Prepare later-run migration script; deployment blocked pending Terra Classic whitelist #16

New issue

Open

opened 2026-11-01 04:46:24 +00:00 by PlasticDigits · 2 comments

PlasticDigits commented

2026-11-01 04:46:24 +00:00

Owner

Parent/related work: security epic #3 and rollout #7. Existing contract/source PR14 and target-checked optimized artifacts are available; existing scripts/rollout-build.sh only builds artifacts. Security-v1 live coverage stays0/35 inventoried code10184 contracts.

Deliver a bounded, reviewable later-run tool with offline plan as default, fresh read-only preflight, unsigned single-action packets and optional explicit broadcast of an externally signed exact prepared transaction. Require actual fresh code-upload whitelist/deployer permissions when storing; distinguish this chain gate from DEX CW20 code-id policy/asset pins. Existing verified code IDs may be supplied for later plans without guessing or treating them as a deployment waiver. Unknown permission formats/chain/admin/role state fail closed. No fake whitelist acknowledgment or auto retries while waiting.

Preflight and staged rollout must verify chain and pinned height, exact optimized artifact/code checksums, controller and token identities, current token admins/migration routes, legacy cw2 version, primary/additional minters and issuer/governance separation. Use actual distinct trusted CL8Y role identities and verified multisig/constituent authority; SSH admin keys are not governance quorum. Do not impersonate a contract admin or guess an LP forwarding route. Full state/supply/allowance/minter snapshots and post-migration conservation checks are required before receipts advance.

Controller begins paused. Enroll exact upgraded tokens, coordinate DEX whitelist/pins and reviewed protocol assignments, wait real on-chain assignment/relaxation deadlines (no bootstrap bypass), then governance-only finalization verifies the entire enrolled cohort. Preserve global pause/blacklist/lock/recovery behavior and >=30-day recovery reservation/timers. Failure holds pause and leaves a reviewable receipt; never roll back to unguarded legacy code or discard pending state.

Implement documented plan/prepare/preflight/resume/verify and explicit later broadcast path with finite fee/gas/timeout/body/signature-context checks.
Focused fixtures prove default no broadcast, whitelist and authority refusal, wrong artifacts/chain/source/admin/minter drift, receipt/resume safety and real timer/cohort gates.
Independent exact-pin source review; publish script/commands/config contract and bounded test evidence. Do not rerun unchanged Rust suites/optimizer builds for script-only work.
Confirm whitelist availability and exact deployed/signer/role inputs at the future execution date; signing/custody stays local, never seeds/passwords in chat/args/logs.
Later authorized rollout produces real chain receipts and per-token coverage evidence. Until then keep this issue open and coverage0/35 explicit.

Current assignee by agent ownership: migration implementation worker under parent thr_4rw76j9ker; independent reviewer handles the new script delta. User will run the prepared script later after whitelist release, not perform development or configuration research now.

User direction (2026-11-01): prepare a script the operator can run later. Terra Classic deployment is currently unavailable pending whitelist access; keep deployment/migration deferred and track that gate in this repository. No transaction, signing, store, instantiate, migrate, enrollment or unpause is authorized for execution in this work item now. Parent/related work: security epic #3 and rollout #7. Existing contract/source PR14 and target-checked optimized artifacts are available; existing scripts/rollout-build.sh only builds artifacts. Security-v1 live coverage stays0/35 inventoried code10184 contracts. Deliver a bounded, reviewable later-run tool with offline plan as default, fresh read-only preflight, unsigned single-action packets and optional explicit broadcast of an externally signed exact prepared transaction. Require actual fresh code-upload whitelist/deployer permissions when storing; distinguish this chain gate from DEX CW20 code-id policy/asset pins. Existing verified code IDs may be supplied for later plans without guessing or treating them as a deployment waiver. Unknown permission formats/chain/admin/role state fail closed. No fake whitelist acknowledgment or auto retries while waiting. Preflight and staged rollout must verify chain and pinned height, exact optimized artifact/code checksums, controller and token identities, current token admins/migration routes, legacy cw2 version, primary/additional minters and issuer/governance separation. Use actual distinct trusted CL8Y role identities and verified multisig/constituent authority; SSH admin keys are not governance quorum. Do not impersonate a contract admin or guess an LP forwarding route. Full state/supply/allowance/minter snapshots and post-migration conservation checks are required before receipts advance. Controller begins paused. Enroll exact upgraded tokens, coordinate DEX whitelist/pins and reviewed protocol assignments, wait real on-chain assignment/relaxation deadlines (no bootstrap bypass), then governance-only finalization verifies the entire enrolled cohort. Preserve global pause/blacklist/lock/recovery behavior and >=30-day recovery reservation/timers. Failure holds pause and leaves a reviewable receipt; never roll back to unguarded legacy code or discard pending state. - [ ] Implement documented plan/prepare/preflight/resume/verify and explicit later broadcast path with finite fee/gas/timeout/body/signature-context checks. - [ ] Focused fixtures prove default no broadcast, whitelist and authority refusal, wrong artifacts/chain/source/admin/minter drift, receipt/resume safety and real timer/cohort gates. - [ ] Independent exact-pin source review; publish script/commands/config contract and bounded test evidence. Do not rerun unchanged Rust suites/optimizer builds for script-only work. - [ ] Confirm whitelist availability and exact deployed/signer/role inputs at the future execution date; signing/custody stays local, never seeds/passwords in chat/args/logs. - [ ] Later authorized rollout produces real chain receipts and per-token coverage evidence. Until then keep this issue open and coverage0/35 explicit. Current assignee by agent ownership: migration implementation worker under parent thr_4rw76j9ker; independent reviewer handles the new script delta. User will run the prepared script later after whitelist release, not perform development or configuration research now.

PlasticDigits referenced this issue

2026-11-01 04:47:25 +00:00

Add deferred whitelist-gated migration tool #17

PlasticDigits commented

2026-11-01 04:47:31 +00:00

Author

Owner

Independent source review cleared deferred migration tool commit 0fce4922e4a05ba0f76e49f0eac40c94fecd8957 for publication. This covers only the five script/config/docs/test files; it does not approve or establish live-chain execution.

Independently ran python3 -m unittest discover -s scripts/tests -v: 19 PASS. Ran the default entrypoint: offline plan, no keys/network/transactions, honest coverage 0/35. git diff --check HEAD^ HEAD passed. Unchanged Rust suites and optimized artifacts were not rebuilt.

Reviewed fixed artifact/code checksums; pinned chain-height and permission checks; distinct registered multisig roles and constituent checks; token admin, primary/additional minter and governance separation; separate actual DEX code-ID membership; full legacy raw-state preservation; real pending assignment payload/nonce/epoch/deadline; complete enrolled-cohort validation before governance unpause. Contract admins fail closed for a separately implemented forwarding route. Broadcast is explicit, consumes an externally signed exact packet, rechecks action/body/fee/key/sequence/state/RPC context and age, and records submission intent before sending to prevent automatic replay after ambiguity.

Review found and implementation corrected the LCD params route, actual hex (including uppercase) state-key encoding, and valid null-primary-minter handling. Wire facts checked against upstream primary schemas: wasmd query route, Model key/value encoding, and HexBytes JSON encoding.

No store, signing, deployment, migration, enrollment, unpause or economic transaction was performed by this review. A read-only public LCD probe returned HTTP403, so this review makes no live preflight/endpoint-availability claim. Whitelist, exact current roles/admin/issuer/DEX routes and authorized signing capability must be resolved and checked on the future authorized execution date. Keep actual deployment coverage 0/35 and issue16 open for that work.

Independent source review cleared deferred migration tool commit `0fce4922e4a05ba0f76e49f0eac40c94fecd8957` for publication. This covers only the five script/config/docs/test files; it does not approve or establish live-chain execution. Independently ran `python3 -m unittest discover -s scripts/tests -v`: 19 PASS. Ran the default entrypoint: offline plan, no keys/network/transactions, honest coverage 0/35. `git diff --check HEAD^ HEAD` passed. Unchanged Rust suites and optimized artifacts were not rebuilt. Reviewed fixed artifact/code checksums; pinned chain-height and permission checks; distinct registered multisig roles and constituent checks; token admin, primary/additional minter and governance separation; separate actual DEX code-ID membership; full legacy raw-state preservation; real pending assignment payload/nonce/epoch/deadline; complete enrolled-cohort validation before governance unpause. Contract admins fail closed for a separately implemented forwarding route. Broadcast is explicit, consumes an externally signed exact packet, rechecks action/body/fee/key/sequence/state/RPC context and age, and records submission intent before sending to prevent automatic replay after ambiguity. Review found and implementation corrected the LCD params route, actual hex (including uppercase) state-key encoding, and valid null-primary-minter handling. Wire facts checked against upstream primary schemas: [wasmd query route](https://raw.githubusercontent.com/CosmWasm/wasmd/v0.46.0/proto/cosmwasm/wasm/v1/query.proto), [Model key/value encoding](https://raw.githubusercontent.com/CosmWasm/wasmd/v0.46.0/proto/cosmwasm/wasm/v1/types.proto), and [HexBytes JSON encoding](https://raw.githubusercontent.com/cometbft/cometbft/v0.37.2/libs/bytes/bytes.go). No store, signing, deployment, migration, enrollment, unpause or economic transaction was performed by this review. A read-only public LCD probe returned HTTP403, so this review makes no live preflight/endpoint-availability claim. Whitelist, exact current roles/admin/issuer/DEX routes and authorized signing capability must be resolved and checked on the future authorized execution date. Keep actual deployment coverage 0/35 and issue16 open for that work.

PlasticDigits commented

2026-11-01 04:47:45 +00:00

Author

Owner

Deferred tool implementation published in PR #17 at 0fce4922e4a05ba0f76e49f0eac40c94fecd8957, independently reviewed for source publication.

python3 scripts/rollout-migrate.py is the safe offline entrypoint. Preparation is pinned-height read-only plus one unsigned transaction; broadcasting requires an externally signed exact packet and explicit --execute.
Stages cover store/existing verified code IDs, paused-controller instantiation, full-raw-state-preserving migration, enrollment, reviewed protocol assignments, actual 24h+ pending deadlines, and governance-only finalization across the complete enrolled cohort. Fresh permissions, actual public role keys and constituent separation, admin/minter/code/artifact drift, DEX code-ID policy, finite fees/gas, exact body, expiry and RPC/LCD context are checked. Durable submission intent blocks blind retries.
Agent-owned configuration, secure signing-route expectations, receipt/resume commands and unresolved inputs are documented in docs/rollout/migration-tool.md. LP contract-admin forwarding routes remain explicitly unsupported/blocked pending separate verified implementations; arbitrary role/issuer placeholders cannot run.
Validation: 19 focused fixtures pass; Python compile/diff checks and actual local terrad offline unsigned generation pass. No contract code/artifacts changed; no Rust/optimizer reruns.

The Terra Classic deployment whitelist remains the current deployment blocker. No upload, chain signing, instantiation, migration, enrollment, activation or unpause was performed. Live coverage remains 0/35. Whitelist and actual rollout acceptance boxes in this issue remain unchecked; neither this PR nor review is deployment clearance. Future agents finalize actual identities, custody/routes, DEX policy and configuration before any later execution.

Deferred tool implementation published in PR #17 at `0fce4922e4a05ba0f76e49f0eac40c94fecd8957`, independently reviewed for source publication. - `python3 scripts/rollout-migrate.py` is the safe offline entrypoint. Preparation is pinned-height read-only plus one unsigned transaction; broadcasting requires an externally signed exact packet and explicit `--execute`. - Stages cover store/existing verified code IDs, paused-controller instantiation, full-raw-state-preserving migration, enrollment, reviewed protocol assignments, actual 24h+ pending deadlines, and governance-only finalization across the complete enrolled cohort. Fresh permissions, actual public role keys and constituent separation, admin/minter/code/artifact drift, DEX code-ID policy, finite fees/gas, exact body, expiry and RPC/LCD context are checked. Durable submission intent blocks blind retries. - Agent-owned configuration, secure signing-route expectations, receipt/resume commands and unresolved inputs are documented in `docs/rollout/migration-tool.md`. LP contract-admin forwarding routes remain explicitly unsupported/blocked pending separate verified implementations; arbitrary role/issuer placeholders cannot run. - Validation: 19 focused fixtures pass; Python compile/diff checks and actual local terrad offline unsigned generation pass. No contract code/artifacts changed; no Rust/optimizer reruns. The Terra Classic deployment whitelist remains the current deployment blocker. No upload, chain signing, instantiation, migration, enrollment, activation or unpause was performed. Live coverage remains **0/35**. Whitelist and actual rollout acceptance boxes in this issue remain unchecked; neither this PR nor review is deployment clearance. Future agents finalize actual identities, custody/routes, DEX policy and configuration before any later execution.