Add emergency pause/blacklist command cookbook (SEC-B11, #399) #928
No reviewers
Labels
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:implement
agent:implement
agent:open_issues
agent:ready
agent:research
agent:security_audit
agent:verify
architecture
backend
blocker:hybrid
blocker:launch
blocker:limit-orders
blocker:v2
block:log_only
block:security
bug
ci
contracts
correctness
deploy
dev
devops
docs
documentation
duplicate
e2e
enhancement
epic
feature
frontend
functional-completion
gas
good first issue
governance
help wanted
high-risk
hooks
hybrid
indexer
infra
infrastructure
integrators
invalid
launch-blocker
limit-orders
localnet
localterra
low priority
missing-implementation
needs-design
ops
performance
priority
high
priority
medium
product
qa
QA
question
ready
ready
research
scripts
security
security-hardening
smartcontracts
tech-debt
testing
ux
UX
v2
verification
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
code/cl8y-dex-terraclassic!928
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "issue-399-emergency-commands"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Adds operator-facing emergency command cookbook for factory pause and trading blacklist controls (#399, SEC-B11).
docs/runbooks/emergency-commands.md— parameterizedterrad tx wasm executerecipes for all eight operations (pause/unpause pair; blacklist/unblacklist wallet, token, pair) with required flags and post-tx confirmation queriesscripts/qa/verify-issue-399.sh— LocalTerra rehearsal exercising all eight ops + queries (linked from cookbook)scripts/check_emergency_commands_docs.py+make check-emergency-commands-docs— doc invariant wired intomake lintskills/AGENTS_EMERGENCY_COMMANDS.mdAcceptance checklist
docs/runbooks/emergency-commands.mdexists with parameterized commandsmake check-emergency-commands-docsmake verify-issue-399(8/8 PASS on deploy)docs/templates/incident-dex-indexer.mdVerification checklist (third parties)
Manual: open
docs/runbooks/emergency-commands.mdand confirm each section is copy-pastable after filling$FACTORY_ADDR,$PAIR_ADDR, etc.Blockers
None.
Security review — MR !928
Commit reviewed:
09c12d728b0270960b52db1c3b0c289b24e6d7f3Scope: Emergency pause/blacklist operator cookbook (SEC-B11, #399) —
docs/runbooks/emergency-commands.md,scripts/qa/verify-issue-399.sh,scripts/check_emergency_commands_docs.py, cross-links, Makefile targets.Method: Diff review; traced operator/env inputs to sinks (shell/jq/terrad, LCD smart queries, docker exec); compared rehearsal script to existing QA patterns; checked prior MR discussions (none).
Outcome:
FINDINGS: 0medium+ — NONEReviewed paths
jq --argused for all tx payloads (no shell interpolation into JSON).--argjson tokens "[\"$TOKEN_ADDR\"]"is brittle if env is malformed, but Terra bech32 addresses cannot contain JSON metacharacters; no external attacker-controlled input path.verify-issue-399.shjq --argthroughout; addresses from chain query validated (^terra1); docker exec with quoted vars; restores state after rehearsal.check_emergency_commands_docs.py.env(same pattern as existing QA libs); no new network-facing surface.No
block:securitylabel applied.Inline threads: none (no medium+ findings).
added 7 commits
main4d53efe7- Merge origin/main into issue-399-emergency-commands.Compare with previous version
Resolved merge conflicts with
main(mergedorigin/mainintoissue-399-emergency-commands).Conflicts resolved:
Makefile— kept both SEC-B11 (check-emergency-commands-docs,verify-issue-399) and SEC-B12 (check-blacklist-decision-docs,verify-issue-400) targets in.PHONY,lint, and help.docs/templates/incident-dex-indexer.md— Mitigation section now links both the emergency-commands cookbook (#399) and the blacklist-decision runbook (#400).Sanity checks:
make check-emergency-commands-docsandmake check-blacklist-decision-docsboth pass.Security review — MR !928 (re-review)
Commit reviewed:
4d53efe711eaf9eeeebda2f22fab1c5b7941574eScope: Emergency pause/blacklist operator cookbook (SEC-B11, #399) —
docs/runbooks/emergency-commands.md,scripts/qa/verify-issue-399.sh,scripts/check_emergency_commands_docs.py, cross-links, Makefile targets. Re-reviewed after merge-conflict resolution withmain(head SHA updated from prior run at09c12d72).Method: Full MR diff vs merge base
d487a0cd; traced operator/env inputs to sinks (shell/jq/terrad, LCD smart queries, docker exec); compared rehearsal script to existing QA lib patterns (lcd-smart-query.sh,localterra-host-curl.sh); re-checked prior MR security note (2026-06-19).Outcome:
FINDINGS: 0medium+ — NONEReviewed paths
jq --arg(no shell interpolation into JSON).--argjson tokens "[\"$TOKEN_ADDR\"]"is brittle if env is malformed, but Terra bech32 addresses cannot contain JSON metacharacters; no external attacker-controlled input path.verify-issue-399.shjq --argthroughout; pair/token addresses from chain query validated (^terra1); docker exec with quoted vars; restores state after rehearsal.check_emergency_commands_docs.py.envmatches existing QA pattern; no new network-facing or auth surface.No
block:securitylabel applied.Inline threads: none (no medium+ findings).
Resolved merge conflicts with
main.Conflict:
Makefile—.PHONYtarget list diverged after parallel merges on both branches.Resolution: Combined both sides — kept
check-emergency-commands-docsandverify-issue-399from this MR plussmoke-wrap-mapper-pauseandverify-issue-396frommain.Sanity check:
make check-emergency-commands-docs— PASS.added 9 commits
main7d2fa501- Merge origin/main into issue-399-emergency-commands.Compare with previous version
Security review — MR !928
Commit reviewed:
7d2fa5014a915340a97a6847e47aaa071c0f8e63Scope: Emergency pause/blacklist operator cookbook (SEC-B11, #399) —
docs/runbooks/emergency-commands.md,scripts/qa/verify-issue-399.sh,scripts/check_emergency_commands_docs.py, cross-links (docs/security-model.md, ADR 0003, incident template),skills/AGENTS_EMERGENCY_COMMANDS.md, Makefile targets. Re-reviewed after merge oforigin/mainintoissue-399-emergency-commands(prior runs:09c12d72,4d53efe7).Method: Full MR diff vs merge base
049471ed; traced operator/env inputs to sinks (shell/jq/terrad, LCD smart queries, docker exec); compared rehearsal script to existing QA lib patterns (lcd-smart-query.sh,terrad-wait-tx.sh,verify-issue-309.sh); confirmed on-chain messages remain governance-gated (ensure_governancein factory contract). Re-checked prior MR security notes (2026-06-19).Outcome:
FINDINGS: 0medium+ — NONESecurity review: no medium+ findings on this diff.
Reviewed paths
jq --arg(no shell interpolation into JSON).--argjson tokens "[\"$TOKEN_ADDR\"]"is brittle if env is malformed, but Terra bech32 addresses cannot contain JSON metacharacters; operator-controlled env only — no external attacker input path.verify-issue-399.shjq --argthroughout; pair/token addresses from chain query validated (^terra1); docker exec with quoted vars; restores state after rehearsal.check_emergency_commands_docs.py.envmatches existing QA pattern; no new network-facing or auth surface.No
block:securitylabel applied.Inline threads: none (no medium+ findings).
added 11 commits
main392c0986- Merge origin/main into issue-399-emergency-commands.Compare with previous version
Resolved merge conflicts with
main(Makefile only).check-emergency-commands-docs,verify-issue-399, and emergency-commands lint wiring.main:check-governance-emergency-rehearsal-docs,rehearse-governance-emergency, andverify-issue-397..PHONY,help, andlinttargets to include both sets.Sanity:
make check-emergency-commands-docsandmake check-governance-emergency-rehearsal-docsboth pass.Security review — MR !928
Commit reviewed:
392c0986f5775f0b7e3de3ea5a409c9334e72878Scope: Emergency pause/blacklist operator cookbook (SEC-B11, #399) —
docs/runbooks/emergency-commands.md,scripts/qa/verify-issue-399.sh,scripts/check_emergency_commands_docs.py, cross-links (docs/security-model.md, ADR 0003, incident template),skills/AGENTS_EMERGENCY_COMMANDS.md, Makefile targets. Re-reviewed after merge oforigin/mainintoissue-399-emergency-commands(prior runs:09c12d72,4d53efe7,7d2fa501).Method: Full MR diff vs merge base
e9d32c9b; traced operator/env inputs to sinks (shell/jq/terrad, LCD smart queries, docker exec); compared rehearsal script to existing QA lib patterns (lcd-smart-query.sh,terrad-wait-tx.sh,verify-issue-309.sh); confirmed on-chain messages remain governance-gated (ensure_governancein factory contract). Re-checked prior MR security notes (2026-06-19).Outcome:
FINDINGS: 0medium+ — NONESecurity review: no medium+ findings on this diff.
Reviewed paths
jq --arg(no shell interpolation into JSON).--argjson tokens "[\"$TOKEN_ADDR\"]"is brittle if env is malformed, but Terra bech32 addresses cannot contain JSON metacharacters; operator-controlled env only — no external attacker input path.verify-issue-399.shjq --argthroughout; pair/token addresses from chain query validated (^terra1); docker exec with quoted vars; restores state after rehearsal.check_emergency_commands_docs.py.envmatches existing QA pattern; no new network-facing or auth surface.No
block:securitylabel applied.Inline threads: none (no medium+ findings).
mentioned in commit
6f4fd29bf7