code/cl8y-dex-terraclassic

Fork 0

SEC-H09: rollback/forward-fix decision tree for four incident types (#445) #976

Merged

PlasticDigits merged 2 commits from issue-445-rollback-decision-tree into main

2026-06-30 11:23:30 +00:00

PlasticDigits commented

2026-06-30 11:03:41 +00:00

(Migrated from gitlab.com)

Summary

Adds docs/runbooks/rollback-decision.md — an operator rollback vs forward-fix decision tree covering frontend-only, indexer, contract, and chain dependency incident types (SEC-H09, #445).

Each type documents symptoms, decision criteria (rollback vs hotfix vs pause), rollback paths with commands, limitations, and recovery verification. Cross-links from launch-checklist.md rollback section, wasm-admin-migration.md, emergency-commands.md, incident template, and security-model.md. Doc drift guards: make check-rollback-decision-docs, make verify-issue-445. Agent playbook: skills/AGENTS_ROLLBACK_DECISION.md.

Acceptance checklist

Criterion	Verification	Result
Runbook documents rollback/forward-fix for frontend, indexer, contract, and chain dependency types	`make verify-issue-445`	PASS
Each type includes decision criteria, rollback path with commands, limitations, and recovery verification	`grep -c '### Decision criteria' docs/runbooks/rollback-decision.md` (≥4 sections) + `make verify-issue-445`	PASS
Cross-linked from `launch-checklist.md` rollback section	`grep rollback-decision docs/runbooks/launch-checklist.md` + `make verify-issue-445`	PASS

Verification checklist (third parties)

make check-rollback-decision-docs
make verify-issue-445

Manual review:

Open docs/runbooks/rollback-decision.md — confirm mermaid top-level tree and four numbered sections.
Open docs/runbooks/launch-checklist.md § Rollback / incident — confirm link to rollback runbook.
Open docs/runbooks/wasm-admin-migration.md § Rollback vs forward-fix — confirm contract cross-link.
Open docs/runbooks/emergency-commands.md Related + Incident workflow — confirm rollback runbook link.
Open docs/templates/incident-dex-indexer.md Mitigation — confirm rollback bullet.
Open skills/AGENTS_ROLLBACK_DECISION.md — agent playbook present.

Related: #445 (issue stays open until merge).

## Summary Adds `docs/runbooks/rollback-decision.md` — an operator rollback vs forward-fix decision tree covering **frontend-only**, **indexer**, **contract**, and **chain dependency** incident types (SEC-H09, #445). Each type documents symptoms, decision criteria (rollback vs hotfix vs pause), rollback paths with commands, limitations, and recovery verification. Cross-links from `launch-checklist.md` rollback section, `wasm-admin-migration.md`, `emergency-commands.md`, incident template, and `security-model.md`. Doc drift guards: `make check-rollback-decision-docs`, `make verify-issue-445`. Agent playbook: `skills/AGENTS_ROLLBACK_DECISION.md`. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Runbook documents rollback/forward-fix for frontend, indexer, contract, and chain dependency types | `make verify-issue-445` | PASS | | Each type includes decision criteria, rollback path with commands, limitations, and recovery verification | `grep -c '### Decision criteria' docs/runbooks/rollback-decision.md` (≥4 sections) + `make verify-issue-445` | PASS | | Cross-linked from `launch-checklist.md` rollback section | `grep rollback-decision docs/runbooks/launch-checklist.md` + `make verify-issue-445` | PASS | ## Verification checklist (third parties) ```bash make check-rollback-decision-docs make verify-issue-445 ``` Manual review: 1. Open `docs/runbooks/rollback-decision.md` — confirm mermaid top-level tree and four numbered sections. 2. Open `docs/runbooks/launch-checklist.md` § Rollback / incident — confirm link to rollback runbook. 3. Open `docs/runbooks/wasm-admin-migration.md` § Rollback vs forward-fix — confirm contract cross-link. 4. Open `docs/runbooks/emergency-commands.md` Related + Incident workflow — confirm rollback runbook link. 5. Open `docs/templates/incident-dex-indexer.md` Mitigation — confirm rollback bullet. 6. Open `skills/AGENTS_ROLLBACK_DECISION.md` — agent playbook present. Related: #445 (issue stays open until merge).

PlasticDigits commented

2026-06-30 11:06:02 +00:00

(Migrated from gitlab.com)

Security review — MR !976

Commit reviewed: d5a509b73c66a7ca367808ddfe0a983b9fd40042
Scope: SEC-H09 rollback/forward-fix decision tree — docs/runbooks/rollback-decision.md, cross-links in runbooks/templates/security-model, agent skill skills/AGENTS_ROLLBACK_DECISION.md, doc drift guards (scripts/check_rollback_decision_docs.py, scripts/qa/verify-issue-445.sh), Makefile targets.

Method: Full MR diff review; traced attacker-controlled input to sinks in added/modified code; compared new scripts to existing doc-invariant patterns; checked for secret leakage, injection, authz bypass, SSRF/XSS/deserialization, and unsafe operator guidance.

Outcome: FINDINGS: 0 medium+

Inline threads: none (no medium+ findings)

Summary

This MR is documentation and CI doc-drift tooling only — no changes to frontend, indexer, CosmWasm contracts, or deployment/runtime code. Added Python/bash scripts read fixed repo paths with string-marker checks; they accept no external or attacker-controlled input and introduce no injection or deserialization surface.

The runbook reinforces sound incident controls already present elsewhere: pause/blacklist before off-chain rollback when funds are at risk, production secrets outside the repo, Postgres snapshot before down.sql, LCD/RPC failover with block-height/hash verification before unpause (SEC-G07), and explicit migrate-back limitations. No credentials, mnemonics, or live endpoints were added.

Prior security-review comments: none on this MR; nothing to re-report.

Security review: no medium+ findings on this diff.

## Security review — MR !976 **Commit reviewed:** `d5a509b73c66a7ca367808ddfe0a983b9fd40042` **Scope:** SEC-H09 rollback/forward-fix decision tree — `docs/runbooks/rollback-decision.md`, cross-links in runbooks/templates/security-model, agent skill `skills/AGENTS_ROLLBACK_DECISION.md`, doc drift guards (`scripts/check_rollback_decision_docs.py`, `scripts/qa/verify-issue-445.sh`), Makefile targets. **Method:** Full MR diff review; traced attacker-controlled input to sinks in added/modified code; compared new scripts to existing doc-invariant patterns; checked for secret leakage, injection, authz bypass, SSRF/XSS/deserialization, and unsafe operator guidance. **Outcome:** `FINDINGS: 0` medium+ **Inline threads:** none (no medium+ findings) ### Summary This MR is documentation and CI doc-drift tooling only — no changes to frontend, indexer, CosmWasm contracts, or deployment/runtime code. Added Python/bash scripts read fixed repo paths with string-marker checks; they accept no external or attacker-controlled input and introduce no injection or deserialization surface. The runbook reinforces sound incident controls already present elsewhere: pause/blacklist before off-chain rollback when funds are at risk, production secrets outside the repo, Postgres snapshot before `down.sql`, LCD/RPC failover with block-height/hash verification before unpause (SEC-G07), and explicit migrate-back limitations. No credentials, mnemonics, or live endpoints were added. **Prior security-review comments:** none on this MR; nothing to re-report. Security review: no medium+ findings on this diff.

Brouie commented

2026-06-30 11:19:06 +00:00

(Migrated from gitlab.com)

mentioned in issue #443

Brouie commented

2026-06-30 11:19:07 +00:00

(Migrated from gitlab.com)

mentioned in issue #445

PlasticDigits commented

2026-06-30 11:22:05 +00:00

(Migrated from gitlab.com)

added 6 commits

d5a509b7...c0bd4546 - 5 commits from branch main
9313da2f - Merge origin/main into issue-445-rollback-decision-tree.

Compare with previous version

added 6 commits <ul><li>d5a509b7...c0bd4546 - 5 commits from branch <code>main</code></li><li>9313da2f - Merge origin/main into issue-445-rollback-decision-tree.</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/258/diffs?diff_id=1878072655&start_sha=d5a509b73c66a7ca367808ddfe0a983b9fd40042)

PlasticDigits commented

2026-06-30 11:22:09 +00:00

(Migrated from gitlab.com)

Resolved merge conflicts with main (merge commit 9313da2f).

Files:

Makefile — combined check-rollback-decision-docs / verify-issue-445 (SEC-H09) with check-wasm-migration-rollback-docs, check-test-evidence-gate-docs, and verify-issue-443 / verify-issue-444 from main.
docs/runbooks/launch-checklist.md — kept SEC-H09 rollback decision tree bullets alongside SEC-H05 wasm migration rollback cross-links.
docs/runbooks/wasm-admin-migration.md — kept SEC-H09 forward-fix decision section above the SEC-H05 rollback/limitations detail from #443.

Sanity checks: make check-rollback-decision-docs, make verify-issue-445, and make verify-issue-443 all pass.

Resolved merge conflicts with `main` (merge commit `9313da2f`). **Files:** - `Makefile` — combined `check-rollback-decision-docs` / `verify-issue-445` (SEC-H09) with `check-wasm-migration-rollback-docs`, `check-test-evidence-gate-docs`, and `verify-issue-443` / `verify-issue-444` from main. - `docs/runbooks/launch-checklist.md` — kept SEC-H09 rollback decision tree bullets alongside SEC-H05 wasm migration rollback cross-links. - `docs/runbooks/wasm-admin-migration.md` — kept SEC-H09 forward-fix decision section above the SEC-H05 rollback/limitations detail from #443. **Sanity checks:** `make check-rollback-decision-docs`, `make verify-issue-445`, and `make verify-issue-443` all pass.

PlasticDigits commented

2026-06-30 11:23:31 +00:00

(Migrated from gitlab.com)

mentioned in commit 6d945d81a8

mentioned in commit 6d945d81a8a249eb34fc39e1b97946f03504c1ce

PlasticDigits (Migrated from gitlab.com) merged commit 6d945d81a8 into main

2026-06-30 11:23:31 +00:00

PlasticDigits commented

2026-06-30 11:24:45 +00:00

(Migrated from gitlab.com)

Security review — MR !976 (re-run)

Commit reviewed: 9313da2fb45d92a400c170de52c937961ef49082 (includes merge of origin/main into issue branch; prior review at d5a509b73c66a7ca367808ddfe0a983b9fd40042)

Scope: SEC-H09 rollback/forward-fix decision tree — docs/runbooks/rollback-decision.md, cross-links in runbooks/templates/security-model, agent skill skills/AGENTS_ROLLBACK_DECISION.md, doc drift guards (scripts/check_rollback_decision_docs.py, scripts/qa/verify-issue-445.sh), Makefile targets.

Method: Full MR diff review at current head; traced attacker-controlled input to sinks in added/modified code; compared new scripts to existing doc-invariant patterns; checked for secret leakage, injection, authz bypass, SSRF/XSS/deserialization, and unsafe operator guidance. Re-read prior security-review note on this MR (3507505327).

Outcome: FINDINGS: 0 medium+

Inline threads: none (no medium+ findings)

Summary

Security review: no medium+ findings on this diff.

This MR is documentation and CI doc-drift guards only — no runtime changes to frontend, indexer, or CosmWasm contracts. Added Python/bash verification scripts read fixed repo paths and marker strings; they accept no external input and introduce no injection or deserialization surface. The runbook operator commands follow existing emergency-commands.md / wasm-admin-migration.md patterns (governance-gated pause/migrate, placeholder env vars, explicit limitations on migrate-back, LCD failover verification, and “never reuse dev .env.local”). Merge-conflict resolution in launch-checklist.md and wasm-admin-migration.md adds cross-links only; no new executable logic.

Prior finding threads: none to re-report.

## Security review — MR !976 (re-run) **Commit reviewed:** `9313da2fb45d92a400c170de52c937961ef49082` (includes merge of `origin/main` into issue branch; prior review at `d5a509b73c66a7ca367808ddfe0a983b9fd40042`) **Scope:** SEC-H09 rollback/forward-fix decision tree — `docs/runbooks/rollback-decision.md`, cross-links in runbooks/templates/security-model, agent skill `skills/AGENTS_ROLLBACK_DECISION.md`, doc drift guards (`scripts/check_rollback_decision_docs.py`, `scripts/qa/verify-issue-445.sh`), Makefile targets. **Method:** Full MR diff review at current head; traced attacker-controlled input to sinks in added/modified code; compared new scripts to existing doc-invariant patterns; checked for secret leakage, injection, authz bypass, SSRF/XSS/deserialization, and unsafe operator guidance. Re-read prior security-review note on this MR (3507505327). **Outcome:** `FINDINGS: 0` medium+ **Inline threads:** none (no medium+ findings) ### Summary Security review: no medium+ findings on this diff. This MR is documentation and CI doc-drift guards only — no runtime changes to frontend, indexer, or CosmWasm contracts. Added Python/bash verification scripts read fixed repo paths and marker strings; they accept no external input and introduce no injection or deserialization surface. The runbook operator commands follow existing `emergency-commands.md` / `wasm-admin-migration.md` patterns (governance-gated pause/migrate, placeholder env vars, explicit limitations on migrate-back, LCD failover verification, and “never reuse dev `.env.local`”). Merge-conflict resolution in `launch-checklist.md` and `wasm-admin-migration.md` adds cross-links only; no new executable logic. Prior finding threads: none to re-report.