code/cl8y-dex-terraclassic
4
0
Fork 0
Code Issues 35 Pull requests 6 Projects Releases Packages Wiki Activity

Add incident timeline table to operator template (SEC-G06, #439) #965

Merged
PlasticDigits merged 2 commits from issue-439-incident-timeline-sec-g06 into main 2026-06-30 05:04:17 +00:00
Conversation 6 Commits 2 Files changed 11 +194 -9
PlasticDigits commented 2026-06-30 02:21:43 +00:00 (Migrated from gitlab.com)
Copy link

Summary

Adds SEC-G06 incident audit-trail structure to the operator incident template (#439):

  • New Incident timeline section in docs/templates/incident-dex-indexer.md with a blank Markdown table (UTC time, tx hash, wallet, token, pair, admin action, user impact).
  • docs/runbooks/blacklist-decision.md rollback checklist steps 4–5 and docs/runbooks/emergency-commands.md "Record tx hashes" now link to #incident-timeline.
  • Drift guard: make check-incident-template-docs + make verify-issue-439; agent playbook skills/AGENTS_INCIDENT_TEMPLATE.md.

Acceptance checklist

Criterion Verification Result
Incident template has blank timeline table with required columns grep '## Incident timeline' docs/templates/incident-dex-indexer.md and make check-incident-template-docs PASS
blacklist-decision.md rollback step 4 links to timeline grep 'incident-dex-indexer.md#incident-timeline' docs/runbooks/blacklist-decision.md PASS
Emergency commands audit-trail step links to timeline grep 'incident-dex-indexer.md#incident-timeline' docs/runbooks/emergency-commands.md PASS
Automated verification script make verify-issue-439 PASS

Third-party verification

make check-incident-template-docs
make verify-issue-439

Manual spot-check:

  1. Open docs/templates/incident-dex-indexer.md — confirm Incident timeline section between Mitigation and Communications with seven column headers and one blank row.
  2. Open docs/runbooks/blacklist-decision.md rollback checklist — steps 4–5 link to #incident-timeline.
  3. Open docs/runbooks/emergency-commands.md § Before you broadcast step 4 — links to #incident-timeline.
## Summary Adds **SEC-G06** incident audit-trail structure to the operator incident template ([#439](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/439)): - New **Incident timeline** section in `docs/templates/incident-dex-indexer.md` with a blank Markdown table (UTC time, tx hash, wallet, token, pair, admin action, user impact). - `docs/runbooks/blacklist-decision.md` rollback checklist steps 4–5 and `docs/runbooks/emergency-commands.md` "Record tx hashes" now link to `#incident-timeline`. - Drift guard: `make check-incident-template-docs` + `make verify-issue-439`; agent playbook `skills/AGENTS_INCIDENT_TEMPLATE.md`. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Incident template has blank timeline table with required columns | `grep '## Incident timeline' docs/templates/incident-dex-indexer.md` and `make check-incident-template-docs` | PASS | | `blacklist-decision.md` rollback step 4 links to timeline | `grep 'incident-dex-indexer.md#incident-timeline' docs/runbooks/blacklist-decision.md` | PASS | | Emergency commands audit-trail step links to timeline | `grep 'incident-dex-indexer.md#incident-timeline' docs/runbooks/emergency-commands.md` | PASS | | Automated verification script | `make verify-issue-439` | PASS | ## Third-party verification ```bash make check-incident-template-docs make verify-issue-439 ``` Manual spot-check: 1. Open `docs/templates/incident-dex-indexer.md` — confirm **Incident timeline** section between Mitigation and Communications with seven column headers and one blank row. 2. Open `docs/runbooks/blacklist-decision.md` rollback checklist — steps 4–5 link to `#incident-timeline`. 3. Open `docs/runbooks/emergency-commands.md` § Before you broadcast step 4 — links to `#incident-timeline`.
PlasticDigits commented 2026-06-30 02:23:09 +00:00 (Migrated from gitlab.com)
Copy link

Security review — MR !965

Commit reviewed: fed103054ab72e091d5d8a4b944b0262b17e2ce0
Scope: SEC-G06 incident timeline table in operator docs template (#439) — markdown template/runbook cross-links, scripts/check_incident_template_docs.py, scripts/qa/verify-issue-439.sh, Makefile/docs drift guards, agent playbook.

Method: Full MR diff review; traced attacker-controlled input to sinks in new/modified paths; compared new doc-check scripts to existing check_*_docs.py patterns.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Summary

This MR is documentation and CI drift-guard only. No CosmWasm, indexer, frontend, or runtime operator tooling changes. New Python/bash verification scripts read fixed repo-relative paths with no CLI arguments or external input — no injection, path traversal, or command-injection surface. The incident timeline table is static markdown for operator copy-paste audit logging; it is not rendered by the dApp and does not alter on-chain authz or governance controls.

Inline threads

None (no findings to anchor).

## Security review — MR !965 **Commit reviewed:** `fed103054ab72e091d5d8a4b944b0262b17e2ce0` **Scope:** SEC-G06 incident timeline table in operator docs template ([#439](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/439)) — markdown template/runbook cross-links, `scripts/check_incident_template_docs.py`, `scripts/qa/verify-issue-439.sh`, Makefile/docs drift guards, agent playbook. **Method:** Full MR diff review; traced attacker-controlled input to sinks in new/modified paths; compared new doc-check scripts to existing `check_*_docs.py` patterns. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. ### Summary This MR is documentation and CI drift-guard only. No CosmWasm, indexer, frontend, or runtime operator tooling changes. New Python/bash verification scripts read fixed repo-relative paths with no CLI arguments or external input — no injection, path traversal, or command-injection surface. The incident timeline table is static markdown for operator copy-paste audit logging; it is not rendered by the dApp and does not alter on-chain authz or governance controls. ### Inline threads None (no findings to anchor).
Brouie commented 2026-06-30 02:59:09 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in issue #439

mentioned in issue #439
PlasticDigits commented 2026-06-30 03:55:12 +00:00 (Migrated from gitlab.com)
Copy link

added 7 commits

  • fed10305...9fcb468b - 6 commits from branch main
  • 114d10b7 - Merge origin/main into issue-439-incident-timeline-sec-g06

Compare with previous version

added 7 commits <ul><li>fed10305...9fcb468b - 6 commits from branch <code>main</code></li><li>114d10b7 - Merge origin/main into issue-439-incident-timeline-sec-g06</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/247/diffs?diff_id=1877343894&start_sha=fed103054ab72e091d5d8a4b944b0262b17e2ce0)
PlasticDigits commented 2026-06-30 03:55:14 +00:00 (Migrated from gitlab.com)
Copy link

Resolved merge conflicts with main (2 files):

  • Makefile — combined #439 check-incident-template-docs / verify-issue-439 with main's check-launch-monitoring-docs / verify-issue-440 in .PHONY, help, and lint.
  • skills/AGENTS_EMERGENCY_COMMANDS.md — kept main's blacklist-decision.md row and the MR's incident-timeline table description.

Sanity: make check-incident-template-docs and make verify-issue-439 pass.

Resolved merge conflicts with `main` (2 files): - **Makefile** — combined `#439` `check-incident-template-docs` / `verify-issue-439` with main's `check-launch-monitoring-docs` / `verify-issue-440` in `.PHONY`, `help`, and `lint`. - **skills/AGENTS_EMERGENCY_COMMANDS.md** — kept main's `blacklist-decision.md` row and the MR's incident-timeline table description. Sanity: `make check-incident-template-docs` and `make verify-issue-439` pass.
PlasticDigits commented 2026-06-30 03:57:12 +00:00 (Migrated from gitlab.com)
Copy link

Security review — MR !965

Commit reviewed: 114d10b79dbf0c285b8f4fd13565dfcf492bc456
Scope: SEC-G06 incident timeline table in operator docs template (#439) — markdown template/runbook cross-links, scripts/check_incident_template_docs.py, scripts/qa/verify-issue-439.sh, Makefile/docs drift guards, agent playbook.

Method: Full MR diff review (head 114d10b7 vs base 9fcb468b); traced attacker-controlled input to sinks in new/modified paths; compared new doc-check scripts to existing check_*_docs.py patterns. Re-checked prior review on fed10305 — no new runtime or on-chain surfaces in subsequent commits.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Summary

This MR is documentation and CI drift-guard only. No CosmWasm, indexer, frontend, or runtime operator tooling changes. New Python/bash verification scripts read fixed repo-relative paths with no CLI arguments or external input — no injection, path traversal, or command-injection surface. The incident timeline table is static markdown for operator copy-paste audit logging; it is not rendered by the dApp and does not alter on-chain authz or governance controls.

Inline threads

None (no findings to anchor).

## Security review — MR !965 **Commit reviewed:** `114d10b79dbf0c285b8f4fd13565dfcf492bc456` **Scope:** SEC-G06 incident timeline table in operator docs template ([#439](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/439)) — markdown template/runbook cross-links, `scripts/check_incident_template_docs.py`, `scripts/qa/verify-issue-439.sh`, Makefile/docs drift guards, agent playbook. **Method:** Full MR diff review (head `114d10b7` vs base `9fcb468b`); traced attacker-controlled input to sinks in new/modified paths; compared new doc-check scripts to existing `check_*_docs.py` patterns. Re-checked prior review on `fed10305` — no new runtime or on-chain surfaces in subsequent commits. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. ### Summary This MR is documentation and CI drift-guard only. No CosmWasm, indexer, frontend, or runtime operator tooling changes. New Python/bash verification scripts read fixed repo-relative paths with no CLI arguments or external input — no injection, path traversal, or command-injection surface. The incident timeline table is static markdown for operator copy-paste audit logging; it is not rendered by the dApp and does not alter on-chain authz or governance controls. ### Inline threads None (no findings to anchor).
PlasticDigits commented 2026-06-30 05:04:18 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in commit 1921c81f7f

mentioned in commit 1921c81f7f2782398230fbcb6a3013f78c2e6e56
PlasticDigits (Migrated from gitlab.com) merged commit 1921c81f7f into main 2026-06-30 05:04:18 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent:fix_bugfix

   
agent:fix_conflicts

   
agent:fix_security

   
agent:gap_analysis

   
agent:implement

   
agent:implement
Queue implement gate

  
agent:implement
Queue implement gate

  
agent:open_issues

   
agent:ready

   
agent:research

   
agent:security_audit

   
agent:verify

   
architecture
Architecture

  
backend
API and services

  
blocker:hybrid
Blocks hybrid launch

  
blocker:launch
Blocks launch

  
blocker:limit-orders
Blocks limits launch

  
blocker:v2
Blocks v2

  
block:log_only

   
block:security

   
bug

   
ci

   
contracts
Smart contracts

  
correctness

   
deploy

   
dev

   
devops

   
docs

   
documentation

   
duplicate

   
e2e

   
enhancement

   
epic
Epic

  
feature

   
frontend

   
functional-completion
Functional

  
gas

   
good first issue

   
governance

   
help wanted

   
high-risk

   
hooks

   
hybrid
Hybrid swaps

  
indexer
Indexer

  
infra
CI/CD

  
infrastructure

   
integrators

   
invalid

   
launch-blocker

   
limit-orders
Limit orders

  
localnet

   
localterra

   
low priority

   
missing-implementation
Implementation

  
needs-design
Design decision required

  
ops

   
performance
  
priority
high

  
priority
medium

  
product

   
qa

   
QA

   
question

   
ready
Definition of Ready

  
ready
Definition of Ready

  
research

   
scripts

   
security
Security

  
security-hardening
Security hardening

  
smartcontracts

   
tech-debt

   
testing
Testing

  
ux

   
UX

   
v2
Pool-only swaps

  
verification

   
wontfix
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:implement
agent:implement
agent:open_issues
agent:ready
agent:research
agent:security_audit
agent:verify
architecture
backend
blocker:hybrid
blocker:launch
blocker:limit-orders
blocker:v2
block:log_only
block:security
bug
ci
contracts
correctness
deploy
dev
devops
docs
documentation
duplicate
e2e
enhancement
epic
feature
frontend
functional-completion
gas
good first issue
governance
help wanted
high-risk
hooks
hybrid
indexer
infra
infrastructure
integrators
invalid
launch-blocker
limit-orders
localnet
localterra
low priority
missing-implementation
needs-design
ops
performance
priority
high
priority
medium
product
qa
QA
question
ready
ready
research
scripts
security
security-hardening
smartcontracts
tech-debt
testing
ux
UX
v2
verification
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
code/cl8y-dex-terraclassic!965
No description provided.