0`. Treat empty bank as hard FAIL. 6. **`launch-checklist.md` cross-link (LOW)** — wire #503 go/no-go extras so launch gates are discoverable from the canonical checklist. ### Residual / out-of-MR (not merge blockers for docs, but launch blockers) - Live **vFDUSD allowance = 0** (balance far below warn) — UST1 withdraw capacity effectively blocked; refill before marketing. Consider `UST1_OPS_STRICT_INVENTORY=1` for launch gates (today WARN still exits 0). - Attack-vector table from #503 only partially operationalized (BSC RPC poisoning, mnemonic-in-logs rotation, mint-inflation narrative). - Cross-repo registry mirrors (ust1-window / ustr-cmm) still operator work. - No cron/Prometheus/webhook wiring for the health script (expected future hardening). ### Surfaces correctly N/A for this diff - Smart-contract design / gas opts / reentrancy / SC unit tests — no wasm changes - Indexer DB leaks / Rust API auth — untouched - Frontend E2E / Playwright — untouched (appropriate); LocalTerra wrap pause remains `make smoke-wrap-mapper-pause` - Tokenomic/oracle manipulation *protocol* fixes — ops response docs only; do not disable age checks (O2) is correct --- ## Gap analysis (non-security) | Area | Verdict | |------|---------| | Features vs operator expectations | Strong registry + probe + pause recipes; weak automated alerting / strict inventory / rate-limit playbook | | UI/UX FAQ | Good retail copy; UST1 ≠ faucet; 429 ≠ wrap rate limit | | Testing | Doc/grep gates + optional live LCD useful; no unit/mocked bad-path tests for health script | | Packages | Docs/scripts/deployments only — correct for #503 | | DRY / readability | Shared defaults lib is good; O7/O8 + fee_bps 100 vs live **200** doc drift elsewhere (`AGENTS_MAINNET_WRAP_ENABLEMENT` W4 / QA template) | | User-expected features | Cron examples, multi-LCD failover, Slack templates, strict launch inventory — missing (P2) | --- ## Required fixes for ACCEPT 1. Add **ust1-oracle pause/unpause** playbook section (or hard link to ust1-window schema) with governance preflight. 2. Correct treasury on-call row to **`set_wrapping_paused` only**. 3. Align **O8** in `verify-issue-503.sh` / Makefile comments (and AGENTS blurb if needed). 4. Soften GitLab autoclose language: do not claim full #503 closure until operator test-plan boxes are checked (pager + pause drill + Coolify). 5. (Recommended) Link ops go/no-go from `launch-checklist.md`; harden empty bank LCD to FAIL; add wrap `rate_limit` read example. After those doc/script nits, this is merge-ready for **in-repo** Phase 5 ops hardening. Not a security BLOCK.
PlasticDigits commented 2026-08-09 09:32:25 +00:00 (Migrated from gitlab.com)
Copy link

RECOMMEND: FIX

Follow-up review incorporating operator-supplied Coolify oracle-service env (no application log lines were attached in the review thread — env-only). This does not replace the prior FIX findings on MR docs (oracle pause playbook, treasury set_paused mislabel, O8 drift, premature full #503 close).

Coolify evidence scope

Surface Provided? Role
oracle-service Coolify env Yes Upstream ust1-window updater bot
oracle-service Coolify logs No (mentioned, not pasted) Needed for silence-alert / broadcast proof
Frontend Coolify VITE_* No Separate pack: deployments/mainnet-ust1-wrap/coolify.env.example

Do not conflate oracle-service env with the frontend registry pack.

Env audit vs registry / #503

Key Value (redacted) Verdict
ORACLE_CONTRACT terra1fmht0…gch8n PASS — matches REGISTRY.md
TERRA_CHAIN_ID columbus-5 PASS
TERRA_LCD_URL publicnode LCD PASS — matches health-script default
BSC_RPC_URLS 2× Binance dataseed PASS — multi-RPC (≥2) for poison/failover
BSC_ALLOWED_CHAIN_IDS 56 PASS — mainnet pin
VENUS_VTOKEN_ADDRESS Venus vFDUSD vToken PASS (canonical BSC address)
POLL_INTERVAL_SECS 3600 PASS — � vToken
POLL_INTERVAL_SECS 3600 PASS — ≪ silence window
ORACLE_MAX_SILENCE_SECS 21600 (6h) PASS for live service — matches on-chain max_oracle_age_sec=21600; conflicts with MR runbook / ust1-wrap-ops-defaults.sh (~28800 / 8h)
TERRA_MNEMONIC Coolify locked secret PASS pattern — never paste real mnemonic into issues/MR
RUST_LOG info OK if mnemonic never logged
HEALTHZ_BIND 0.0.0.0:8080 WARN — bind-all; restrict Coolify/network ingress; /healthz is process-up only, not freshness proof
TERRA_GAS_PRICE 28.325 OK optional

Security: No mnemonic material was exposed in the paste (Coolify lock placeholder only). Public RPC endpoints are fine to share. Residual risks: single Terra LCD, public BSC seeds (mitigated by multi-RPC + chain-id pin), healthz exposure if port is internet-reachable.

#503 acceptance update

Criterion Status after env paste
Oracle host configured correctly DONE (config checkpoint)
Oracle verified live (broadcasts advancing) PARTIAL — chain LCD today shows fresh last_update (~40m age, under 21600); still want Coolify startup/broadcast logs or verify_oracle_operator_env exit-0 transcript (no secrets)
Silence alert delivers to watched channel STILL MISSING — env sets threshold; does not prove pager/log-drain fired (LIVENESS_ORACLE_NO_BROADCAST or equivalent)
Frontend Coolify ↔ coolify.env.example STILL MISSING
Columbus-5 wrap pause drill STILL MISSING
vFDUSD inventory / allowance STILL WARN — allowance 0 (launch marketing blocker, not MR code)

Doc fix amplified by this env

MR text should stop advertising silence as ~8h / 28800 as the production default. Live Coolify + on-chain age policy are 21600. Align:

  • docs/runbooks/ust1-wrap-production-ops.md
  • scripts/lib/ust1-wrap-ops-defaults.sh (UST1_OPS_ORACLE_SILENCE_SECS)
  • skill blurb if it copies 8h

Otherwise the health probe under-warns relative to the service’s actual silence alert.

Prior FIX items (unchanged, still required)

  1. Oracle pause/unpause playbook (O3 control with no execute path)
  2. Treasury on-call row: set_wrapping_paused only (not set_paused)
  3. Align O8 in verify-issue-503.sh / Makefile
  4. Soften Closes #503 until operator gates (pager + pause drill + frontend Coolify) are checked
  5. Recommended: launch-checklist.md link; empty bank LCD → hard FAIL; wrap rate_limit read example

Verdict

Still FIX. Coolify oracle-service env is a solid config checkpoint and reduces uncertainty on address/RPC/chain pinning, but it does not complete #503 silence-alert verification and does not clear the MR doc correctness items. Please attach redacted Coolify logs (successful poll/broadcast + any silence-alert test) on #503, and fix the 21600 vs 28800 drift in this MR before merge.

RECOMMEND: FIX Follow-up review incorporating operator-supplied **Coolify oracle-service env** (no application log lines were attached in the review thread — env-only). This does **not** replace the prior FIX findings on MR docs (oracle pause playbook, treasury `set_paused` mislabel, O8 drift, premature full #503 close). --- ## Coolify evidence scope | Surface | Provided? | Role | |---------|-----------|------| | **oracle-service Coolify env** | Yes | Upstream ust1-window updater bot | | **oracle-service Coolify logs** | **No** (mentioned, not pasted) | Needed for silence-alert / broadcast proof | | **Frontend Coolify `VITE_*`** | No | Separate pack: `deployments/mainnet-ust1-wrap/coolify.env.example` | Do not conflate oracle-service env with the frontend registry pack. --- ## Env audit vs registry / #503 | Key | Value (redacted) | Verdict | |-----|------------------|---------| | `ORACLE_CONTRACT` | `terra1fmht0…gch8n` | **PASS** — matches `REGISTRY.md` | | `TERRA_CHAIN_ID` | `columbus-5` | **PASS** | | `TERRA_LCD_URL` | publicnode LCD | **PASS** — matches health-script default | | `BSC_RPC_URLS` | 2× Binance dataseed | **PASS** — multi-RPC (≥2) for poison/failover | | `BSC_ALLOWED_CHAIN_IDS` | `56` | **PASS** — mainnet pin | | `VENUS_VTOKEN_ADDRESS` | Venus vFDUSD vToken | **PASS** (canonical BSC address) | | `POLL_INTERVAL_SECS` | `3600` | **PASS** — � vToken | **PASS** (canonical BSC address) | | `POLL_INTERVAL_SECS` | `3600` | **PASS** — ≪ silence window | | `ORACLE_MAX_SILENCE_SECS` | **`21600` (6h)** | **PASS for live service** — matches on-chain `max_oracle_age_sec=21600`; **conflicts with MR runbook / `ust1-wrap-ops-defaults.sh` (~28800 / 8h)** | | `TERRA_MNEMONIC` | Coolify locked secret | **PASS pattern** — never paste real mnemonic into issues/MR | | `RUST_LOG` | `info` | **OK** if mnemonic never logged | | `HEALTHZ_BIND` | `0.0.0.0:8080` | **WARN** — bind-all; restrict Coolify/network ingress; `/healthz` is process-up only, not freshness proof | | `TERRA_GAS_PRICE` | `28.325` | **OK** optional | **Security:** No mnemonic material was exposed in the paste (Coolify lock placeholder only). Public RPC endpoints are fine to share. Residual risks: single Terra LCD, public BSC seeds (mitigated by multi-RPC + chain-id pin), healthz exposure if port is internet-reachable. --- ## #503 acceptance update | Criterion | Status after env paste | |-----------|------------------------| | Oracle host **configured** correctly | **DONE** (config checkpoint) | | Oracle **verified live** (broadcasts advancing) | **PARTIAL** — chain LCD today shows fresh `last_update` (~40m age, under 21600); still want Coolify startup/broadcast logs or `verify_oracle_operator_env` exit-0 transcript (no secrets) | | **Silence alert delivers** to watched channel | **STILL MISSING** — env sets threshold; does not prove pager/log-drain fired (`LIVENESS_ORACLE_NO_BROADCAST` or equivalent) | | Frontend Coolify ↔ `coolify.env.example` | **STILL MISSING** | | Columbus-5 wrap pause drill | **STILL MISSING** | | vFDUSD inventory / allowance | **STILL WARN** — allowance `0` (launch marketing blocker, not MR code) | --- ## Doc fix amplified by this env MR text should stop advertising silence as **~8h / 28800** as the production default. Live Coolify + on-chain age policy are **21600**. Align: - `docs/runbooks/ust1-wrap-production-ops.md` - `scripts/lib/ust1-wrap-ops-defaults.sh` (`UST1_OPS_ORACLE_SILENCE_SECS`) - skill blurb if it copies 8h Otherwise the health probe under-warns relative to the service’s actual silence alert. --- ## Prior FIX items (unchanged, still required) 1. Oracle **pause/unpause** playbook (O3 control with no execute path) 2. Treasury on-call row: **`set_wrapping_paused` only** (not `set_paused`) 3. Align **O8** in `verify-issue-503.sh` / Makefile 4. Soften **Closes #503** until operator gates (pager + pause drill + frontend Coolify) are checked 5. Recommended: `launch-checklist.md` link; empty bank LCD → hard FAIL; wrap `rate_limit` read example --- ## Verdict **Still FIX.** Coolify oracle-service env is a solid config checkpoint and reduces uncertainty on address/RPC/chain pinning, but it does **not** complete #503 silence-alert verification and does **not** clear the MR doc correctness items. Please attach redacted Coolify **logs** (successful poll/broadcast + any silence-alert test) on #503, and fix the 21600 vs 28800 drift in this MR before merge.
PlasticDigits commented 2026-08-09 09:32:31 +00:00 (Migrated from gitlab.com)
Copy link

Correction to the Coolify env table in the previous note: ignore the garbled POLL_INTERVAL_SECS / vToken row.

Correct rows:

  • VENUS_VTOKEN_ADDRESS — PASS (canonical BSC Venus vFDUSD vToken)
  • POLL_INTERVAL_SECS=3600 — PASS (≪ ORACLE_MAX_SILENCE_SECS=21600)

Verdict unchanged: RECOMMEND: FIX.

Correction to the Coolify env table in the previous note: ignore the garbled `POLL_INTERVAL_SECS` / vToken row. Correct rows: - `VENUS_VTOKEN_ADDRESS` — PASS (canonical BSC Venus vFDUSD vToken) - `POLL_INTERVAL_SECS=3600` — PASS (≪ `ORACLE_MAX_SILENCE_SECS=21600`) Verdict unchanged: **RECOMMEND: FIX**.
PlasticDigits commented 2026-08-09 09:34:14 +00:00 (Migrated from gitlab.com)
Copy link

added 1 commit

  • f8bc7506 - fix(#503): address MR 330 review — oracle pause, O8, silence 21600

Compare with previous version

added 1 commit <ul><li>f8bc7506 - fix(#503): address MR 330 review — oracle pause, O8, silence 21600</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/330/diffs?diff_id=1950816644&start_sha=25c48526d51d2a050da19a69088fb7192184e355)
PlasticDigits commented 2026-08-09 09:34:21 +00:00 (Migrated from gitlab.com)
Copy link

changed the description

changed the description
PlasticDigits commented 2026-08-09 09:34:23 +00:00 (Migrated from gitlab.com)
Copy link

Addressed prior RECOMMEND: FIX items in f8bc750:

  • Added A2 ust1-oracle set_paused playbook (governance preflight + upstream DEPLOYMENT link)
  • Treasury on-call / section C: set_wrapping_paused only (not set_paused)
  • Aligned O1–O8 in verify/Makefile/AGENTS; silence default 21600
  • Rate-limit read/raise playbook (§ D); health script probes rate_limit
  • Empty bank/supply LCD → hard FAIL; UST1_OPS_STRICT_INVENTORY=1 for launch gates
  • launch-checklist.md UST1/wrap go/no-go extras; fee_bps docs note live 200
  • MR description now Refs #503 (not full autoclose) until operator gates land

make verify-issue-503 + VERIFY503_MAINNET=1 PASS after changes.

Addressed prior **RECOMMEND: FIX** items in `f8bc750`: - Added **A2 ust1-oracle `set_paused`** playbook (governance preflight + upstream DEPLOYMENT link) - Treasury on-call / section C: **`set_wrapping_paused` only** (not `set_paused`) - Aligned **O1–O8** in verify/Makefile/AGENTS; silence default **21600** - Rate-limit read/raise playbook (§ D); health script probes `rate_limit` - Empty bank/supply LCD → hard FAIL; `UST1_OPS_STRICT_INVENTORY=1` for launch gates - `launch-checklist.md` UST1/wrap go/no-go extras; fee_bps docs note live **200** - MR description now **Refs #503** (not full autoclose) until operator gates land `make verify-issue-503` + `VERIFY503_MAINNET=1` PASS after changes.
PlasticDigits commented 2026-08-09 09:35:59 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in commit 19e12121ad

mentioned in commit 19e12121ad7aa3597b192070d88859920d13cb96
PlasticDigits (Migrated from gitlab.com) merged commit 19e12121ad into main 2026-08-09 09:35:59 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent:fix_bugfix

   
agent:fix_conflicts

   
agent:fix_security

   
agent:gap_analysis

   
agent:implement

   
agent:implement
Queue implement gate

  
agent:implement
Queue implement gate

  
agent:open_issues

   
agent:ready

   
agent:research

   
agent:security_audit

   
agent:verify

   
architecture
Architecture

  
backend
API and services

  
blocker:hybrid
Blocks hybrid launch

  
blocker:launch
Blocks launch

  
blocker:limit-orders
Blocks limits launch

  
blocker:v2
Blocks v2

  
block:log_only

   
block:security

   
bug

   
ci

   
contracts
Smart contracts

  
correctness

   
deploy

   
dev

   
devops

   
docs

   
documentation

   
duplicate

   
e2e

   
enhancement

   
epic
Epic

  
feature

   
frontend

   
functional-completion
Functional

  
gas

   
good first issue

   
governance

   
help wanted

   
high-risk

   
hooks

   
hybrid
Hybrid swaps

  
indexer
Indexer

  
infra
CI/CD

  
infrastructure

   
integrators

   
invalid

   
launch-blocker

   
limit-orders
Limit orders

  
localnet

   
localterra

   
low priority

   
missing-implementation
Implementation

  
needs-design
Design decision required

  
ops

   
performance
  
priority
high

  
priority
medium

  
product

   
qa

   
QA

   
question

   
ready
Definition of Ready

  
ready
Definition of Ready

  
research

   
scripts

   
security
Security

  
security-hardening
Security hardening

  
smartcontracts

   
tech-debt

   
testing
Testing

  
ux

   
UX

   
v2
Pool-only swaps

  
verification

   
wontfix
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:implement
agent:implement
agent:open_issues
agent:ready
agent:research
agent:security_audit
agent:verify
architecture
backend
blocker:hybrid
blocker:launch
blocker:limit-orders
blocker:v2
block:log_only
block:security
bug
ci
contracts
correctness
deploy
dev
devops
docs
documentation
duplicate
e2e
enhancement
epic
feature
frontend
functional-completion
gas
good first issue
governance
help wanted
high-risk
hooks
hybrid
indexer
infra
infrastructure
integrators
invalid
launch-blocker
limit-orders
localnet
localterra
low priority
missing-implementation
needs-design
ops
performance
priority
high
priority
medium
product
qa
QA
question
ready
ready
research
scripts
security
security-hardening
smartcontracts
tech-debt
testing
ux
UX
v2
verification
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
code/cl8y-dex-terraclassic!1048
No description provided.