Fix cosmes patch, db_orderbook_sim, and add #293 indexer integration tests #943

2026-06-25T20:52:00Z

PlasticDigits commented

2026-06-25 20:52:00 +00:00

(Migrated from gitlab.com)

Summary

Addresses GitLab #420 (parent #411 recommendation 13):

Cosmes patch-package: Renamed patch to @goblinhunt/cosmes@0.0.71-ghunt.22 to match package-lock.json; pinned package.json to ^0.0.71-ghunt.22. SHA in patches/.cosmes-patch-sha256 unchanged (same patch content).
db_orderbook_sim: zero_reserve_mirror_returns_no_output now uses MirrorFreshness::EmptyPool (production semantics for zero reserves) so simulate_pool_only_from_mirror returns InsufficientLiquidity as intended.
#293 slippage integration: Added seed_route_slippage_293 fixture and route_solve_slippage_percent_enrichment_293 in api_route_solve.rs — asserts slippage_percent, spot_amount_out, and symmetric deviation math on GET /route/solve with pool_only=true.
LCD error bodies: Include response snippet in non-success LCD errors so limit_book_lcd can map wasm "key not found" 500s to 400 (fixes limit_book_invalid_cursor_lcd_not_found_400).

Docs: docs/testing.md, skills/AGENTS_LOCAL_POSTGRES_DEV.md.

Acceptance checklist

Criterion	Command / step	Result
`make test-frontend` 1040/1040 incl. `cosmesPatch127.test.ts`	`make test-frontend`	PASS (1047/1047)
`make test-indexer-integration` completes (lib + integration)	`make setup-indexer-postgres && make test-indexer-integration`	PASS
New/extended integration test covers `slippage_percent` (#293)	`cd indexer && cargo test --test api_route_solve route_solve_slippage_percent_enrichment_293 -- --test-threads=1`	PASS
`db_orderbook_sim::zero_reserve_mirror_returns_no_output` passes	`cd indexer && cargo test --lib api::db_orderbook_sim::tests::zero_reserve_mirror_returns_no_output`	PASS

Verification for third parties

# Frontend (needs npm ci for patch postinstall)
cd frontend-dapp && npm ci && cd .. && make test-frontend

# Indexer lib + integration (Postgres only on Cloud Agent)
make setup-indexer-postgres
make test-indexer-integration

# Targeted regressions
cd indexer && cargo test --lib api::db_orderbook_sim::tests::zero_reserve_mirror_returns_no_output
cd indexer && cargo test --test api_route_solve route_solve_slippage_percent_enrichment_293 -- --test-threads=1

# Live #293 parity (optional — needs LocalTerra + indexer)
bash scripts/qa/verify-issue-293.sh

Follow-ups

Live verify-issue-293.sh [3c] was not re-run in this session (requires full LocalTerra stack + swarm warmup); Postgres integration test now covers the same slippage_percent fields and symmetric math.

## Summary Addresses GitLab #420 (parent #411 recommendation 13): 1. **Cosmes patch-package:** Renamed patch to `@goblinhunt/cosmes@0.0.71-ghunt.22` to match `package-lock.json`; pinned `package.json` to `^0.0.71-ghunt.22`. SHA in `patches/.cosmes-patch-sha256` unchanged (same patch content). 2. **`db_orderbook_sim`:** `zero_reserve_mirror_returns_no_output` now uses `MirrorFreshness::EmptyPool` (production semantics for zero reserves) so `simulate_pool_only_from_mirror` returns `InsufficientLiquidity` as intended. 3. **#293 slippage integration:** Added `seed_route_slippage_293` fixture and `route_solve_slippage_percent_enrichment_293` in `api_route_solve.rs` — asserts `slippage_percent`, `spot_amount_out`, and symmetric deviation math on `GET /route/solve` with `pool_only=true`. 4. **LCD error bodies:** Include response snippet in non-success LCD errors so `limit_book_lcd` can map wasm "key not found" 500s to 400 (fixes `limit_book_invalid_cursor_lcd_not_found_400`). Docs: `docs/testing.md`, `skills/AGENTS_LOCAL_POSTGRES_DEV.md`. ## Acceptance checklist | Criterion | Command / step | Result | |-----------|----------------|--------| | `make test-frontend` 1040/1040 incl. `cosmesPatch127.test.ts` | `make test-frontend` | **PASS** (1047/1047) | | `make test-indexer-integration` completes (lib + integration) | `make setup-indexer-postgres && make test-indexer-integration` | **PASS** | | New/extended integration test covers `slippage_percent` (#293) | `cd indexer && cargo test --test api_route_solve route_solve_slippage_percent_enrichment_293 -- --test-threads=1` | **PASS** | | `db_orderbook_sim::zero_reserve_mirror_returns_no_output` passes | `cd indexer && cargo test --lib api::db_orderbook_sim::tests::zero_reserve_mirror_returns_no_output` | **PASS** | ## Verification for third parties ```bash # Frontend (needs npm ci for patch postinstall) cd frontend-dapp && npm ci && cd .. && make test-frontend # Indexer lib + integration (Postgres only on Cloud Agent) make setup-indexer-postgres make test-indexer-integration # Targeted regressions cd indexer && cargo test --lib api::db_orderbook_sim::tests::zero_reserve_mirror_returns_no_output cd indexer && cargo test --test api_route_solve route_solve_slippage_percent_enrichment_293 -- --test-threads=1 # Live #293 parity (optional — needs LocalTerra + indexer) bash scripts/qa/verify-issue-293.sh ``` ## Follow-ups - Live `verify-issue-293.sh` [3c] was not re-run in this session (requires full LocalTerra stack + swarm warmup); Postgres integration test now covers the same `slippage_percent` fields and symmetric math.

PlasticDigits commented

2026-06-25 20:53:59 +00:00

(Migrated from gitlab.com)

Security review — MR !943

Commit reviewed: 4ad0ae1440043ea0a5d741217c44ac4b0e9a89cd
Scope: Cosmes patch rename (0.0.71-ghunt.21 → 0.0.71-ghunt.22, unchanged SHA), db_orderbook_sim test fix, LCD error body_snippet in internal AllEndpointsFailed messages, #293 slippage integration test + fixture seed, docs.

Outcome: FINDINGS: 0 medium+

Summary

Security review: no medium+ findings on this diff.

Areas reviewed

Change	Assessment
LCD `body_snippet` in `LcdError::AllEndpointsFailed`	Enables `lcd_query_missing_key` (`msg.contains("not found")`) for wasmd 500 bodies. Client responses remain sanitized via `lcd_gateway_err` → generic `502` / `"Upstream LCD query failed"` (`indexer/src/api/errors.rs`); covered by `lcd_failure_returns_sanitized_502_body` in `security.rs`. Snippet is operator-trusted LCD content, capped at 200 chars; not attacker-controlled via API params.
Cosmes patch rename	Patch content unchanged (`.cosmes-patch-sha256` identical). Fee undershoot guard is LocalTerra-only and hardens signing; no new supply-chain surface beyond existing patch-package flow.
`db_orderbook_sim` test	Test-only alignment with `MirrorFreshness::EmptyPool` production semantics.
`seed_route_slippage_293` / integration test	Parameterized SQL (`$1` binds); test harness only, no new HTTP surface.
Docs	No runtime impact.

Inline threads

None — no medium+ findings to anchor on diff lines.

Automated security review (CosmWasm / Terra / DeFi). Re-review if the diff changes materially.

## Security review — MR !943 **Commit reviewed:** `4ad0ae1440043ea0a5d741217c44ac4b0e9a89cd` **Scope:** Cosmes patch rename (`0.0.71-ghunt.21` → `0.0.71-ghunt.22`, unchanged SHA), `db_orderbook_sim` test fix, LCD error `body_snippet` in internal `AllEndpointsFailed` messages, #293 slippage integration test + fixture seed, docs. **Outcome:** `FINDINGS: 0` medium+ ### Summary Security review: no medium+ findings on this diff. ### Areas reviewed | Change | Assessment | |--------|------------| | **LCD `body_snippet` in `LcdError::AllEndpointsFailed`** | Enables `lcd_query_missing_key` (`msg.contains("not found")`) for wasmd 500 bodies. Client responses remain sanitized via `lcd_gateway_err` → generic `502` / `"Upstream LCD query failed"` (`indexer/src/api/errors.rs`); covered by `lcd_failure_returns_sanitized_502_body` in `security.rs`. Snippet is operator-trusted LCD content, capped at 200 chars; not attacker-controlled via API params. | | **Cosmes patch rename** | Patch content unchanged (`.cosmes-patch-sha256` identical). Fee undershoot guard is LocalTerra-only and hardens signing; no new supply-chain surface beyond existing patch-package flow. | | **`db_orderbook_sim` test** | Test-only alignment with `MirrorFreshness::EmptyPool` production semantics. | | **`seed_route_slippage_293` / integration test** | Parameterized SQL (`$1` binds); test harness only, no new HTTP surface. | | **Docs** | No runtime impact. | ### Inline threads None — no medium+ findings to anchor on diff lines. --- *Automated security review (CosmWasm / Terra / DeFi). Re-review if the diff changes materially.*

PlasticDigits commented

2026-06-25 21:52:21 +00:00

(Migrated from gitlab.com)

mentioned in commit 2f26b71d6c

mentioned in commit 2f26b71d6ca481b943edd57a5d1656735f0d35a2