Security: gate mainnet deploy on pasted test outputs (SEC-H08, #444) #974

Merged

PlasticDigits merged 1 commit from issue-444-test-evidence-gate into main

2026-06-30 11:11:10 +00:00

PlasticDigits commented

2026-06-30 11:00:05 +00:00

(Migrated from gitlab.com)

Summary

Adds an explicit pre-deploy test evidence gate (SEC-H08) to the release runbook so operators cannot proceed to production mainnet without recording contract, indexer, frontend, and pool smoke test passage on the launch issue (#444).

What changed:

docs/runbooks/launch-checklist.md Phase 0 — new SEC-H08 step requiring pasted/linked output for make test-contracts, make test-indexer-integration, make test-frontend, and make smoke-pool-swap; notes that CI pipeline links satisfy the gate for CI-built artifacts
docs/templates/deploy-trace.md — new Test results section for release-issue evidence
scripts/check_test_evidence_gate_docs.py + make check-test-evidence-gate-docs — doc drift guard (wired into make lint)
scripts/qa/verify-issue-444.sh + make verify-issue-444 — acceptance regression
skills/AGENTS_TEST_EVIDENCE_GATE.md — agent playbook
Cross-links in docs/deployment-guide.md, docs/qa-invariants.md (Q3), docs/security-model.md, docs/testing.md, skills/AGENTS_LAUNCH_GO_NO_GO.md

Acceptance checklist

Criterion	Command / step	Result
Launch checklist has explicit pre-deploy test output gate	`grep 'SEC-H08' docs/runbooks/launch-checklist.md`	PASS
Checklist requires `make test-contracts` output	`grep 'make test-contracts' docs/runbooks/launch-checklist.md`	PASS
Checklist requires `make test-indexer-integration` output	`grep 'make test-indexer-integration' docs/runbooks/launch-checklist.md`	PASS
Checklist requires `make test-frontend` output	`grep 'make test-frontend' docs/runbooks/launch-checklist.md`	PASS
Checklist notes CI-built artifacts satisfy gate	`grep 'CI-built artifacts' docs/runbooks/launch-checklist.md`	PASS
Deploy trace template has Test results section	`grep 'Test results (pre-deploy evidence' docs/templates/deploy-trace.md`	PASS
Automated regression	`make verify-issue-444`	PASS

Verification checklist (third parties)

make verify-issue-444 — all steps PASS
make check-test-evidence-gate-docs — prints OK line
Read docs/runbooks/launch-checklist.md Phase 0 SEC-H08 item — confirms paste/link requirement and CI pipeline exception
Read docs/templates/deploy-trace.md § Test results — confirms table for contracts/indexer/frontend/smoke evidence

Related issue: #444 (leave open until merge)

## Summary Adds an explicit **pre-deploy test evidence gate (SEC-H08)** to the release runbook so operators cannot proceed to production mainnet without recording contract, indexer, frontend, and pool smoke test passage on the launch issue ([#444](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/444)). **What changed:** - `docs/runbooks/launch-checklist.md` Phase 0 — new SEC-H08 step requiring pasted/linked output for `make test-contracts`, `make test-indexer-integration`, `make test-frontend`, and `make smoke-pool-swap`; notes that CI pipeline links satisfy the gate for CI-built artifacts - `docs/templates/deploy-trace.md` — new **Test results** section for release-issue evidence - `scripts/check_test_evidence_gate_docs.py` + `make check-test-evidence-gate-docs` — doc drift guard (wired into `make lint`) - `scripts/qa/verify-issue-444.sh` + `make verify-issue-444` — acceptance regression - `skills/AGENTS_TEST_EVIDENCE_GATE.md` — agent playbook - Cross-links in `docs/deployment-guide.md`, `docs/qa-invariants.md` (Q3), `docs/security-model.md`, `docs/testing.md`, `skills/AGENTS_LAUNCH_GO_NO_GO.md` ## Acceptance checklist | Criterion | Command / step | Result | |-----------|----------------|--------| | Launch checklist has explicit pre-deploy test output gate | `grep 'SEC-H08' docs/runbooks/launch-checklist.md` | PASS | | Checklist requires `make test-contracts` output | `grep 'make test-contracts' docs/runbooks/launch-checklist.md` | PASS | | Checklist requires `make test-indexer-integration` output | `grep 'make test-indexer-integration' docs/runbooks/launch-checklist.md` | PASS | | Checklist requires `make test-frontend` output | `grep 'make test-frontend' docs/runbooks/launch-checklist.md` | PASS | | Checklist notes CI-built artifacts satisfy gate | `grep 'CI-built artifacts' docs/runbooks/launch-checklist.md` | PASS | | Deploy trace template has Test results section | `grep 'Test results (pre-deploy evidence' docs/templates/deploy-trace.md` | PASS | | Automated regression | `make verify-issue-444` | PASS | ## Verification checklist (third parties) 1. `make verify-issue-444` — all steps PASS 2. `make check-test-evidence-gate-docs` — prints OK line 3. Read `docs/runbooks/launch-checklist.md` Phase 0 SEC-H08 item — confirms paste/link requirement and CI pipeline exception 4. Read `docs/templates/deploy-trace.md` § Test results — confirms table for contracts/indexer/frontend/smoke evidence Related issue: #444 (leave open until merge)

PlasticDigits commented

2026-06-30 11:02:35 +00:00

(Migrated from gitlab.com)

Security review — MR !974

Commit reviewed: 4aabd71d7ea8c4646950b56c8961c61c7b606946

Scope: SEC-H08 pre-deploy test evidence gate — launch runbook Phase 0, deploy-trace template, security-model / testing / qa-invariants cross-links, scripts/check_test_evidence_gate_docs.py, scripts/qa/verify-issue-444.sh, skills/AGENTS_TEST_EVIDENCE_GATE.md, Makefile lint / verify-issue-444 wiring.

Method: Diff-only review; traced attacker-controlled input to sinks in added/modified code paths.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Summary

This MR is procedural hardening only: it documents that operators must paste or link passing test output (or a CI pipeline URL at the same commit SHA) before production mainnet deploy. Added automation (check_test_evidence_gate_docs.py, verify-issue-444.sh) reads fixed repo paths and checks for required documentation markers via path.read_text() / grep — no shell interpolation of external input, no network calls, no changes to CosmWasm contracts, indexer API, frontend runtime, or deploy scripts.

No injection, authz bypass, secret leakage, SSRF/XSS, or unsafe-deserialization surfaces were introduced. The CI-pipeline-link alternative and doc-only regression (verify-issue-444 does not scrape GitLab issues) are intentional operator-process controls, not exploitable code paths.

Inline threads: none (no findings to anchor).

## Security review — MR !974 **Commit reviewed:** `4aabd71d7ea8c4646950b56c8961c61c7b606946` **Scope:** SEC-H08 pre-deploy test evidence gate — launch runbook Phase 0, deploy-trace template, security-model / testing / qa-invariants cross-links, `scripts/check_test_evidence_gate_docs.py`, `scripts/qa/verify-issue-444.sh`, `skills/AGENTS_TEST_EVIDENCE_GATE.md`, Makefile `lint` / `verify-issue-444` wiring. **Method:** Diff-only review; traced attacker-controlled input to sinks in added/modified code paths. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. ### Summary This MR is procedural hardening only: it documents that operators must paste or link passing test output (or a CI pipeline URL at the same commit SHA) before production mainnet deploy. Added automation (`check_test_evidence_gate_docs.py`, `verify-issue-444.sh`) reads fixed repo paths and checks for required documentation markers via `path.read_text()` / `grep` — no shell interpolation of external input, no network calls, no changes to CosmWasm contracts, indexer API, frontend runtime, or deploy scripts. No injection, authz bypass, secret leakage, SSRF/XSS, or unsafe-deserialization surfaces were introduced. The CI-pipeline-link alternative and doc-only regression (`verify-issue-444` does not scrape GitLab issues) are intentional operator-process controls, not exploitable code paths. **Inline threads:** none (no findings to anchor).

PlasticDigits commented

2026-06-30 11:11:11 +00:00

(Migrated from gitlab.com)

mentioned in commit 71ae2d02b1

mentioned in commit 71ae2d02b1298844583ad2cde927cb1326812aff