Add pool triage runbook for incident liquidity ranking (SEC-G03) #968

Merged

PlasticDigits merged 3 commits from issue-436-pool-triage-sec-g03 into main 2026-06-30 06:06:29 +00:00

Conversation 9 Commits 3 Files changed 9 +299 -5

PlasticDigits commented 2026-06-30 02:22:51 +00:00 (Migrated from gitlab.com)

Copy link

Summary

Adds Quick pool triage (SEC-G03) to the emergency-commands runbook and incident template so operators can rank CL8Y DEX pairs by approximate on-chain liquidity during incidents (#436).

• Indexer SQL on pair_reserves — pairs sorted by descending approx_liquidity_units (human-normalized reserve sum) or quote-side reserve
• Indexer API fallback — GET /api/v1/pairs?sort=volume_24h&order=desc (24h activity proxy when DB shell unavailable)
• LCD fallback — single-pair {"pool":{}} when indexer is down
• Doc invariant: make check-pool-triage-docs / make verify-issue-436
• Agent playbook: skills/AGENTS_POOL_TRIAGE.md

Acceptance checklist

Criterion	Verification	Result
Runbook includes SQL or API returning pairs sorted by approximate TVL/liquidity (desc)	grep 'ORDER BY approx_liquidity_units DESC' docs/runbooks/emergency-commands.md	PASS
Query present in incident template triage or emergency-commands.md	grep 'quick-pool-triage-sec-g03' docs/templates/incident-dex-indexer.md	PASS
Doc invariant script	make check-pool-triage-docs	PASS
Full verification ladder	make verify-issue-436	PASS (4 PASS, 1 SKIP — optional SQL smoke needs populated pair_reserves)

Verification for third parties

make check-pool-triage-docs
make verify-issue-436

Manual: open docs/runbooks/emergency-commands.md § Quick pool triage (SEC-G03) and confirm SQL + API snippets. With indexer Postgres populated (make setup-cloud-localterra):

source indexer/.env
psql "$DATABASE_URL" -X -c "SELECT COUNT(*) FROM pair_reserves;"

Incident template triage item: docs/templates/incident-dex-indexer.md → Top pools by liquidity.

## Summary Adds **Quick pool triage (SEC-G03)** to the emergency-commands runbook and incident template so operators can rank CL8Y DEX pairs by approximate on-chain liquidity during incidents ([#436](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/436)). - **Indexer SQL** on `pair_reserves` — pairs sorted by descending `approx_liquidity_units` (human-normalized reserve sum) or quote-side reserve - **Indexer API** fallback — `GET /api/v1/pairs?sort=volume_24h&order=desc` (24h activity proxy when DB shell unavailable) - **LCD fallback** — single-pair `{"pool":{}}` when indexer is down - Doc invariant: `make check-pool-triage-docs` / `make verify-issue-436` - Agent playbook: `skills/AGENTS_POOL_TRIAGE.md` ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Runbook includes SQL or API returning pairs sorted by approximate TVL/liquidity (desc) | `grep 'ORDER BY approx_liquidity_units DESC' docs/runbooks/emergency-commands.md` | **PASS** | | Query present in incident template triage or `emergency-commands.md` | `grep 'quick-pool-triage-sec-g03' docs/templates/incident-dex-indexer.md` | **PASS** | | Doc invariant script | `make check-pool-triage-docs` | **PASS** | | Full verification ladder | `make verify-issue-436` | **PASS** (4 PASS, 1 SKIP — optional SQL smoke needs populated `pair_reserves`) | ## Verification for third parties ```bash make check-pool-triage-docs make verify-issue-436 ``` Manual: open `docs/runbooks/emergency-commands.md` § **Quick pool triage (SEC-G03)** and confirm SQL + API snippets. With indexer Postgres populated (`make setup-cloud-localterra`): ```bash source indexer/.env psql "$DATABASE_URL" -X -c "SELECT COUNT(*) FROM pair_reserves;" ``` Incident template triage item: `docs/templates/incident-dex-indexer.md` → **Top pools by liquidity**.

PlasticDigits commented 2026-06-30 02:25:06 +00:00 (Migrated from gitlab.com)

Copy link

Security review — MR !968

Commit reviewed: 97cb68420f40c45392097dd9b3d6c9e257a4fdfb

Scope: Pool triage runbook (SEC-G03) — docs/runbooks/emergency-commands.md, incident template, security-model cross-links, skills/AGENTS_POOL_TRIAGE.md, scripts/check_pool_triage_docs.py, scripts/qa/verify-issue-436.sh, Makefile targets. No smart-contract, indexer API, or frontend runtime changes.

Method: Diff review with attacker-input tracing on new shell/SQL/curl snippets and verification scripts. Checked prior MR notes (none). Compared indexer GET /api/v1/pairs?sort=volume_24h usage against existing allowlisted sort parsing in indexer/src/api/pairs.rs (pre-existing; not modified here).

Outcome: FINDINGS: 0 medium+

Inline threads: None (no findings to anchor).

Notes (informational, below reporting threshold)

• Runbook SQL is static (no operator-interpolated query fragments); psql "$DATABASE_URL" and verify-issue-436.sh smoke SQL use quoted connection strings and fixed SELECT text — no new injection sink.
• Documented indexer API and LCD pool queries are read-only, operator-local triage paths; credentials stay in indexer/.env on the host (existing emergency-commands pattern).
• Volume-24h API fallback is an activity proxy, not reserve TVL — operational triage guidance only, not an exploitable boundary in this diff.

Security review: no medium+ findings on this diff.

## Security review — MR !968 **Commit reviewed:** `97cb68420f40c45392097dd9b3d6c9e257a4fdfb` **Scope:** Pool triage runbook (SEC-G03) — `docs/runbooks/emergency-commands.md`, incident template, security-model cross-links, `skills/AGENTS_POOL_TRIAGE.md`, `scripts/check_pool_triage_docs.py`, `scripts/qa/verify-issue-436.sh`, Makefile targets. No smart-contract, indexer API, or frontend runtime changes. **Method:** Diff review with attacker-input tracing on new shell/SQL/curl snippets and verification scripts. Checked prior MR notes (none). Compared indexer `GET /api/v1/pairs?sort=volume_24h` usage against existing allowlisted sort parsing in `indexer/src/api/pairs.rs` (pre-existing; not modified here). **Outcome:** `FINDINGS: 0` medium+ **Inline threads:** None (no findings to anchor). ### Notes (informational, below reporting threshold) - Runbook SQL is static (no operator-interpolated query fragments); `psql "$DATABASE_URL"` and `verify-issue-436.sh` smoke SQL use quoted connection strings and fixed `SELECT` text — no new injection sink. - Documented indexer API and LCD `pool` queries are read-only, operator-local triage paths; credentials stay in `indexer/.env` on the host (existing emergency-commands pattern). - Volume-24h API fallback is an activity proxy, not reserve TVL — operational triage guidance only, not an exploitable boundary in this diff. Security review: **no medium+ findings** on this diff.

Brouie commented 2026-06-30 02:59:06 +00:00 (Migrated from gitlab.com)

Copy link

mentioned in issue #436

mentioned in issue #436

PlasticDigits commented 2026-06-30 05:08:30 +00:00 (Migrated from gitlab.com)

Copy link

added 12 commits

• 97cb6842...1921c81f - 11 commits from branch main
• 0b0b0334 - Merge origin/main into issue-436-pool-triage-sec-g03.

Compare with previous version

added 12 commits <ul><li>97cb6842...1921c81f - 11 commits from branch <code>main</code></li><li>0b0b0334 - Merge origin/main into issue-436-pool-triage-sec-g03.</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/250/diffs?diff_id=1877400709&start_sha=97cb68420f40c45392097dd9b3d6c9e257a4fdfb)

PlasticDigits commented 2026-06-30 05:08:32 +00:00 (Migrated from gitlab.com)

Copy link

Resolved merge conflicts with main (commit 0b0b0334).

Files: Makefile, docs/security-model.md, docs/testing.md, skills/AGENTS_EMERGENCY_COMMANDS.md

Resolution: Kept both sides' additions — pool triage (SEC-G03, #436) alongside incident template (SEC-G06, #439), launch monitoring (#434), and unpause gates (SEC-G07, #440) from main.

Sanity: make check-pool-triage-docs and make check-incident-template-docs pass.

Resolved merge conflicts with `main` (commit `0b0b0334`). **Files:** `Makefile`, `docs/security-model.md`, `docs/testing.md`, `skills/AGENTS_EMERGENCY_COMMANDS.md` **Resolution:** Kept both sides' additions — pool triage (SEC-G03, #436) alongside incident template (SEC-G06, #439), launch monitoring (#434), and unpause gates (SEC-G07, #440) from `main`. Sanity: `make check-pool-triage-docs` and `make check-incident-template-docs` pass.

PlasticDigits commented 2026-06-30 05:10:00 +00:00 (Migrated from gitlab.com)

Copy link

Security review — MR !968 (re-review after merge)

Commit reviewed: 0b0b03346b207e139d79cb55f46c4863d4afb306

Scope: Pool triage runbook (SEC-G03) — docs/runbooks/emergency-commands.md, incident template, docs/security-model.md, skills/AGENTS_POOL_TRIAGE.md, skills/AGENTS_EMERGENCY_COMMANDS.md, scripts/check_pool_triage_docs.py, scripts/qa/verify-issue-436.sh, Makefile/doc-test targets. Re-reviewed after merge-conflict resolution with main (prior review on 97cb684).

Method: Full diff review with attacker-input tracing on documented shell/SQL/curl snippets and verification scripts. Cross-checked documented GET /api/v1/pairs?sort=volume_24h against pre-existing allowlisted sort parsing in indexer/src/api/pairs.rs (parse_pair_list_sort — not modified in this MR). No smart-contract, indexer runtime, or frontend code changes.

Outcome: FINDINGS: 0 medium+

Inline threads: None (no findings to anchor).

Prior review

Earlier security note on 97cb684 also reported zero medium+ findings. Merge resolution (0b0b033) only integrated parallel doc/Makefile additions from main; no new executable attack surface.

Notes (informational, below reporting threshold)

• Runbook SQL is static (no operator-interpolated query fragments); psql "$DATABASE_URL" and verify-issue-436.sh smoke SQL use quoted connection strings and fixed SELECT text — no new injection sink.
• Documented indexer API and LCD pool queries are read-only, operator-local triage paths; credentials remain in indexer/.env on the host (existing emergency-commands pattern).
• Volume-24h API fallback is an activity proxy, not reserve TVL — operational triage guidance only, not an exploitable boundary in this diff.

Security review: no medium+ findings on this diff.

## Security review — MR !968 (re-review after merge) **Commit reviewed:** `0b0b03346b207e139d79cb55f46c4863d4afb306` **Scope:** Pool triage runbook (SEC-G03) — `docs/runbooks/emergency-commands.md`, incident template, `docs/security-model.md`, `skills/AGENTS_POOL_TRIAGE.md`, `skills/AGENTS_EMERGENCY_COMMANDS.md`, `scripts/check_pool_triage_docs.py`, `scripts/qa/verify-issue-436.sh`, Makefile/doc-test targets. Re-reviewed after merge-conflict resolution with `main` (prior review on `97cb684`). **Method:** Full diff review with attacker-input tracing on documented shell/SQL/curl snippets and verification scripts. Cross-checked documented `GET /api/v1/pairs?sort=volume_24h` against pre-existing allowlisted sort parsing in `indexer/src/api/pairs.rs` (`parse_pair_list_sort` — not modified in this MR). No smart-contract, indexer runtime, or frontend code changes. **Outcome:** `FINDINGS: 0` medium+ **Inline threads:** None (no findings to anchor). ### Prior review Earlier security note on `97cb684` also reported zero medium+ findings. Merge resolution (`0b0b033`) only integrated parallel doc/Makefile additions from `main`; no new executable attack surface. ### Notes (informational, below reporting threshold) - Runbook SQL is static (no operator-interpolated query fragments); `psql "$DATABASE_URL"` and `verify-issue-436.sh` smoke SQL use quoted connection strings and fixed `SELECT` text — no new injection sink. - Documented indexer API and LCD `pool` queries are read-only, operator-local triage paths; credentials remain in `indexer/.env` on the host (existing emergency-commands pattern). - Volume-24h API fallback is an activity proxy, not reserve TVL — operational triage guidance only, not an exploitable boundary in this diff. Security review: **no medium+ findings** on this diff.

PlasticDigits commented 2026-06-30 05:39:30 +00:00 (Migrated from gitlab.com)

Copy link

added 4 commits

• 0b0b0334...ba73247a - 3 commits from branch main
• 5c7e3a13 - Merge origin/main into issue-436-pool-triage-sec-g03.

Compare with previous version

added 4 commits <ul><li>0b0b0334...ba73247a - 3 commits from branch <code>main</code></li><li>5c7e3a13 - Merge origin/main into issue-436-pool-triage-sec-g03.</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/250/diffs?diff_id=1877427774&start_sha=0b0b03346b207e139d79cb55f46c4863d4afb306)

PlasticDigits commented 2026-06-30 05:39:32 +00:00 (Migrated from gitlab.com)

Copy link

Resolved merge conflicts with main in Makefile (3 hunks).

Kept both branches' doc/verify targets:

• This branch: check-pool-triage-docs, verify-issue-436
• main: check-anomaly-signals-docs, verify-issue-435

Sanity: make check-pool-triage-docs and make check-anomaly-signals-docs both pass.

Resolved merge conflicts with `main` in `Makefile` (3 hunks). Kept both branches' doc/verify targets: - **This branch:** `check-pool-triage-docs`, `verify-issue-436` - **main:** `check-anomaly-signals-docs`, `verify-issue-435` Sanity: `make check-pool-triage-docs` and `make check-anomaly-signals-docs` both pass.

PlasticDigits commented 2026-06-30 05:42:14 +00:00 (Migrated from gitlab.com)

Copy link

Security review — MR !968

Commit reviewed: 5c7e3a136a035f63207b083e092c38bd160e46ef

Scope: Pool triage runbook (SEC-G03) — docs/runbooks/emergency-commands.md, incident template, docs/security-model.md, skills/AGENTS_POOL_TRIAGE.md, skills/AGENTS_EMERGENCY_COMMANDS.md, scripts/check_pool_triage_docs.py, scripts/qa/verify-issue-436.sh, Makefile/doc-test targets. Re-reviewed at current head (prior reviews on 97cb684 / 0b0b033).

Method: Full diff review with attacker-input tracing on documented shell/SQL/curl snippets and verification scripts. Cross-checked documented GET /api/v1/pairs?sort=volume_24h against pre-existing allowlisted sort parsing in indexer/src/api/pairs.rs (parse_pair_list_sort — not modified in this MR). No smart-contract, indexer runtime, or frontend code changes.

Outcome: FINDINGS: 0 medium+

Inline threads: None (no findings to anchor)

Prior review

Earlier notes on 97cb684 and 0b0b033 also reported zero medium+ findings. Current head (5c7e3a1) is the same functional diff scope; no new executable attack surface identified.

Notes (informational, below reporting threshold)

• Runbook SQL is static (no operator-interpolated query fragments); psql "$DATABASE_URL" and verify-issue-436.sh smoke SQL use quoted connection strings and fixed SELECT text — no new injection sink.
• Documented indexer API and LCD pool queries are read-only, operator-local triage paths; credentials remain in indexer/.env on the host (existing emergency-commands pattern).
• Volume-24h API fallback is an activity proxy, not reserve TVL — operational triage guidance only, not an exploitable boundary in this diff.

Security review: no medium+ findings on this diff.

## Security review — MR !968 **Commit reviewed:** `5c7e3a136a035f63207b083e092c38bd160e46ef` **Scope:** Pool triage runbook (SEC-G03) — `docs/runbooks/emergency-commands.md`, incident template, `docs/security-model.md`, `skills/AGENTS_POOL_TRIAGE.md`, `skills/AGENTS_EMERGENCY_COMMANDS.md`, `scripts/check_pool_triage_docs.py`, `scripts/qa/verify-issue-436.sh`, Makefile/doc-test targets. Re-reviewed at current head (prior reviews on `97cb684` / `0b0b033`). **Method:** Full diff review with attacker-input tracing on documented shell/SQL/curl snippets and verification scripts. Cross-checked documented `GET /api/v1/pairs?sort=volume_24h` against pre-existing allowlisted sort parsing in `indexer/src/api/pairs.rs` (`parse_pair_list_sort` — not modified in this MR). No smart-contract, indexer runtime, or frontend code changes. **Outcome:** `FINDINGS: 0` medium+ **Inline threads:** None (no findings to anchor) ### Prior review Earlier notes on `97cb684` and `0b0b033` also reported zero medium+ findings. Current head (`5c7e3a1`) is the same functional diff scope; no new executable attack surface identified. ### Notes (informational, below reporting threshold) - Runbook SQL is static (no operator-interpolated query fragments); `psql "$DATABASE_URL"` and `verify-issue-436.sh` smoke SQL use quoted connection strings and fixed `SELECT` text — no new injection sink. - Documented indexer API and LCD `pool` queries are read-only, operator-local triage paths; credentials remain in `indexer/.env` on the host (existing emergency-commands pattern). - Volume-24h API fallback is an activity proxy, not reserve TVL — operational triage guidance only, not an exploitable boundary in this diff. Security review: **no medium+ findings** on this diff.

PlasticDigits commented 2026-06-30 06:06:30 +00:00 (Migrated from gitlab.com)

Copy link

mentioned in commit 7f1429d829

mentioned in commit 7f1429d829078da2607ff93d62ca0ccc296eebe8

PlasticDigits (Migrated from gitlab.com) merged commit 7f1429d829 into main 2026-06-30 06:06:30 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:implement

Queue implement gate

  

agent:implement

Queue implement gate

  

agent:open_issues

  

agent:ready

  

agent:research

  

agent:security_audit

  

agent:verify

  

architecture

Architecture

  

backend

API and services

  

blocker:hybrid

Blocks hybrid launch

  

blocker:launch

Blocks launch

  

blocker:limit-orders

Blocks limits launch

  

blocker:v2

Blocks v2

  

block:log_only

  

block:security

  

bug

  

ci

  

contracts

Smart contracts

  

correctness

  

deploy

  

dev

  

devops

  

docs

  

documentation

  

duplicate

  

e2e

  

enhancement

  

epic

Epic

  

feature

  

frontend

  

functional-completion

Functional

  

gas

  

good first issue

  

governance

  

help wanted

  

high-risk

  

hooks

  

hybrid

Hybrid swaps

  

indexer

Indexer

  

infra

CI/CD

  

infrastructure

  

integrators

  

invalid

  

launch-blocker

  

limit-orders

Limit orders

  

localnet

  

localterra

  

low priority

  

missing-implementation

Implementation

  

needs-design

Design decision required

  

ops

  

performance

  

priority

high

  

priority

medium

  

product

  

qa

  

QA

  

question

  

ready

Definition of Ready

  

ready

Definition of Ready

  

research

  

scripts

  

security

Security

  

security-hardening

Security hardening

  

smartcontracts

  

tech-debt

  

testing

Testing

  

ux

  

UX

  

v2

Pool-only swaps

  

verification

  

wontfix

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:implement

agent:implement

agent:open_issues

agent:ready

agent:research

agent:security_audit

agent:verify

architecture

backend

blocker:hybrid

blocker:launch

blocker:limit-orders

blocker:v2

block:log_only

block:security

bug

ci

contracts

correctness

deploy

dev

devops

docs

documentation

duplicate

e2e

enhancement

epic

feature

frontend

functional-completion

gas

good first issue

governance

help wanted

high-risk

hooks

hybrid

indexer

infra

infrastructure

integrators

invalid

launch-blocker

limit-orders

localnet

localterra

low priority

missing-implementation

needs-design

ops

performance

priority

high

priority

medium

product

qa

QA

question

ready

ready

research

scripts

security

security-hardening

smartcontracts

tech-debt

testing

ux

UX

v2

verification

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

code/cl8y-dex-terraclassic!968

No description provided.