Document wasm migration rollback limitations (SEC-H05) — #443 #975

2026-06-30T11:00:20Z

PlasticDigits commented

2026-06-30 11:00:20 +00:00

(Migrated from gitlab.com)

Summary

Addresses GitLab #443 (SEC-H05): the wasm admin migration runbook had no operator guidance on what can or cannot be reversed after a CosmWasm upgrade.

Adds Rollback and limitations section to docs/runbooks/wasm-admin-migration.md covering contract reversal via prior code_id, irrecoverable cases (admin cleared, code purged, keys lost), indexer DB .down.sql rollback under indexer/migrations/revert/, and partial fleet recovery steps.
Cross-links from docs/runbooks/launch-checklist.md rollback section, docs/testing.md, and docs/contracts-security-audit.md.
Adds drift guard make check-wasm-migration-rollback-docs, acceptance script make verify-issue-443, and agent skill skills/AGENTS_WASM_MIGRATION_ROLLBACK.md.

Acceptance checklist

Criterion	Verification	Result
`wasm-admin-migration.md` rollback section covers contract reversal and irrecoverable cases	`grep -q 'Rollback and limitations' docs/runbooks/wasm-admin-migration.md && grep -q 'Irrecoverable cases' docs/runbooks/wasm-admin-migration.md`	PASS
Section references indexer `indexer/migrations/revert/` down.sql	`grep -q 'indexer/migrations/revert/' docs/runbooks/wasm-admin-migration.md`	PASS
`launch-checklist.md` rollback section cross-links wasm migration limitations	`grep -q 'rollback-and-limitations-sec-h05' docs/runbooks/launch-checklist.md`	PASS
Doc drift guard	`make check-wasm-migration-rollback-docs`	PASS
Full issue acceptance script	`make verify-issue-443`	PASS
SEC-C14 migration rehearsal unchanged	`make test-contracts` (included in verify-issue-443)	PASS

Verification checklist (third parties)

make check-wasm-migration-rollback-docs
make verify-issue-443

Manual review:

Open docs/runbooks/wasm-admin-migration.md → Rollback and limitations (SEC-H05) — confirm reversal path, irrecoverable table, indexer down.sql, and partial migration steps read clearly for operators.
Open docs/runbooks/launch-checklist.md → Rollback / incident — confirm link to the new section.
Open skills/AGENTS_WASM_MIGRATION_ROLLBACK.md for agent-oriented summary.

No LocalTerra, Postgres, or frontend required for doc checks.

## Summary Addresses GitLab #443 (**SEC-H05**): the wasm admin migration runbook had no operator guidance on what can or cannot be reversed after a CosmWasm upgrade. - Adds **Rollback and limitations** section to `docs/runbooks/wasm-admin-migration.md` covering contract reversal via prior `code_id`, irrecoverable cases (admin cleared, code purged, keys lost), indexer DB `.down.sql` rollback under `indexer/migrations/revert/`, and partial fleet recovery steps. - Cross-links from `docs/runbooks/launch-checklist.md` rollback section, `docs/testing.md`, and `docs/contracts-security-audit.md`. - Adds drift guard `make check-wasm-migration-rollback-docs`, acceptance script `make verify-issue-443`, and agent skill `skills/AGENTS_WASM_MIGRATION_ROLLBACK.md`. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | `wasm-admin-migration.md` rollback section covers contract reversal and irrecoverable cases | `grep -q 'Rollback and limitations' docs/runbooks/wasm-admin-migration.md && grep -q 'Irrecoverable cases' docs/runbooks/wasm-admin-migration.md` | PASS | | Section references indexer `indexer/migrations/revert/` down.sql | `grep -q 'indexer/migrations/revert/' docs/runbooks/wasm-admin-migration.md` | PASS | | `launch-checklist.md` rollback section cross-links wasm migration limitations | `grep -q 'rollback-and-limitations-sec-h05' docs/runbooks/launch-checklist.md` | PASS | | Doc drift guard | `make check-wasm-migration-rollback-docs` | PASS | | Full issue acceptance script | `make verify-issue-443` | PASS | | SEC-C14 migration rehearsal unchanged | `make test-contracts` (included in verify-issue-443) | PASS | ## Verification checklist (third parties) ```bash make check-wasm-migration-rollback-docs make verify-issue-443 ``` Manual review: 1. Open `docs/runbooks/wasm-admin-migration.md` → **Rollback and limitations (SEC-H05)** — confirm reversal path, irrecoverable table, indexer down.sql, and partial migration steps read clearly for operators. 2. Open `docs/runbooks/launch-checklist.md` → **Rollback / incident** — confirm link to the new section. 3. Open `skills/AGENTS_WASM_MIGRATION_ROLLBACK.md` for agent-oriented summary. No LocalTerra, Postgres, or frontend required for doc checks.

PlasticDigits commented

2026-06-30 11:03:02 +00:00

(Migrated from gitlab.com)

Security review — MR !975

Commit reviewed: 8c71c202ce8bad7148413b2893b87d3d3fc9a403 (base 0a75911012cf7b616eee2d12337102784392f393)

Scope: Documentation and doc-drift tooling for SEC-H05 / #443 — operator rollback/limitations guidance in docs/runbooks/wasm-admin-migration.md, cross-links in launch checklist / testing / contracts-security-audit, agent skill skills/AGENTS_WASM_MIGRATION_ROLLBACK.md, drift guard scripts/check_wasm_migration_rollback_docs.py, acceptance script scripts/qa/verify-issue-443.sh, Makefile targets, and a comment-only link update in smartcontracts/tests/src/migration_tests.rs.

Method: Full MR diff reviewed. Prior MR security threads: none. Each candidate class (injection, authn/authz, secret leakage, SSRF/XSS, unsafe deserialization, supply chain) traced for attacker-controlled input reaching a runtime sink — none present in this diff.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Inline threads: none (no findings to anchor).

Notes (informational, below reporting threshold):

Added content is operator runbook prose and static string markers; no CosmWasm, indexer API, or frontend runtime behavior changes.
check_wasm_migration_rollback_docs.py reads fixed repo paths with hardcoded markers — no external/user input, no shell invocation.
verify-issue-443.sh delegates to make check-wasm-migration-rollback-docs and make test-contracts with fixed paths; no attacker-controlled parameters.
Rollback guidance (terrad query wasm migrate to prior code_id, indexer manual .down.sql, partial-fleet pause) documents existing operational controls; it does not weaken on-chain admin gates or expose credentials.

## Security review — MR !975 **Commit reviewed:** `8c71c202ce8bad7148413b2893b87d3d3fc9a403` (base `0a75911012cf7b616eee2d12337102784392f393`) **Scope:** Documentation and doc-drift tooling for SEC-H05 / #443 — operator rollback/limitations guidance in `docs/runbooks/wasm-admin-migration.md`, cross-links in launch checklist / testing / contracts-security-audit, agent skill `skills/AGENTS_WASM_MIGRATION_ROLLBACK.md`, drift guard `scripts/check_wasm_migration_rollback_docs.py`, acceptance script `scripts/qa/verify-issue-443.sh`, Makefile targets, and a comment-only link update in `smartcontracts/tests/src/migration_tests.rs`. **Method:** Full MR diff reviewed. Prior MR security threads: none. Each candidate class (injection, authn/authz, secret leakage, SSRF/XSS, unsafe deserialization, supply chain) traced for attacker-controlled input reaching a runtime sink — none present in this diff. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. **Inline threads:** none (no findings to anchor). **Notes (informational, below reporting threshold):** - Added content is operator runbook prose and static string markers; no CosmWasm, indexer API, or frontend runtime behavior changes. - `check_wasm_migration_rollback_docs.py` reads fixed repo paths with hardcoded markers — no external/user input, no shell invocation. - `verify-issue-443.sh` delegates to `make check-wasm-migration-rollback-docs` and `make test-contracts` with fixed paths; no attacker-controlled parameters. - Rollback guidance (`terrad query wasm migrate` to prior `code_id`, indexer manual `.down.sql`, partial-fleet pause) documents existing operational controls; it does not weaken on-chain admin gates or expose credentials.

PlasticDigits commented

2026-06-30 11:15:56 +00:00

(Migrated from gitlab.com)

added 3 commits

8c71c202...71ae2d02 - 2 commits from branch main
5058c61b - Merge branch 'main' into issue-443-wasm-migration-rollback-docs

Compare with previous version

added 3 commits <ul><li>8c71c202...71ae2d02 - 2 commits from branch <code>main</code></li><li>5058c61b - Merge branch 'main' into issue-443-wasm-migration-rollback-docs</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/257/diffs?diff_id=1878060193&start_sha=8c71c202ce8bad7148413b2893b87d3d3fc9a403)

PlasticDigits commented

2026-06-30 11:15:59 +00:00

(Migrated from gitlab.com)

Resolved merge conflicts with main (Makefile only).

Merged origin/main into issue-443-wasm-migration-rollback-docs and kept both sides' Makefile targets:

#443 (this MR): check-wasm-migration-rollback-docs, verify-issue-443
#444 (landed on main): check-test-evidence-gate-docs, verify-issue-444

Updated .PHONY, lint, help, and verify targets accordingly. make check-wasm-migration-rollback-docs and make verify-issue-443 pass locally.

Resolved merge conflicts with `main` (Makefile only). Merged `origin/main` into `issue-443-wasm-migration-rollback-docs` and kept both sides' Makefile targets: - **#443 (this MR):** `check-wasm-migration-rollback-docs`, `verify-issue-443` - **#444 (landed on main):** `check-test-evidence-gate-docs`, `verify-issue-444` Updated `.PHONY`, `lint`, `help`, and verify targets accordingly. `make check-wasm-migration-rollback-docs` and `make verify-issue-443` pass locally.

PlasticDigits commented

2026-06-30 11:16:44 +00:00

(Migrated from gitlab.com)

mentioned in commit c0bd454668

mentioned in commit c0bd454668363fb607795f1cc638ce3265785e7a

PlasticDigits (Migrated from gitlab.com) merged commit c0bd454668 into main

2026-06-30 11:16:47 +00:00

PlasticDigits commented

2026-06-30 11:18:28 +00:00

(Migrated from gitlab.com)

Security review — MR !975

Commit reviewed: 5058c61b9595a1381fdd408b7a4b60efbd2c7a20 (base 71ae2d02b1298844583ad2cde927cb1326812aff)

Scope: SEC-H05 / #443 — operator rollback/limitations documentation in docs/runbooks/wasm-admin-migration.md, cross-links in launch-checklist.md, docs/testing.md, and docs/contracts-security-audit.md, agent skill skills/AGENTS_WASM_MIGRATION_ROLLBACK.md, drift guard scripts/check_wasm_migration_rollback_docs.py, acceptance script scripts/qa/verify-issue-443.sh, Makefile targets, and a comment-only link update in smartcontracts/tests/src/migration_tests.rs.

Method: Full MR diff reviewed (9 files). Prior MR security thread (2026-06-30, 8c71c202) reported zero medium+ findings; re-validated on current head including merge resolution. Traced injection, authn/authz, secret leakage, SSRF/XSS, unsafe deserialization, and supply-chain classes for attacker-controlled input reaching a runtime sink — none present in this diff.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Inline threads: none (no findings to anchor).

Notes (informational, below reporting threshold):

Added content is operator runbook prose and static string markers; no CosmWasm contract logic, indexer API, or frontend runtime behavior changes.
check_wasm_migration_rollback_docs.py reads fixed repo paths with hardcoded markers — no external/user input, no shell invocation.
verify-issue-443.sh delegates to make check-wasm-migration-rollback-docs and make test-contracts with fixed paths; no attacker-controlled parameters.
Rollback guidance (migrate to prior code_id with intact admin, manual indexer .down.sql, partial-fleet pause) documents existing operational controls; it does not weaken on-chain admin gates or expose credentials.

## Security review — MR !975 **Commit reviewed:** `5058c61b9595a1381fdd408b7a4b60efbd2c7a20` (base `71ae2d02b1298844583ad2cde927cb1326812aff`) **Scope:** SEC-H05 / #443 — operator rollback/limitations documentation in `docs/runbooks/wasm-admin-migration.md`, cross-links in `launch-checklist.md`, `docs/testing.md`, and `docs/contracts-security-audit.md`, agent skill `skills/AGENTS_WASM_MIGRATION_ROLLBACK.md`, drift guard `scripts/check_wasm_migration_rollback_docs.py`, acceptance script `scripts/qa/verify-issue-443.sh`, Makefile targets, and a comment-only link update in `smartcontracts/tests/src/migration_tests.rs`. **Method:** Full MR diff reviewed (9 files). Prior MR security thread (2026-06-30, `8c71c202`) reported zero medium+ findings; re-validated on current head including merge resolution. Traced injection, authn/authz, secret leakage, SSRF/XSS, unsafe deserialization, and supply-chain classes for attacker-controlled input reaching a runtime sink — none present in this diff. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. **Inline threads:** none (no findings to anchor). **Notes (informational, below reporting threshold):** - Added content is operator runbook prose and static string markers; no CosmWasm contract logic, indexer API, or frontend runtime behavior changes. - `check_wasm_migration_rollback_docs.py` reads fixed repo paths with hardcoded markers — no external/user input, no shell invocation. - `verify-issue-443.sh` delegates to `make check-wasm-migration-rollback-docs` and `make test-contracts` with fixed paths; no attacker-controlled parameters. - Rollback guidance (migrate to prior `code_id` with intact admin, manual indexer `.down.sql`, partial-fleet pause) documents existing operational controls; it does not weaken on-chain admin gates or expose credentials.

Brouie commented

2026-06-30 11:19:06 +00:00

(Migrated from gitlab.com)

mentioned in issue #443