Add admin-key custody runbook and signer roster (SEC-B10, #398) #978

Merged

Brouie merged 1 commit from issue-398-key-custody-roster into main

2026-06-30 14:50:16 +00:00

Brouie commented

2026-06-30 13:48:42 +00:00

(Migrated from gitlab.com)

Implements SEC-B10 (#398): a custody framework for the production governance key.

New docs/runbooks/key-custody.md:

multisig type + TVL-banded threshold (k-of-n Cosmos multisig / DAO)
role-based signer roster (primary / treasury / security / backup) — roles only, identities kept private
backup signer + escalation path
key-rotation triggers + high-level process
no-single-EOA policy

Honors the "pending multisig setup" status — no fabricated signers/addresses/threshold; concrete values are key-ceremony fill-ins. Forward-references SEC-B09 (#397) signing flow and SEC-D10 (#408) rotation cookbook; no duplication.

Wiring: Phase 0 custody gate, Related-docs header, BLOCK table, and go/no-go doc invariant in launch-checklist.md; cross-link in security-model.md. Verify quartet: check_key_custody_docs.py, verify-issue-398.sh, AGENTS_KEY_CUSTODY.md, Makefile targets into lint + help.

make verify-issue-398 -> 5/5. Doc-only; no chain/Postgres. Phase 0 checkbox intentionally left unchecked until the real multisig is live.

Implements SEC-B10 (#398): a custody framework for the production governance key. New `docs/runbooks/key-custody.md`: - multisig type + TVL-banded threshold (k-of-n Cosmos multisig / DAO) - role-based signer roster (primary / treasury / security / backup) — roles only, identities kept private - backup signer + escalation path - key-rotation triggers + high-level process - no-single-EOA policy Honors the "pending multisig setup" status — no fabricated signers/addresses/threshold; concrete values are key-ceremony fill-ins. Forward-references SEC-B09 (#397) signing flow and SEC-D10 (#408) rotation cookbook; no duplication. Wiring: Phase 0 custody gate, Related-docs header, BLOCK table, and go/no-go doc invariant in `launch-checklist.md`; cross-link in `security-model.md`. Verify quartet: `check_key_custody_docs.py`, `verify-issue-398.sh`, `AGENTS_KEY_CUSTODY.md`, Makefile targets into `lint` + `help`. `make verify-issue-398` -> 5/5. Doc-only; no chain/Postgres. Phase 0 checkbox intentionally left unchecked until the real multisig is live.

Brouie commented

2026-06-30 13:49:06 +00:00

(Migrated from gitlab.com)

mentioned in issue #398

PlasticDigits commented

2026-06-30 13:51:01 +00:00

(Migrated from gitlab.com)

Security review — MR !978

Commit reviewed: f1091f011f218eefbf642c792db723b33400e180
Scope: Doc-only SEC-B10 (#398) — docs/runbooks/key-custody.md, launch-checklist / security-model cross-links, scripts/check_key_custody_docs.py, scripts/qa/verify-issue-398.sh, skills/AGENTS_KEY_CUSTODY.md, Makefile wiring into lint / verify-issue-398.

Method: Full diff vs origin/main; traced verification scripts for injection, secret leakage, auth bypass, and unsafe execution paths; reviewed custody runbook rotation/escalation guidance against existing wasm-admin-migration and deployment docs.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Inline threads: none (no findings to anchor).

Notes (informational, below reporting threshold):

Placeholders only in committed roster (<fill>); policy explicitly forbids committing real signer identities/addresses.
check_key_custody_docs.py / verify-issue-398.sh operate on fixed repo paths with no external/attacker-controlled input; no subprocess shell injection surface.
make verify-issue-398 checks documentation presence/markers only — runbook states filled roster is private and not verified here; Phase 0 checkbox remains unchecked until live multisig (appropriate).
Detailed rotation command cookbook deferred to SEC-D10 (#408) per design; not a code-exploitable gap in this MR.

## Security review — MR !978 **Commit reviewed:** `f1091f011f218eefbf642c792db723b33400e180` **Scope:** Doc-only SEC-B10 (#398) — `docs/runbooks/key-custody.md`, launch-checklist / security-model cross-links, `scripts/check_key_custody_docs.py`, `scripts/qa/verify-issue-398.sh`, `skills/AGENTS_KEY_CUSTODY.md`, Makefile wiring into `lint` / `verify-issue-398`. **Method:** Full diff vs `origin/main`; traced verification scripts for injection, secret leakage, auth bypass, and unsafe execution paths; reviewed custody runbook rotation/escalation guidance against existing wasm-admin-migration and deployment docs. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. **Inline threads:** none (no findings to anchor). **Notes (informational, below reporting threshold):** - Placeholders only in committed roster (`<fill>`); policy explicitly forbids committing real signer identities/addresses. - `check_key_custody_docs.py` / `verify-issue-398.sh` operate on fixed repo paths with no external/attacker-controlled input; no subprocess shell injection surface. - `make verify-issue-398` checks documentation presence/markers only — runbook states filled roster is private and not verified here; Phase 0 checkbox remains unchecked until live multisig (appropriate). - Detailed rotation command cookbook deferred to SEC-D10 (#408) per design; not a code-exploitable gap in this MR.

Brouie commented

2026-06-30 14:24:30 +00:00

(Migrated from gitlab.com)

mentioned in merge request !979