Add emergency pause/blacklist command cookbook (SEC-B11, #399) #928

Merged
PlasticDigits merged 4 commits from issue-399-emergency-commands into main 2026-06-19 14:15:54 +00:00
PlasticDigits commented 2026-06-19 11:10:51 +00:00 (Migrated from gitlab.com)

Summary

Adds operator-facing emergency command cookbook for factory pause and trading blacklist controls (#399, SEC-B11).

  • docs/runbooks/emergency-commands.md — parameterized terrad tx wasm execute recipes for all eight operations (pause/unpause pair; blacklist/unblacklist wallet, token, pair) with required flags and post-tx confirmation queries
  • scripts/qa/verify-issue-399.sh — LocalTerra rehearsal exercising all eight ops + queries (linked from cookbook)
  • scripts/check_emergency_commands_docs.py + make check-emergency-commands-docs — doc invariant wired into make lint
  • Cross-links from incident triage template Mitigation step, security model, ADR 0003
  • Agent playbook: skills/AGENTS_EMERGENCY_COMMANDS.md

Acceptance checklist

Criterion Verification Result
docs/runbooks/emergency-commands.md exists with parameterized commands make check-emergency-commands-docs PASS
All eight operations covered Doc check + cookbook sections 1–8 PASS
Commands include required flags and post-execution confirm queries Doc check markers + cookbook content PASS
LocalTerra rehearsal evidence linked Cookbook § LocalTerra rehearsal; make verify-issue-399 (8/8 PASS on deploy) PASS
Referenced from incident template Mitigation step Doc check + docs/templates/incident-dex-indexer.md PASS

Verification checklist (third parties)

# Doc invariant (no chain)
make check-emergency-commands-docs

# LocalTerra rehearsal (after make deploy-local)
make has-localterra && make verify-issue-399

Manual: open docs/runbooks/emergency-commands.md and confirm each section is copy-pastable after filling $FACTORY_ADDR, $PAIR_ADDR, etc.

Blockers

None.

## Summary Adds operator-facing emergency command cookbook for factory pause and trading blacklist controls ([#399](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/399), SEC-B11). - **`docs/runbooks/emergency-commands.md`** — parameterized `terrad tx wasm execute` recipes for all eight operations (pause/unpause pair; blacklist/unblacklist wallet, token, pair) with required flags and post-tx confirmation queries - **`scripts/qa/verify-issue-399.sh`** — LocalTerra rehearsal exercising all eight ops + queries (linked from cookbook) - **`scripts/check_emergency_commands_docs.py`** + `make check-emergency-commands-docs` — doc invariant wired into `make lint` - Cross-links from incident triage template Mitigation step, security model, ADR 0003 - Agent playbook: `skills/AGENTS_EMERGENCY_COMMANDS.md` ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | `docs/runbooks/emergency-commands.md` exists with parameterized commands | `make check-emergency-commands-docs` | PASS | | All eight operations covered | Doc check + cookbook sections 1–8 | PASS | | Commands include required flags and post-execution confirm queries | Doc check markers + cookbook content | PASS | | LocalTerra rehearsal evidence linked | Cookbook § LocalTerra rehearsal; `make verify-issue-399` (8/8 PASS on deploy) | PASS | | Referenced from incident template Mitigation step | Doc check + `docs/templates/incident-dex-indexer.md` | PASS | ## Verification checklist (third parties) ```bash # Doc invariant (no chain) make check-emergency-commands-docs # LocalTerra rehearsal (after make deploy-local) make has-localterra && make verify-issue-399 ``` Manual: open `docs/runbooks/emergency-commands.md` and confirm each section is copy-pastable after filling `$FACTORY_ADDR`, `$PAIR_ADDR`, etc. ## Blockers None.
PlasticDigits commented 2026-06-19 11:13:52 +00:00 (Migrated from gitlab.com)

Security review — MR !928

Commit reviewed: 09c12d728b0270960b52db1c3b0c289b24e6d7f3
Scope: Emergency pause/blacklist operator cookbook (SEC-B11, #399) — docs/runbooks/emergency-commands.md, scripts/qa/verify-issue-399.sh, scripts/check_emergency_commands_docs.py, cross-links, Makefile targets.

Method: Diff review; traced operator/env inputs to sinks (shell/jq/terrad, LCD smart queries, docker exec); compared rehearsal script to existing QA patterns; checked prior MR discussions (none).

Outcome: FINDINGS: 0 medium+ — NONE

Reviewed paths

Area Assessment
On-chain execute recipes Governance-gated factory messages only; jq --arg used for all tx payloads (no shell interpolation into JSON).
Confirm queries (cookbook) --argjson tokens "[\"$TOKEN_ADDR\"]" is brittle if env is malformed, but Terra bech32 addresses cannot contain JSON metacharacters; no external attacker-controlled input path.
verify-issue-399.sh LocalTerra-only; uses jq --arg throughout; addresses from chain query validated (^terra1); docker exec with quoted vars; restores state after rehearsal.
check_emergency_commands_docs.py Static marker/link checks only.
Secrets / SSRF / injection No credentials committed; LCD URL sourced from deploy .env (same pattern as existing QA libs); no new network-facing surface.

No block:security label applied.

Inline threads: none (no medium+ findings).

## Security review — MR !928 **Commit reviewed:** `09c12d728b0270960b52db1c3b0c289b24e6d7f3` **Scope:** Emergency pause/blacklist operator cookbook (SEC-B11, #399) — `docs/runbooks/emergency-commands.md`, `scripts/qa/verify-issue-399.sh`, `scripts/check_emergency_commands_docs.py`, cross-links, Makefile targets. **Method:** Diff review; traced operator/env inputs to sinks (shell/jq/terrad, LCD smart queries, docker exec); compared rehearsal script to existing QA patterns; checked prior MR discussions (none). **Outcome:** `FINDINGS: 0` medium+ — **NONE** ### Reviewed paths | Area | Assessment | |------|------------| | On-chain execute recipes | Governance-gated factory messages only; `jq --arg` used for all tx payloads (no shell interpolation into JSON). | | Confirm queries (cookbook) | `--argjson tokens "[\"$TOKEN_ADDR\"]"` is brittle if env is malformed, but Terra bech32 addresses cannot contain JSON metacharacters; no external attacker-controlled input path. | | `verify-issue-399.sh` | LocalTerra-only; uses `jq --arg` throughout; addresses from chain query validated (`^terra1`); docker exec with quoted vars; restores state after rehearsal. | | `check_emergency_commands_docs.py` | Static marker/link checks only. | | Secrets / SSRF / injection | No credentials committed; LCD URL sourced from deploy `.env` (same pattern as existing QA libs); no new network-facing surface. | No `block:security` label applied. **Inline threads:** none (no medium+ findings).
PlasticDigits commented 2026-06-19 12:49:42 +00:00 (Migrated from gitlab.com)

added 7 commits

  • 09c12d72...d487a0cd - 6 commits from branch main
  • 4d53efe7 - Merge origin/main into issue-399-emergency-commands.

Compare with previous version

added 7 commits <ul><li>09c12d72...d487a0cd - 6 commits from branch <code>main</code></li><li>4d53efe7 - Merge origin/main into issue-399-emergency-commands.</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/210/diffs?diff_id=1861160886&start_sha=09c12d728b0270960b52db1c3b0c289b24e6d7f3)
PlasticDigits commented 2026-06-19 12:49:45 +00:00 (Migrated from gitlab.com)

Resolved merge conflicts with main (merged origin/main into issue-399-emergency-commands).

Conflicts resolved:

  • Makefile — kept both SEC-B11 (check-emergency-commands-docs, verify-issue-399) and SEC-B12 (check-blacklist-decision-docs, verify-issue-400) targets in .PHONY, lint, and help.
  • docs/templates/incident-dex-indexer.md — Mitigation section now links both the emergency-commands cookbook (#399) and the blacklist-decision runbook (#400).

Sanity checks: make check-emergency-commands-docs and make check-blacklist-decision-docs both pass.

Resolved merge conflicts with `main` (merged `origin/main` into `issue-399-emergency-commands`). **Conflicts resolved:** - `Makefile` — kept both SEC-B11 (`check-emergency-commands-docs`, `verify-issue-399`) and SEC-B12 (`check-blacklist-decision-docs`, `verify-issue-400`) targets in `.PHONY`, `lint`, and help. - `docs/templates/incident-dex-indexer.md` — Mitigation section now links both the emergency-commands cookbook (#399) and the blacklist-decision runbook (#400). **Sanity checks:** `make check-emergency-commands-docs` and `make check-blacklist-decision-docs` both pass.
PlasticDigits commented 2026-06-19 12:51:43 +00:00 (Migrated from gitlab.com)

Security review — MR !928 (re-review)

Commit reviewed: 4d53efe711eaf9eeeebda2f22fab1c5b7941574e
Scope: Emergency pause/blacklist operator cookbook (SEC-B11, #399) — docs/runbooks/emergency-commands.md, scripts/qa/verify-issue-399.sh, scripts/check_emergency_commands_docs.py, cross-links, Makefile targets. Re-reviewed after merge-conflict resolution with main (head SHA updated from prior run at 09c12d72).

Method: Full MR diff vs merge base d487a0cd; traced operator/env inputs to sinks (shell/jq/terrad, LCD smart queries, docker exec); compared rehearsal script to existing QA lib patterns (lcd-smart-query.sh, localterra-host-curl.sh); re-checked prior MR security note (2026-06-19).

Outcome: FINDINGS: 0 medium+ — NONE

Reviewed paths

Area Assessment
On-chain execute recipes Governance-gated factory messages only; all tx payloads built with jq --arg (no shell interpolation into JSON).
Confirm queries (cookbook) --argjson tokens "[\"$TOKEN_ADDR\"]" is brittle if env is malformed, but Terra bech32 addresses cannot contain JSON metacharacters; no external attacker-controlled input path.
verify-issue-399.sh LocalTerra-only; jq --arg throughout; pair/token addresses from chain query validated (^terra1); docker exec with quoted vars; restores state after rehearsal.
check_emergency_commands_docs.py Static marker/link checks only; no runtime input.
Secrets / SSRF / injection No credentials committed; LCD URL from deploy .env matches existing QA pattern; no new network-facing or auth surface.

No block:security label applied.

Inline threads: none (no medium+ findings).

## Security review — MR !928 (re-review) **Commit reviewed:** `4d53efe711eaf9eeeebda2f22fab1c5b7941574e` **Scope:** Emergency pause/blacklist operator cookbook (SEC-B11, #399) — `docs/runbooks/emergency-commands.md`, `scripts/qa/verify-issue-399.sh`, `scripts/check_emergency_commands_docs.py`, cross-links, Makefile targets. Re-reviewed after merge-conflict resolution with `main` (head SHA updated from prior run at `09c12d72`). **Method:** Full MR diff vs merge base `d487a0cd`; traced operator/env inputs to sinks (shell/jq/terrad, LCD smart queries, docker exec); compared rehearsal script to existing QA lib patterns (`lcd-smart-query.sh`, `localterra-host-curl.sh`); re-checked prior MR security note (2026-06-19). **Outcome:** `FINDINGS: 0` medium+ — **NONE** ### Reviewed paths | Area | Assessment | |------|------------| | On-chain execute recipes | Governance-gated factory messages only; all tx payloads built with `jq --arg` (no shell interpolation into JSON). | | Confirm queries (cookbook) | `--argjson tokens "[\"$TOKEN_ADDR\"]"` is brittle if env is malformed, but Terra bech32 addresses cannot contain JSON metacharacters; no external attacker-controlled input path. | | `verify-issue-399.sh` | LocalTerra-only; `jq --arg` throughout; pair/token addresses from chain query validated (`^terra1`); docker exec with quoted vars; restores state after rehearsal. | | `check_emergency_commands_docs.py` | Static marker/link checks only; no runtime input. | | Secrets / SSRF / injection | No credentials committed; LCD URL from deploy `.env` matches existing QA pattern; no new network-facing or auth surface. | No `block:security` label applied. **Inline threads:** none (no medium+ findings).
PlasticDigits commented 2026-06-19 13:11:49 +00:00 (Migrated from gitlab.com)

Resolved merge conflicts with main.

Conflict: Makefile — .PHONY target list diverged after parallel merges on both branches.

Resolution: Combined both sides — kept check-emergency-commands-docs and verify-issue-399 from this MR plus smoke-wrap-mapper-pause and verify-issue-396 from main.

Sanity check: make check-emergency-commands-docs — PASS.

Resolved merge conflicts with `main`. **Conflict:** `Makefile` — `.PHONY` target list diverged after parallel merges on both branches. **Resolution:** Combined both sides — kept `check-emergency-commands-docs` and `verify-issue-399` from this MR plus `smoke-wrap-mapper-pause` and `verify-issue-396` from `main`. **Sanity check:** `make check-emergency-commands-docs` — PASS.
PlasticDigits commented 2026-06-19 13:12:05 +00:00 (Migrated from gitlab.com)

added 9 commits

  • 4d53efe7...049471ed - 8 commits from branch main
  • 7d2fa501 - Merge origin/main into issue-399-emergency-commands.

Compare with previous version

added 9 commits <ul><li>4d53efe7...049471ed - 8 commits from branch <code>main</code></li><li>7d2fa501 - Merge origin/main into issue-399-emergency-commands.</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/210/diffs?diff_id=1861208415&start_sha=4d53efe711eaf9eeeebda2f22fab1c5b7941574e)
PlasticDigits commented 2026-06-19 13:15:03 +00:00 (Migrated from gitlab.com)

Security review — MR !928

Commit reviewed: 7d2fa5014a915340a97a6847e47aaa071c0f8e63
Scope: Emergency pause/blacklist operator cookbook (SEC-B11, #399) — docs/runbooks/emergency-commands.md, scripts/qa/verify-issue-399.sh, scripts/check_emergency_commands_docs.py, cross-links (docs/security-model.md, ADR 0003, incident template), skills/AGENTS_EMERGENCY_COMMANDS.md, Makefile targets. Re-reviewed after merge of origin/main into issue-399-emergency-commands (prior runs: 09c12d72, 4d53efe7).

Method: Full MR diff vs merge base 049471ed; traced operator/env inputs to sinks (shell/jq/terrad, LCD smart queries, docker exec); compared rehearsal script to existing QA lib patterns (lcd-smart-query.sh, terrad-wait-tx.sh, verify-issue-309.sh); confirmed on-chain messages remain governance-gated (ensure_governance in factory contract). Re-checked prior MR security notes (2026-06-19).

Outcome: FINDINGS: 0 medium+ — NONE

Security review: no medium+ findings on this diff.

Reviewed paths

Area Assessment
On-chain execute recipes Governance-gated factory messages only; all tx payloads built with jq --arg (no shell interpolation into JSON).
Confirm queries (cookbook) --argjson tokens "[\"$TOKEN_ADDR\"]" is brittle if env is malformed, but Terra bech32 addresses cannot contain JSON metacharacters; operator-controlled env only — no external attacker input path.
verify-issue-399.sh LocalTerra-only; jq --arg throughout; pair/token addresses from chain query validated (^terra1); docker exec with quoted vars; restores state after rehearsal.
check_emergency_commands_docs.py Static marker/link checks only; no runtime input.
Secrets / SSRF / injection No credentials committed; LCD URL from deploy .env matches existing QA pattern; no new network-facing or auth surface.

No block:security label applied.

Inline threads: none (no medium+ findings).

## Security review — MR !928 **Commit reviewed:** `7d2fa5014a915340a97a6847e47aaa071c0f8e63` **Scope:** Emergency pause/blacklist operator cookbook (SEC-B11, #399) — `docs/runbooks/emergency-commands.md`, `scripts/qa/verify-issue-399.sh`, `scripts/check_emergency_commands_docs.py`, cross-links (`docs/security-model.md`, ADR 0003, incident template), `skills/AGENTS_EMERGENCY_COMMANDS.md`, Makefile targets. Re-reviewed after merge of `origin/main` into `issue-399-emergency-commands` (prior runs: `09c12d72`, `4d53efe7`). **Method:** Full MR diff vs merge base `049471ed`; traced operator/env inputs to sinks (shell/jq/terrad, LCD smart queries, docker exec); compared rehearsal script to existing QA lib patterns (`lcd-smart-query.sh`, `terrad-wait-tx.sh`, `verify-issue-309.sh`); confirmed on-chain messages remain governance-gated (`ensure_governance` in factory contract). Re-checked prior MR security notes (2026-06-19). **Outcome:** `FINDINGS: 0` medium+ — **NONE** Security review: no medium+ findings on this diff. ### Reviewed paths | Area | Assessment | |------|------------| | On-chain execute recipes | Governance-gated factory messages only; all tx payloads built with `jq --arg` (no shell interpolation into JSON). | | Confirm queries (cookbook) | `--argjson tokens "[\"$TOKEN_ADDR\"]"` is brittle if env is malformed, but Terra bech32 addresses cannot contain JSON metacharacters; operator-controlled env only — no external attacker input path. | | `verify-issue-399.sh` | LocalTerra-only; `jq --arg` throughout; pair/token addresses from chain query validated (`^terra1`); docker exec with quoted vars; restores state after rehearsal. | | `check_emergency_commands_docs.py` | Static marker/link checks only; no runtime input. | | Secrets / SSRF / injection | No credentials committed; LCD URL from deploy `.env` matches existing QA pattern; no new network-facing or auth surface. | No `block:security` label applied. **Inline threads:** none (no medium+ findings).
PlasticDigits commented 2026-06-19 13:49:48 +00:00 (Migrated from gitlab.com)

added 11 commits

  • 7d2fa501...e9d32c9b - 10 commits from branch main
  • 392c0986 - Merge origin/main into issue-399-emergency-commands.

Compare with previous version

added 11 commits <ul><li>7d2fa501...e9d32c9b - 10 commits from branch <code>main</code></li><li>392c0986 - Merge origin/main into issue-399-emergency-commands.</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/210/diffs?diff_id=1861287591&start_sha=7d2fa5014a915340a97a6847e47aaa071c0f8e63)
PlasticDigits commented 2026-06-19 13:49:49 +00:00 (Migrated from gitlab.com)

Resolved merge conflicts with main (Makefile only).

  • Kept #399 additions: check-emergency-commands-docs, verify-issue-399, and emergency-commands lint wiring.
  • Kept #397 additions from main: check-governance-emergency-rehearsal-docs, rehearse-governance-emergency, and verify-issue-397.
  • Updated .PHONY, help, and lint targets to include both sets.

Sanity: make check-emergency-commands-docs and make check-governance-emergency-rehearsal-docs both pass.

Resolved merge conflicts with `main` (Makefile only). - Kept **#399** additions: `check-emergency-commands-docs`, `verify-issue-399`, and emergency-commands lint wiring. - Kept **#397** additions from `main`: `check-governance-emergency-rehearsal-docs`, `rehearse-governance-emergency`, and `verify-issue-397`. - Updated `.PHONY`, `help`, and `lint` targets to include both sets. Sanity: `make check-emergency-commands-docs` and `make check-governance-emergency-rehearsal-docs` both pass.
PlasticDigits commented 2026-06-19 13:51:38 +00:00 (Migrated from gitlab.com)

Security review — MR !928

Commit reviewed: 392c0986f5775f0b7e3de3ea5a409c9334e72878
Scope: Emergency pause/blacklist operator cookbook (SEC-B11, #399) — docs/runbooks/emergency-commands.md, scripts/qa/verify-issue-399.sh, scripts/check_emergency_commands_docs.py, cross-links (docs/security-model.md, ADR 0003, incident template), skills/AGENTS_EMERGENCY_COMMANDS.md, Makefile targets. Re-reviewed after merge of origin/main into issue-399-emergency-commands (prior runs: 09c12d72, 4d53efe7, 7d2fa501).

Method: Full MR diff vs merge base e9d32c9b; traced operator/env inputs to sinks (shell/jq/terrad, LCD smart queries, docker exec); compared rehearsal script to existing QA lib patterns (lcd-smart-query.sh, terrad-wait-tx.sh, verify-issue-309.sh); confirmed on-chain messages remain governance-gated (ensure_governance in factory contract). Re-checked prior MR security notes (2026-06-19).

Outcome: FINDINGS: 0 medium+ — NONE

Security review: no medium+ findings on this diff.

Reviewed paths

Area Assessment
On-chain execute recipes Governance-gated factory messages only; all tx payloads built with jq --arg (no shell interpolation into JSON).
Confirm queries (cookbook) --argjson tokens "[\"$TOKEN_ADDR\"]" is brittle if env is malformed, but Terra bech32 addresses cannot contain JSON metacharacters; operator-controlled env only — no external attacker input path.
verify-issue-399.sh LocalTerra-only; jq --arg throughout; pair/token addresses from chain query validated (^terra1); docker exec with quoted vars; restores state after rehearsal.
check_emergency_commands_docs.py Static marker/link checks only; no runtime input.
Secrets / SSRF / injection No credentials committed; LCD URL from deploy .env matches existing QA pattern; no new network-facing or auth surface.

No block:security label applied.

Inline threads: none (no medium+ findings).

## Security review — MR !928 **Commit reviewed:** `392c0986f5775f0b7e3de3ea5a409c9334e72878` **Scope:** Emergency pause/blacklist operator cookbook (SEC-B11, #399) — `docs/runbooks/emergency-commands.md`, `scripts/qa/verify-issue-399.sh`, `scripts/check_emergency_commands_docs.py`, cross-links (`docs/security-model.md`, ADR 0003, incident template), `skills/AGENTS_EMERGENCY_COMMANDS.md`, Makefile targets. Re-reviewed after merge of `origin/main` into `issue-399-emergency-commands` (prior runs: `09c12d72`, `4d53efe7`, `7d2fa501`). **Method:** Full MR diff vs merge base `e9d32c9b`; traced operator/env inputs to sinks (shell/jq/terrad, LCD smart queries, docker exec); compared rehearsal script to existing QA lib patterns (`lcd-smart-query.sh`, `terrad-wait-tx.sh`, `verify-issue-309.sh`); confirmed on-chain messages remain governance-gated (`ensure_governance` in factory contract). Re-checked prior MR security notes (2026-06-19). **Outcome:** `FINDINGS: 0` medium+ — **NONE** Security review: no medium+ findings on this diff. ### Reviewed paths | Area | Assessment | |------|------------| | On-chain execute recipes | Governance-gated factory messages only; all tx payloads built with `jq --arg` (no shell interpolation into JSON). | | Confirm queries (cookbook) | `--argjson tokens "[\"$TOKEN_ADDR\"]"` is brittle if env is malformed, but Terra bech32 addresses cannot contain JSON metacharacters; operator-controlled env only — no external attacker input path. | | `verify-issue-399.sh` | LocalTerra-only; `jq --arg` throughout; pair/token addresses from chain query validated (`^terra1`); docker exec with quoted vars; restores state after rehearsal. | | `check_emergency_commands_docs.py` | Static marker/link checks only; no runtime input. | | Secrets / SSRF / injection | No credentials committed; LCD URL from deploy `.env` matches existing QA pattern; no new network-facing or auth surface. | No `block:security` label applied. **Inline threads:** none (no medium+ findings).
PlasticDigits commented 2026-06-19 14:15:55 +00:00 (Migrated from gitlab.com)

mentioned in commit 6f4fd29bf7

mentioned in commit 6f4fd29bf704c18cfc9f7c848690c4400cc9d562
PlasticDigits (Migrated from gitlab.com) merged commit 6f4fd29bf7 into main 2026-06-19 14:15:55 +00:00
Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
code/cl8y-dex-terraclassic!928
No description provided.