Add launch go/no-go gate and sign-off to runbook (SEC-A06) (#391) #916

2026-06-19T01:40:46Z

PlasticDigits commented

2026-06-19 01:40:46 +00:00

(Migrated from gitlab.com)

Summary

Addresses GitLab #391 (SEC-A06): the pool-only launch runbook had no consolidated go/no-go section or mandatory sign-off before production mainnet deploy.

Adds Phase 5 — Go / no-go decision to docs/runbooks/launch-checklist.md with explicit BLOCK, PAUSE, GO, and GO with accepted risk criteria.
BLOCK criteria reference P0 categories: admin controls, value-flow invariants, deploy/runbook, user visibility of pause/blacklist/rate-limit risk.
GO with accepted risk requires all P0 items closed and residual risks documented on the launch tracking issue.
Adds a mandatory sign-off gate (final runbook step) embedding the QA_TEMPLATE.md § SIGN-OFF role table and requiring a launch-issue comment before mainnet Phase 1.
Adds make check-launch-go-no-go-docs / make verify-issue-391 regression and agent playbook skills/AGENTS_LAUNCH_GO_NO_GO.md.
Cross-links: deployment guide, security model, qa-onboarding, testing.md.

Acceptance checklist

Criterion	Verification	Result
`launch-checklist.md` has explicit go/no-go section with BLOCK, PAUSE, GO criteria	`grep 'Phase 5 — Go / no-go' docs/runbooks/launch-checklist.md`	PASS
BLOCK criteria reference P0 categories (admin, value-flow, runbook, user visibility)	`make check-launch-go-no-go-docs`	PASS
GO with accepted risk requires all P0 closed + residual risks documented	`make check-launch-go-no-go-docs`	PASS
Named signoff step is final required gate in launch runbook	Phase 5 follows Phase 4; `make check-launch-go-no-go-docs`	PASS
Signoff references QA_TEMPLATE.md SIGN-OFF table format	`grep QA_TEMPLATE.md docs/runbooks/launch-checklist.md`	PASS
Developer completes signoff before production deploy	Process gate documented in Phase 5; operational step is manual on launch issue	SKIP (process — not automatable in repo)

Verification checklist (third parties)

make verify-issue-391
make check-launch-go-no-go-docs

Manual review:

Open docs/runbooks/launch-checklist.md → confirm Phase 5 decision table and mandatory sign-off steps.
Confirm docs/deployment-guide.md and docs/security-model.md link to Phase 5.
Confirm skills/AGENTS_LAUNCH_GO_NO_GO.md describes the three decisions and regression commands.

Blockers

None.

## Summary Addresses GitLab #391 (SEC-A06): the pool-only launch runbook had no consolidated go/no-go section or mandatory sign-off before production mainnet deploy. - Adds **Phase 5 — Go / no-go decision** to `docs/runbooks/launch-checklist.md` with explicit **BLOCK**, **PAUSE**, **GO**, and **GO with accepted risk** criteria. - **BLOCK** criteria reference P0 categories: admin controls, value-flow invariants, deploy/runbook, user visibility of pause/blacklist/rate-limit risk. - **GO with accepted risk** requires all P0 items closed and residual risks documented on the launch tracking issue. - Adds a **mandatory sign-off gate** (final runbook step) embedding the [`QA_TEMPLATE.md` § SIGN-OFF](QA_TEMPLATE.md#sign-off) role table and requiring a launch-issue comment before mainnet Phase 1. - Adds `make check-launch-go-no-go-docs` / `make verify-issue-391` regression and agent playbook [`skills/AGENTS_LAUNCH_GO_NO_GO.md`](skills/AGENTS_LAUNCH_GO_NO_GO.md). - Cross-links: deployment guide, security model, qa-onboarding, testing.md. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | `launch-checklist.md` has explicit go/no-go section with BLOCK, PAUSE, GO criteria | `grep 'Phase 5 — Go / no-go' docs/runbooks/launch-checklist.md` | PASS | | BLOCK criteria reference P0 categories (admin, value-flow, runbook, user visibility) | `make check-launch-go-no-go-docs` | PASS | | GO with accepted risk requires all P0 closed + residual risks documented | `make check-launch-go-no-go-docs` | PASS | | Named signoff step is final required gate in launch runbook | Phase 5 follows Phase 4; `make check-launch-go-no-go-docs` | PASS | | Signoff references QA_TEMPLATE.md SIGN-OFF table format | `grep QA_TEMPLATE.md docs/runbooks/launch-checklist.md` | PASS | | Developer completes signoff before production deploy | Process gate documented in Phase 5; operational step is manual on launch issue | SKIP (process — not automatable in repo) | ## Verification checklist (third parties) ```bash make verify-issue-391 make check-launch-go-no-go-docs ``` Manual review: 1. Open `docs/runbooks/launch-checklist.md` → confirm Phase 5 decision table and mandatory sign-off steps. 2. Confirm `docs/deployment-guide.md` and `docs/security-model.md` link to Phase 5. 3. Confirm `skills/AGENTS_LAUNCH_GO_NO_GO.md` describes the three decisions and regression commands. ## Blockers None.

PlasticDigits commented

2026-06-19 01:42:24 +00:00

(Migrated from gitlab.com)

Security review — MR !916

Commit reviewed: 5b1ef3a0747fcf15e458fc5b8183ec38d504489b
Scope: Documentation and QA regression only — docs/runbooks/launch-checklist.md Phase 5 go/no-go gate, cross-links in deployment/security/QA docs, scripts/check_launch_go_no_go_docs.py, scripts/qa/verify-issue-391.sh, skills/AGENTS_LAUNCH_GO_NO_GO.md, Makefile lint/verify-issue-391 targets.

Method: Full MR diff review; traced attacker-controlled input to sinks in new/changed scripts; checked for injection, authz, secret leakage, SSRF/XSS, supply-chain, and on-chain/off-chain boundary changes. No prior security-review threads on this MR.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Inline threads: none (no findings to anchor).

Notes:

Changed files are process/runbook documentation and static doc-invariant checks (string presence in fixed repo paths). No CosmWasm, indexer API, frontend runtime, deploy scripts, or dependency changes.
check_launch_go_no_go_docs.py reads only hardcoded paths derived from __file__; no external or CLI input, no subprocess/eval/network.
verify-issue-391.sh runs fixed make/grep/test steps with set -euo pipefail and quoted expansion; no user-controlled arguments.
Adding the doc check to make lint is a process guardrail, not an enforcement bypass for human sign-off (runbook still requires manual launch-issue sign-off before mainnet).

## Security review — MR !916 **Commit reviewed:** `5b1ef3a0747fcf15e458fc5b8183ec38d504489b` **Scope:** Documentation and QA regression only — `docs/runbooks/launch-checklist.md` Phase 5 go/no-go gate, cross-links in deployment/security/QA docs, `scripts/check_launch_go_no_go_docs.py`, `scripts/qa/verify-issue-391.sh`, `skills/AGENTS_LAUNCH_GO_NO_GO.md`, Makefile `lint`/`verify-issue-391` targets. **Method:** Full MR diff review; traced attacker-controlled input to sinks in new/changed scripts; checked for injection, authz, secret leakage, SSRF/XSS, supply-chain, and on-chain/off-chain boundary changes. No prior security-review threads on this MR. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. **Inline threads:** none (no findings to anchor). **Notes:** - Changed files are process/runbook documentation and static doc-invariant checks (string presence in fixed repo paths). No CosmWasm, indexer API, frontend runtime, deploy scripts, or dependency changes. - `check_launch_go_no_go_docs.py` reads only hardcoded paths derived from `__file__`; no external or CLI input, no subprocess/eval/network. - `verify-issue-391.sh` runs fixed `make`/`grep`/`test` steps with `set -euo pipefail` and quoted expansion; no user-controlled arguments. - Adding the doc check to `make lint` is a process guardrail, not an enforcement bypass for human sign-off (runbook still requires manual launch-issue sign-off before mainnet).

PlasticDigits commented

2026-06-19 01:53:04 +00:00

(Migrated from gitlab.com)

mentioned in commit 9c9b10e87f

mentioned in commit 9c9b10e87f3a255f6685ca2f105698d75b23e34d