Security: unpause prerequisite checklist [SEC-G07] (#440) #967

2026-06-30T02:22:31Z

PlasticDigits commented

2026-06-30 02:22:31 +00:00

(Migrated from gitlab.com)

Summary

Addresses GitLab #440 (SEC-G07): the unpause restore path in docs/runbooks/emergency-commands.md had no prerequisite gate requiring root-cause documentation or explicit risk acceptance before broadcasting set_pair_paused with paused: false.

Changes:

Add mandatory Before you unpause checklist to section 2 of emergency-commands.md, mirroring the blacklist rollback checklist structure (evidence preservation, rationale, resolution confirmation, funds-at-risk check, timeline entry with approver, then execute).
Cross-link symmetrically with blacklist-decision.md and security-model.md.
Extend scripts/check_emergency_commands_docs.py with SEC-G07 markers.
Add make verify-issue-440 / scripts/qa/verify-issue-440.sh.
Update skills/AGENTS_EMERGENCY_COMMANDS.md for third-party agents.

Acceptance checklist

Criterion	Verification	Result
`emergency-commands.md` section 2 includes prerequisite checklist (incident reference, resolution confirmation, funds-at-risk, timeline entry, approver)	`make verify-issue-440`	PASS
Unpause checklist mirrors blacklist rollback structure in `blacklist-decision.md`	`grep -A20 'Before you unpause' docs/runbooks/emergency-commands.md` and compare to rollback checklist	PASS
Doc invariant enforces checklist markers	`make check-emergency-commands-docs`	PASS
Symmetric cross-link between restore paths	`grep blacklist-decision docs/runbooks/emergency-commands.md` and `grep emergency-commands docs/runbooks/blacklist-decision.md`	PASS
Agent skill documents SEC-G07 gate	`grep SEC-G07 skills/AGENTS_EMERGENCY_COMMANDS.md`	PASS
Security model references unpause prerequisite	`grep SEC-G07 docs/security-model.md`	PASS

Verification for third parties

make verify-issue-440
make check-emergency-commands-docs
make check-blacklist-decision-docs

Manual review:

Open docs/runbooks/emergency-commands.md § 2 — confirm the Before you unpause (mandatory) checklist appears before the terrad tx wasm execute command.
Open docs/runbooks/blacklist-decision.md § False-positive rollback — confirm cross-link to unpause section.
Confirm both restore paths require: documented rationale, resolution evidence, funds-at-risk confirmation, incident timeline entry with approver.

Related issue: #440 (left open; auto-close on merge).

## Summary Addresses GitLab #440 (**SEC-G07**): the unpause restore path in `docs/runbooks/emergency-commands.md` had no prerequisite gate requiring root-cause documentation or explicit risk acceptance before broadcasting `set_pair_paused` with `paused: false`. Changes: - Add mandatory **Before you unpause** checklist to section 2 of `emergency-commands.md`, mirroring the blacklist rollback checklist structure (evidence preservation, rationale, resolution confirmation, funds-at-risk check, timeline entry with approver, then execute). - Cross-link symmetrically with `blacklist-decision.md` and `security-model.md`. - Extend `scripts/check_emergency_commands_docs.py` with SEC-G07 markers. - Add `make verify-issue-440` / `scripts/qa/verify-issue-440.sh`. - Update `skills/AGENTS_EMERGENCY_COMMANDS.md` for third-party agents. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | `emergency-commands.md` section 2 includes prerequisite checklist (incident reference, resolution confirmation, funds-at-risk, timeline entry, approver) | `make verify-issue-440` | PASS | | Unpause checklist mirrors blacklist rollback structure in `blacklist-decision.md` | `grep -A20 'Before you unpause' docs/runbooks/emergency-commands.md` and compare to rollback checklist | PASS | | Doc invariant enforces checklist markers | `make check-emergency-commands-docs` | PASS | | Symmetric cross-link between restore paths | `grep blacklist-decision docs/runbooks/emergency-commands.md` and `grep emergency-commands docs/runbooks/blacklist-decision.md` | PASS | | Agent skill documents SEC-G07 gate | `grep SEC-G07 skills/AGENTS_EMERGENCY_COMMANDS.md` | PASS | | Security model references unpause prerequisite | `grep SEC-G07 docs/security-model.md` | PASS | ## Verification for third parties ```bash make verify-issue-440 make check-emergency-commands-docs make check-blacklist-decision-docs ``` Manual review: 1. Open `docs/runbooks/emergency-commands.md` § 2 — confirm the **Before you unpause (mandatory)** checklist appears **before** the `terrad tx wasm execute` command. 2. Open `docs/runbooks/blacklist-decision.md` § False-positive rollback — confirm cross-link to unpause section. 3. Confirm both restore paths require: documented rationale, resolution evidence, funds-at-risk confirmation, incident timeline entry with approver. Related issue: #440 (left open; auto-close on merge).

PlasticDigits commented

2026-06-30 02:24:18 +00:00

(Migrated from gitlab.com)

Security review — MR !967

Commit reviewed: dc26e35f4516591e8e5a17b34217f5e0a12cd670
Scope: SEC-G07 unpause prerequisite checklist — documentation, doc-invariant markers, QA verification script (verify-issue-440.sh), Makefile target, agent skill cross-links.

Method

Reviewed full MR diff (8 files: runbooks, security-model, check_emergency_commands_docs.py, verify-issue-440.sh, Makefile, agent skill).
Traced attacker-controlled input paths in added/modified executable code (verify-issue-440.sh, Python doc checker).
Checked prior MR discussion threads for superseded findings — none present.

Outcome

FINDINGS: 0 (no medium, high, or critical)

Security review: no medium+ findings on this diff.

Notes

Changes are procedural/documentation only: mandatory Before you unpause checklist before existing set_pair_paused recipe, symmetric cross-links with blacklist rollback gate, and grep-based CI/doc invariants.
verify-issue-440.sh uses hardcoded paths and fixed grep/make invocations; labels are display-only (not eval'd). No injection surface.
check_emergency_commands_docs.py adds static string markers; no subprocess or external input.
No smart-contract, indexer, or frontend runtime changes; no new secrets, auth paths, or network calls.

Inline threads

None — no findings to anchor.

## Security review — MR !967 **Commit reviewed:** `dc26e35f4516591e8e5a17b34217f5e0a12cd670` **Scope:** SEC-G07 unpause prerequisite checklist — documentation, doc-invariant markers, QA verification script (`verify-issue-440.sh`), Makefile target, agent skill cross-links. ### Method - Reviewed full MR diff (8 files: runbooks, security-model, `check_emergency_commands_docs.py`, `verify-issue-440.sh`, Makefile, agent skill). - Traced attacker-controlled input paths in added/modified executable code (`verify-issue-440.sh`, Python doc checker). - Checked prior MR discussion threads for superseded findings — none present. ### Outcome **FINDINGS: 0** (no medium, high, or critical) **Security review: no medium+ findings on this diff.** ### Notes - Changes are procedural/documentation only: mandatory **Before you unpause** checklist before existing `set_pair_paused` recipe, symmetric cross-links with blacklist rollback gate, and grep-based CI/doc invariants. - `verify-issue-440.sh` uses hardcoded paths and fixed `grep`/`make` invocations; labels are display-only (not `eval`'d). No injection surface. - `check_emergency_commands_docs.py` adds static string markers; no subprocess or external input. - No smart-contract, indexer, or frontend runtime changes; no new secrets, auth paths, or network calls. ### Inline threads None — no findings to anchor.

Brouie commented

2026-06-30 02:59:10 +00:00

(Migrated from gitlab.com)

mentioned in issue #440