docs(test): verify #297 limit ladder crossing guard #767

2026-06-05T04:40:57Z

PlasticDigits commented

2026-06-05 04:40:57 +00:00

(Migrated from gitlab.com)

Summary

Verification pass for GitLab #297 (limit ladder crossing-order validation). The frontend fix landed in MR !757; this MR adds:

Docs / skill cross-links — document invariant #13 (ladder post-only crossing guard) in skills/AGENTS_LIMIT_ORDER_BATCH_LADDER.md, docs/limit-orders.md, and docs/frontend.md.
Regression tests — LimitOrderLadderPanel.crossing.test.tsx reproduces the reported BID/ASK ladder scenarios with mocked best bid/ask.

No changes to LimitOrderLadderPanel.tsx itself (fix already on main).

Verification checklist (acceptance → command/output)

Acceptance item	Result	How verified
`LimitOrderLadderPanel` imports `describeLimitCrossingBlocker`, `bestBid`, `bestAsk`	PASS	`rg` on `LimitOrderLadderPanel.tsx` — 8 matches
Each rung checked against book head; crossing rungs blocked	PASS	Code read `ladderCrossingGate` memo + `mutationFn` loop
Inline warning: "X of Y rungs will cross the market…"	PASS	Vitest `LimitOrderLadderPanel.crossing.test.tsx`
Submit disabled when any rung crosses	PASS	Vitest: bid 2→10 and ask 0.1→0.5
Non-crossing ladder (0.95→1.05) still submittable	PASS	Vitest: submit enabled, no guard
Same guard semantics as `TradeOrderTicket` (#152)	PASS	Both use `describeLimitCrossingBlocker`
`limitOrderNonCrossing` unit tests	PASS	`npm test -- limitOrderNonCrossing` — 4/4
TypeScript build	PASS	`npx tsc -b` — clean
Docs / skill invariants cross-linked (#297)	PASS	This MR
Manual browser on LocalTerra (CORAL/EMBER)	FAIL	`deploy-dex-local.sh` aborts: `Pair creation requires 100000000 uluna attached`
On-chain ladder E2E	SKIP	Blocked by deploy failure

Follow-ups

Investigate deploy script / factory pair-creation fee attachment so LocalTerra QA deploy succeeds on fresh volumes.
Optional Playwright crossing-guard case once deploy is green.

Related: #297, MR !757 (original fix).

## Summary Verification pass for GitLab **#297** (limit ladder crossing-order validation). The frontend fix landed in MR !757; this MR adds: - **Docs / skill cross-links** — document invariant #13 (ladder post-only crossing guard) in `skills/AGENTS_LIMIT_ORDER_BATCH_LADDER.md`, `docs/limit-orders.md`, and `docs/frontend.md`. - **Regression tests** — `LimitOrderLadderPanel.crossing.test.tsx` reproduces the reported BID/ASK ladder scenarios with mocked best bid/ask. No changes to `LimitOrderLadderPanel.tsx` itself (fix already on `main`). ## Verification checklist (acceptance → command/output) | Acceptance item | Result | How verified | |-----------------|--------|--------------| | `LimitOrderLadderPanel` imports `describeLimitCrossingBlocker`, `bestBid`, `bestAsk` | **PASS** | `rg` on `LimitOrderLadderPanel.tsx` — 8 matches | | Each rung checked against book head; crossing rungs blocked | **PASS** | Code read `ladderCrossingGate` memo + `mutationFn` loop | | Inline warning: "X of Y rungs will cross the market…" | **PASS** | Vitest `LimitOrderLadderPanel.crossing.test.tsx` | | Submit disabled when any rung crosses | **PASS** | Vitest: bid 2→10 and ask 0.1→0.5 | | Non-crossing ladder (0.95→1.05) still submittable | **PASS** | Vitest: submit enabled, no guard | | Same guard semantics as `TradeOrderTicket` (#152) | **PASS** | Both use `describeLimitCrossingBlocker` | | `limitOrderNonCrossing` unit tests | **PASS** | `npm test -- limitOrderNonCrossing` — 4/4 | | TypeScript build | **PASS** | `npx tsc -b` — clean | | Docs / skill invariants cross-linked (#297) | **PASS** | This MR | | Manual browser on LocalTerra (CORAL/EMBER) | **FAIL** | `deploy-dex-local.sh` aborts: `Pair creation requires 100000000 uluna attached` | | On-chain ladder E2E | **SKIP** | Blocked by deploy failure | ## Follow-ups - Investigate deploy script / factory pair-creation fee attachment so LocalTerra QA deploy succeeds on fresh volumes. - Optional Playwright crossing-guard case once deploy is green. Related: #297, MR !757 (original fix).

PlasticDigits commented

2026-06-05 04:41:14 +00:00

(Migrated from gitlab.com)

mentioned in issue #297

PlasticDigits commented

2026-06-05 04:41:22 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-05 04:42:47 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: 25f8b8faa7cfaf9644639e6070a429a5ca019859

Scope: 4 files — docs/frontend.md, docs/limit-orders.md, skills/AGENTS_LIMIT_ORDER_BATCH_LADDER.md (documentation cross-links for invariant #13), and new Vitest file frontend-dapp/src/components/trade/__tests__/LimitOrderLadderPanel.crossing.test.tsx. No changes to production/runtime code (LimitOrderLadderPanel.tsx unchanged).

Method: Reviewed the full MR diff for injection, authn/authz bypass, permission-boundary mistakes, secret leakage, SSRF/XSS, unsafe deserialization, and dependency/supply-chain changes. For the new test file, traced inputs through mocked hooks (useTradeBestBookPrices, useLimitLadderPlaceGates, etc.); mocks are test-only and do not ship. Docs describe existing client-only crossing-guard semantics already on main (MR !757); no new attack surface introduced.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Inline threads: None (no findings to anchor).

## Security review **Commit reviewed:** `25f8b8faa7cfaf9644639e6070a429a5ca019859` **Scope:** 4 files — `docs/frontend.md`, `docs/limit-orders.md`, `skills/AGENTS_LIMIT_ORDER_BATCH_LADDER.md` (documentation cross-links for invariant #13), and new Vitest file `frontend-dapp/src/components/trade/__tests__/LimitOrderLadderPanel.crossing.test.tsx`. No changes to production/runtime code (`LimitOrderLadderPanel.tsx` unchanged). **Method:** Reviewed the full MR diff for injection, authn/authz bypass, permission-boundary mistakes, secret leakage, SSRF/XSS, unsafe deserialization, and dependency/supply-chain changes. For the new test file, traced inputs through mocked hooks (`useTradeBestBookPrices`, `useLimitLadderPlaceGates`, etc.); mocks are test-only and do not ship. Docs describe existing client-only crossing-guard semantics already on `main` (MR !757); no new attack surface introduced. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. **Inline threads:** None (no findings to anchor).

PlasticDigits commented

2026-06-05 04:56:37 +00:00

(Migrated from gitlab.com)

mentioned in commit f9bf77b7cd

mentioned in commit f9bf77b7cd6ada2d63da43b1ab2b06dd0f3cb7f0