verify(#292): SDK53 wiremock guardrails + verification report #821

2026-06-05T16:04:16Z

PlasticDigits commented

2026-06-05 16:04:16 +00:00

(Migrated from gitlab.com)

Summary

Verification run for GitLab #292 (LocalTerra SDK 53 / terrad v4).

Guardrail fixes in this MR:

Align indexer/tests/indexer_ingestion_hardening.rs wiremock tx-search matchers with terrad v4 (query + page + limit; was legacy events= / pagination.offset).
Document LT10 in docs/localterra-sdk53.md and Cloud Agent make test-e2e-tx prerequisites in skills/AGENTS_E2E_STRICT_CHAIN.md.

Issue stays open until strict E2E is fully green on CI/QA hardware (see checklist below).

Acceptance criteria → verification

Criterion	Result	How verified
1. Fresh stack: `make reset && make start && make wait-healthy && make deploy-local` on new digest	PASS	`docker pull ghcr.io/plasticdigits/localterra-cl8y:latest` → digest `sha256:29e2d125…2faf` matches `docker-compose.yml`; `terrad version` 4.0.1 / SDK 0.53.6; `make reset && make start && make wait-healthy`; `make build-optimized && make deploy-local-no-build` (336s, 20 pairs + seed swaps)
2. `make test` (contracts + frontend unit)	PASS	`cargo test` in `smartcontracts/`: 414 passed; `make test-frontend`: 851 passed (Node 24)
3. Strict on-chain E2E `make test-e2e` / `test-e2e-tx`	FAIL (partial)	`CI=1 sg docker -c 'npm run test:e2e:tx'`: 28 passed, 5 failed, 4 did not run (~1.1h). Core swap/hybrid/limit-place paths passed; failures: fee-discount swap quote (#245), limit claim-all (#259 indexer `limit-placements` 404), limit cancel indexed id, pool provide liquidity UI timeout, wrap-pool E7 (indexer did not list LUNC-C within 180s during global setup)
4. `make test-qa-verify-deploy`	PASS	`make test-qa-verify-deploy` + `make qa-verify-deploy` (stamp `9d7331c`)
Indexer `cargo test --tests`	PASS (after wiremock fix)	All integration binaries green; `indexer_ingestion_hardening` was failing on stale mocks before this MR
`make verify-issue-238` (v4 wasm events / hybrid parity)	PASS	7/7 after installing `bc` on VM
Indexer live sync + API	PASS	Indexer synced past deploy height; `GET /api/v1/pairs` returns 20+ pairs

Failed E2E detail (follow-up for implementers)

fee-discount-quote-245 — Swap page trader quote vs router sim
limit-orders-claim-all-tx — limit-placements 404 / parked_expired poll timeout
limit-orders-tx — last-placed-order-id not visible (indexer placement poll)
pool-tx — cannot expand “Provide Liquidity” on factory pool card (120s timeout)
wrap-pool E7 — no native auto-wrap pool card (indexer LUNC-C listing)

Commands (repro)

docker pull ghcr.io/plasticdigits/localterra-cl8y:latest
make reset && make start && make wait-healthy
make build-optimized && make deploy-local-no-build
make test-contracts && make test-frontend
make test-qa-verify-deploy && make qa-verify-deploy
cd indexer && cargo test --tests -j 1 -- --test-threads=1
# E2E (needs docker group + playwright browsers + indexer up):
sg docker -c 'CI=1 make test-e2e-tx'

Branch: cursor/gitlab-issue-verification-e1d2 @ 805a670

Note

Low Risk
Test and documentation-only changes; no production indexer or runtime behavior is modified.

Overview
Updates indexer ingestion hardening integration wiremocks so mocked LCD tx search matches terrad v4 / SDK 0.53 GetTxsEvent: requests use query, page, and limit instead of legacy events= and pagination.offset, and paginated responses use top-level total instead of pagination.total.

Adds LT10 to docs/localterra-sdk53.md documenting that invariant for agents and QA.

Extends skills/AGENTS_E2E_STRICT_CHAIN.md with Cloud Agent VM notes for strict E2E: run under sg docker, one-time Playwright Chromium install, CI=1 to avoid a hanging HTML report, and 1 worker for the tx project.

^{Reviewed by Cursor Bugbot for commit 805a6704b8. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Verification run for [GitLab #292](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/292) (LocalTerra SDK 53 / terrad v4). **Guardrail fixes in this MR:** - Align `indexer/tests/indexer_ingestion_hardening.rs` wiremock tx-search matchers with terrad v4 (`query` + `page` + `limit`; was legacy `events=` / `pagination.offset`). - Document **LT10** in `docs/localterra-sdk53.md` and Cloud Agent `make test-e2e-tx` prerequisites in `skills/AGENTS_E2E_STRICT_CHAIN.md`. **Issue stays open** until strict E2E is fully green on CI/QA hardware (see checklist below). ## Acceptance criteria → verification | Criterion | Result | How verified | |-----------|--------|----------------| | **1.** Fresh stack: `make reset && make start && make wait-healthy && make deploy-local` on new digest | **PASS** | `docker pull ghcr.io/plasticdigits/localterra-cl8y:latest` → digest `sha256:29e2d125…2faf` matches `docker-compose.yml`; `terrad version` **4.0.1** / SDK **0.53.6**; `make reset && make start && make wait-healthy`; `make build-optimized && make deploy-local-no-build` (336s, 20 pairs + seed swaps) | | **2.** `make test` (contracts + frontend unit) | **PASS** | `cargo test` in `smartcontracts/`: **414** passed; `make test-frontend`: **851** passed (Node 24) | | **3.** Strict on-chain E2E `make test-e2e` / `test-e2e-tx` | **FAIL** (partial) | `CI=1 sg docker -c 'npm run test:e2e:tx'`: **28 passed**, **5 failed**, **4 did not run** (~1.1h). Core swap/hybrid/limit-place paths passed; failures: fee-discount swap quote (#245), limit claim-all (#259 indexer `limit-placements` 404), limit cancel indexed id, pool provide liquidity UI timeout, wrap-pool E7 (indexer did not list LUNC-C within 180s during global setup) | | **4.** `make test-qa-verify-deploy` | **PASS** | `make test-qa-verify-deploy` + `make qa-verify-deploy` (stamp `9d7331c`) | | Indexer `cargo test --tests` | **PASS** (after wiremock fix) | All integration binaries green; `indexer_ingestion_hardening` was failing on stale mocks before this MR | | `make verify-issue-238` (v4 wasm events / hybrid parity) | **PASS** | 7/7 after installing `bc` on VM | | Indexer live sync + API | **PASS** | Indexer synced past deploy height; `GET /api/v1/pairs` returns 20+ pairs | ## Failed E2E detail (follow-up for implementers) 1. `fee-discount-quote-245` — Swap page trader quote vs router sim 2. `limit-orders-claim-all-tx` — `limit-placements` 404 / parked_expired poll timeout 3. `limit-orders-tx` — `last-placed-order-id` not visible (indexer placement poll) 4. `pool-tx` — cannot expand “Provide Liquidity” on factory pool card (120s timeout) 5. `wrap-pool` E7 — no native auto-wrap pool card (indexer LUNC-C listing) ## Commands (repro) ```bash docker pull ghcr.io/plasticdigits/localterra-cl8y:latest make reset && make start && make wait-healthy make build-optimized && make deploy-local-no-build make test-contracts && make test-frontend make test-qa-verify-deploy && make qa-verify-deploy cd indexer && cargo test --tests -j 1 -- --test-threads=1 # E2E (needs docker group + playwright browsers + indexer up): sg docker -c 'CI=1 make test-e2e-tx' ``` Branch: `cursor/gitlab-issue-verification-e1d2` @ `805a670`  --- > [!NOTE] > **Low Risk** > Test and documentation-only changes; no production indexer or runtime behavior is modified. > > **Overview** > Updates **indexer ingestion hardening** integration wiremocks so mocked LCD tx search matches **terrad v4 / SDK 0.53** `GetTxsEvent`: requests use **`query`**, **`page`**, and **`limit`** instead of legacy **`events=`** and **`pagination.offset`**, and paginated responses use top-level **`total`** instead of **`pagination.total`**. > > Adds **LT10** to `docs/localterra-sdk53.md` documenting that invariant for agents and QA. > > Extends **`skills/AGENTS_E2E_STRICT_CHAIN.md`** with **Cloud Agent VM** notes for strict E2E: run under **`sg docker`**, one-time Playwright Chromium install, **`CI=1`** to avoid a hanging HTML report, and **1 worker** for the tx project. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 805a6704b8d73c1a292a0cabb97b608a893d2b2e. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-05 16:04:23 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-05 16:04:29 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-05 16:05:15 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: 805a6704b8d73c1a292a0cabb97b608a893d2b2e
Scope: 3 files — indexer/tests/indexer_ingestion_hardening.rs (wiremock tx-search matchers), docs/localterra-sdk53.md (LT10 doc), skills/AGENTS_E2E_STRICT_CHAIN.md (Cloud Agent E2E notes)

Outcome: FINDINGS: 0 medium+

Summary

This MR is test-and-documentation only. No production indexer, API, frontend, or contract runtime code is modified.

Area	Assessment
Injection / SSRF / XSS	Not applicable — no new network sinks, user input handlers, or rendered output.
Authn / authz	No changes to authentication or authorization paths.
Secrets / logging	No credentials, tokens, or sensitive data added.
Supply chain	No dependency changes.
On-chain / dapp	No wasm, router, or wallet interaction changes.

Code paths reviewed

Test wiremock alignment: mount_block_txs_json and multi_page_block_txs_ingested_count_matches_lcd_total now mock terrad v4 GetTxsEvent (query + page + limit, top-level total). This mirrors existing production behavior in indexer/src/lcd/mod.rs (search_txs / get_block_txs). Test height values are fixture-controlled i64 literals — not attacker-controlled input.
Docs: LT10 documents the wiremock invariant; Cloud Agent E2E notes cover sg docker, Playwright install, CI=1, and 1-worker tx project — operational guidance only.

Prior review threads

No prior security-review comments on this MR; nothing to re-report.

Inline threads: none (no medium+ findings).

## Security review **Commit reviewed:** `805a6704b8d73c1a292a0cabb97b608a893d2b2e` **Scope:** 3 files — `indexer/tests/indexer_ingestion_hardening.rs` (wiremock tx-search matchers), `docs/localterra-sdk53.md` (LT10 doc), `skills/AGENTS_E2E_STRICT_CHAIN.md` (Cloud Agent E2E notes) **Outcome:** `FINDINGS: 0` medium+ ### Summary This MR is test-and-documentation only. No production indexer, API, frontend, or contract runtime code is modified. | Area | Assessment | |------|------------| | **Injection / SSRF / XSS** | Not applicable — no new network sinks, user input handlers, or rendered output. | | **Authn / authz** | No changes to authentication or authorization paths. | | **Secrets / logging** | No credentials, tokens, or sensitive data added. | | **Supply chain** | No dependency changes. | | **On-chain / dapp** | No wasm, router, or wallet interaction changes. | ### Code paths reviewed - **Test wiremock alignment:** `mount_block_txs_json` and `multi_page_block_txs_ingested_count_matches_lcd_total` now mock terrad v4 `GetTxsEvent` (`query` + `page` + `limit`, top-level `total`). This mirrors existing production behavior in `indexer/src/lcd/mod.rs` (`search_txs` / `get_block_txs`). Test `height` values are fixture-controlled `i64` literals — not attacker-controlled input. - **Docs:** LT10 documents the wiremock invariant; Cloud Agent E2E notes cover `sg docker`, Playwright install, `CI=1`, and 1-worker tx project — operational guidance only. ### Prior review threads No prior security-review comments on this MR; nothing to re-report. **Inline threads:** none (no medium+ findings).