test: close post-merge coverage gaps from #22/#23/#25 (minter, BSC hang, SIGTERM, pause e2e, LocalTerra) #28

New issue

Closed

opened 2026-08-08 06:01:52 +00:00 by PlasticDigits · 8 comments

PlasticDigits commented 2026-08-08 06:01:52 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Summary

Close the automated coverage / CI gaps called out in verification notes when merging #22 (!40), #23 (!35), and #25 (!41). Implementation for those issues landed; several acceptance “fork or integration / automated / LocalTerra” paths remain open.

Sources (verification follow-ups):

• #25 / !41: no in-repo test that UpdateMinter(None) deletes MINTERS (M-8 AC); bsc.rs timeouts without hang/wiremock test (M-19); SIGTERM handler without automated probe (L-10); TEST-16 LocalTerra e2e not in CI
• #23 / !35: optional LocalTerra DeliverTx-reject smoke; policy-skip / equal-rate short-circuit lack dedicated regression tests
• #22 / !40: no integration-suite case for oracle-pause → window fail-closed (multitest only)

Out of scope here: new product features (H-1 → #26; C-2 remaining → #27); pure mainnet ops probes (live withdraw, staging restart logs).

---

Current codebase

Gap	Where today	What’s missing
M-8 minter delete	cw20-mintable pinned 8a50c36 (fork PR); claimed in README INV-MINTER-001	No window/integration test in this repo asserting map entry removed after UpdateMinter(None)
M-19 BSC hang	oracle-service/src/bsc.rs has reqwest/transport timeouts; evm_rpc/terra_tx have wiremock tests	No dedicated hang→timeout test for BSC provider path
L-10 SIGTERM	oracle-service/src/main.rs shutdown_signal + tokio::select!	Manual-only; no automated test that shutdown path completes cleanly
C-3 skip paths	run_once equal-rate / check_rate_update Err skip broadcast	Behavior exists; no dedicated regression tests that liveness is untouched
C-2 pause e2e	Window multitest oracle_paused_blocks_deposit_and_withdraw_while_rate_fresh	No ust1-integration-tests case
LocalTerra / TEST-16	Historical e2e scripts; CI rust job runs unit/integration	DeliverTx-reject smoke + e2e job not wired as required CI (or clearly optional gated job)

---

Why this is needed

1. M-8 is a cross-repo safety claim (H-2 “drop governance mint”) with no in-repo regression — pin bumps can silently regress delete semantics.
2. BSC hang was the M-12/M-19 hole called out at merge; without a test, timeouts can be refactored away unnoticed.
3. SIGTERM / health semantics are ops-critical on Render; manual checks drift.
4. C-3 skip paths are easy to break when touching run_once success gating.
5. Oracle-pause is a cross-contract invariant; integration suite should pin it beside multitest.
6. LocalTerra confirm-reject + e2e CI are the only checks that exercise LCD/DeliverTx reality beyond wiremock.

---

Constraints / guardrails

1. Prefer deterministic unit/wiremock tests for BSC hang, SIGTERM, policy-skip, equal-rate; keep LocalTerra/e2e gated (allow skip when Docker/LCD unavailable) but runnable in CI when services present.
2. Do not weaken fail-closed liveness (#23): skip paths must not call record_successful_broadcast.
3. M-8 test may live as integration against the pinned git dep (instantiate mintable → update minter None → query/map absent) — do not vendor a second fork copy.
4. No on-chain behavior changes required to close this issue; if a test reveals a bug, file/fix separately rather than silently expanding scope.
5. /healthz remains process-up only (do not assert rate freshness).
6. Keep CI time reasonable: mark heavy LocalTerra job manual or allow_failure only if documented; prefer a fast subset always-on.

---

Relevant files

• contracts/ust1-window / integration tests — M-8 minter delete; oracle-pause integration
• oracle-service/src/{bsc,main,liveness}.rs (+ test mods) — hang timeout, SIGTERM, skip-path regressions
• smartcontracts-terraclassic/tests/src/integration_tests.rs (or sibling) — oracle pause fail-closed
• .gitlab-ci.yml / .github/workflows/ci.yml — optional LocalTerra/e2e job
• scripts/ LocalTerra helpers, docs/DEPLOYMENT.md — document how to run gated jobs
• skills/audit-hardening-bundle, skills/oracle-liveness-confirm, skills/oracle-circuit-breaker — checklist updates

---

Recommended direction

1. M-8: Add integration/multitest: mintable token with primary minter → UpdateMinter(None) (or fork API equivalent) → assert minter metadata/map entry gone; re-add works.
2. BSC hang: wiremock or custom hyper service that never responds; assert read_exchange_rate_stored / provider build path errors within BSC_RPC_TIMEOUT_SECS (and tick timeout still bounds run_once).
3. SIGTERM: unit-test shutdown_signal / select branch with a testable hook, or spawn binary/helper under timeout and send SIGTERM expecting exit 0 + graceful log (document approach).
4. C-3 skips: multitest run_once with equal rate and with policy reject → no confirm poll / no liveness advance.
5. Oracle pause integration: real oracle+window wasm in integration suite: pause oracle → deposit/withdraw err OraclePaused while age fresh → unpause → success.
6. LocalTerra: scripted smoke — pause oracle or force DeliverTx fail after SYNC; assert service does not advance liveness; optional CI job.

---

Acceptance criteria

• In-repo automated test proves pinned cw20-mintable UpdateMinter(None) clears MINTERS (M-8).
• Automated test proves BSC RPC hang fails within configured timeout (M-19/M-12).
• Automated (or CI-scripted) SIGTERM/graceful-shutdown coverage for oracle-service (L-10).
• Tests prove equal-rate and policy-skip paths do not record liveness success (#23).
• Integration-suite test: oracle pause fails window deposit+withdraw closed (#22).
• LocalTerra DeliverTx-reject (or equivalent) smoke documented and CI-gated or scheduled; TEST-16 status explicit in docs/CI.
• Skills/README checklists updated; cargo test / clippy still green.

---

Test plan (all paths)

1. M-8 happy: add minter → remove via None → query shows absent → add again OK.
2. BSC hang: no response → error before pathological wait; consensus fail-closed when enough peers hang.
3. SIGTERM idle: process exits 0 with graceful log.
4. SIGTERM mid-tick: in-flight tick aborted or finished per design; process exits; no panic.
5. Equal rate: run_once skips broadcast; liveness timestamp unchanged.
6. Policy skip (mono/throttle/daily): skip broadcast; liveness unchanged; structured log present.
7. Oracle pause integration: pause → both directions err → unpause → both directions OK; stale still stale.
8. LocalTerra DeliverTx reject: SYNC ok + DeliverTx fail → no liveness success (complements wiremock #23).
9. CI: unit/wiremock always on; LocalTerra job documented (required or optional with reason).

---

Test plan (attack / hack / abuse vectors)

1. Pin bait (M-8): MR bumps cw20-mintable to a rev that keeps stale MINTERS → in-repo test must fail.
2. Timeout removal (M-12): refactor drops BSC timeout → hang test fails CI.
3. Fake liveness via skips: treating policy skip as success would suppress silence alerts — skip tests must forbid liveness advance.
4. Pause bypass in integration only: ensure integration uses on-chain SetPaused, not a mocked client flag.
5. CI skip abuse: LocalTerra allow_failure forever without tracking — docs must state ownership; prefer artifact/junit visibility.
6. Signal storm: repeated SIGTERM/SIGINT — process still exits cleanly once.

---

Verification criteria

• All checklist items above have a merged automated test or an explicitly documented CI-gated job with owner.
• Verification notes from #22/#23/#25 that cite these gaps can be marked superseded by this issue.
• No claim that mainnet ops probes (live withdraw, staging env restart) are covered here — those remain runbook items under DEPLOYMENT / #19.

## Summary Close the **automated coverage / CI gaps** called out in verification notes when merging [#22](https://gitlab.com/PlasticDigits/ust1-window/-/issues/22) (!40), [#23](https://gitlab.com/PlasticDigits/ust1-window/-/issues/23) (!35), and [#25](https://gitlab.com/PlasticDigits/ust1-window/-/issues/25) (!41). Implementation for those issues landed; several acceptance “fork or integration / automated / LocalTerra” paths remain open. **Sources (verification follow-ups):** - **#25 / !41:** no in-repo test that `UpdateMinter(None)` deletes `MINTERS` (M-8 AC); `bsc.rs` timeouts without hang/wiremock test (M-19); SIGTERM handler without automated probe (L-10); TEST-16 LocalTerra e2e not in CI - **#23 / !35:** optional LocalTerra DeliverTx-reject smoke; policy-skip / equal-rate short-circuit lack dedicated regression tests - **#22 / !40:** no integration-suite case for oracle-pause → window fail-closed (multitest only) **Out of scope here:** new product features (H-1 → [#26](https://gitlab.com/PlasticDigits/ust1-window/-/issues/26); C-2 remaining → [#27](https://gitlab.com/PlasticDigits/ust1-window/-/issues/27)); pure mainnet ops probes (live withdraw, staging restart logs). --- ## Current codebase | Gap | Where today | What’s missing | |-----|-------------|----------------| | M-8 minter delete | `cw20-mintable` pinned `8a50c36` (fork PR); claimed in README INV-MINTER-001 | **No** window/integration test in this repo asserting map entry removed after `UpdateMinter(None)` | | M-19 BSC hang | `oracle-service/src/bsc.rs` has reqwest/transport timeouts; `evm_rpc`/`terra_tx` have wiremock tests | **No** dedicated hang→timeout test for BSC provider path | | L-10 SIGTERM | `oracle-service/src/main.rs` `shutdown_signal` + `tokio::select!` | Manual-only; **no** automated test that shutdown path completes cleanly | | C-3 skip paths | `run_once` equal-rate / `check_rate_update` Err skip broadcast | Behavior exists; **no** dedicated regression tests that liveness is untouched | | C-2 pause e2e | Window multitest `oracle_paused_blocks_deposit_and_withdraw_while_rate_fresh` | **No** `ust1-integration-tests` case | | LocalTerra / TEST-16 | Historical e2e scripts; CI `rust` job runs unit/integration | DeliverTx-reject smoke + e2e job **not** wired as required CI (or clearly optional gated job) | --- ## Why this is needed 1. M-8 is a cross-repo safety claim (H-2 “drop governance mint”) with no in-repo regression — pin bumps can silently regress delete semantics. 2. BSC hang was the M-12/M-19 hole called out at merge; without a test, timeouts can be refactored away unnoticed. 3. SIGTERM / health semantics are ops-critical on Render; manual checks drift. 4. C-3 skip paths are easy to break when touching `run_once` success gating. 5. Oracle-pause is a cross-contract invariant; integration suite should pin it beside multitest. 6. LocalTerra confirm-reject + e2e CI are the only checks that exercise LCD/DeliverTx reality beyond wiremock. --- ## Constraints / guardrails 1. Prefer **deterministic** unit/wiremock tests for BSC hang, SIGTERM, policy-skip, equal-rate; keep LocalTerra/e2e **gated** (allow skip when Docker/LCD unavailable) but runnable in CI when services present. 2. Do not weaken fail-closed liveness (#23): skip paths must **not** call `record_successful_broadcast`. 3. M-8 test may live as integration against the pinned git dep (instantiate mintable → update minter None → query/map absent) — do not vendor a second fork copy. 4. No on-chain behavior changes required to close this issue; if a test reveals a bug, file/fix separately rather than silently expanding scope. 5. `/healthz` remains process-up only (do not assert rate freshness). 6. Keep CI time reasonable: mark heavy LocalTerra job `manual` or `allow_failure` only if documented; prefer a fast subset always-on. --- ## Relevant files - `contracts/ust1-window` / integration tests — M-8 minter delete; oracle-pause integration - `oracle-service/src/{bsc,main,liveness}.rs` (+ test mods) — hang timeout, SIGTERM, skip-path regressions - `smartcontracts-terraclassic/tests/src/integration_tests.rs` (or sibling) — oracle pause fail-closed - `.gitlab-ci.yml` / `.github/workflows/ci.yml` — optional LocalTerra/e2e job - `scripts/` LocalTerra helpers, `docs/DEPLOYMENT.md` — document how to run gated jobs - `skills/audit-hardening-bundle`, `skills/oracle-liveness-confirm`, `skills/oracle-circuit-breaker` — checklist updates --- ## Recommended direction 1. **M-8:** Add integration/multitest: mintable token with primary minter → `UpdateMinter(None)` (or fork API equivalent) → assert minter metadata/map entry gone; re-add works. 2. **BSC hang:** wiremock or custom hyper service that never responds; assert `read_exchange_rate_stored` / provider build path errors within `BSC_RPC_TIMEOUT_SECS` (and tick timeout still bounds `run_once`). 3. **SIGTERM:** unit-test `shutdown_signal` / select branch with a testable hook, or spawn binary/helper under timeout and send SIGTERM expecting exit 0 + graceful log (document approach). 4. **C-3 skips:** multitest `run_once` with equal rate and with policy reject → no confirm poll / no liveness advance. 5. **Oracle pause integration:** real oracle+window wasm in integration suite: pause oracle → deposit/withdraw err `OraclePaused` while age fresh → unpause → success. 6. **LocalTerra:** scripted smoke — pause oracle or force DeliverTx fail after SYNC; assert service does not advance liveness; optional CI job. --- ## Acceptance criteria - [ ] In-repo automated test proves pinned `cw20-mintable` `UpdateMinter(None)` clears `MINTERS` (M-8). - [ ] Automated test proves BSC RPC hang fails within configured timeout (M-19/M-12). - [ ] Automated (or CI-scripted) SIGTERM/graceful-shutdown coverage for oracle-service (L-10). - [ ] Tests prove equal-rate and policy-skip paths do not record liveness success (#23). - [ ] Integration-suite test: oracle pause fails window deposit+withdraw closed (#22). - [ ] LocalTerra DeliverTx-reject (or equivalent) smoke documented and CI-gated or scheduled; TEST-16 status explicit in docs/CI. - [ ] Skills/README checklists updated; `cargo test` / clippy still green. --- ## Test plan (all paths) 1. **M-8 happy:** add minter → remove via None → query shows absent → add again OK. 2. **BSC hang:** no response → error before pathological wait; consensus fail-closed when enough peers hang. 3. **SIGTERM idle:** process exits 0 with graceful log. 4. **SIGTERM mid-tick:** in-flight tick aborted or finished per design; process exits; no panic. 5. **Equal rate:** `run_once` skips broadcast; liveness timestamp unchanged. 6. **Policy skip (mono/throttle/daily):** skip broadcast; liveness unchanged; structured log present. 7. **Oracle pause integration:** pause → both directions err → unpause → both directions OK; stale still stale. 8. **LocalTerra DeliverTx reject:** SYNC ok + DeliverTx fail → no liveness success (complements wiremock #23). 9. **CI:** unit/wiremock always on; LocalTerra job documented (required or optional with reason). --- ## Test plan (attack / hack / abuse vectors) 1. **Pin bait (M-8):** MR bumps `cw20-mintable` to a rev that keeps stale `MINTERS` → in-repo test must fail. 2. **Timeout removal (M-12):** refactor drops BSC timeout → hang test fails CI. 3. **Fake liveness via skips:** treating policy skip as success would suppress silence alerts — skip tests must forbid liveness advance. 4. **Pause bypass in integration only:** ensure integration uses on-chain `SetPaused`, not a mocked client flag. 5. **CI skip abuse:** LocalTerra `allow_failure` forever without tracking — docs must state ownership; prefer artifact/junit visibility. 6. **Signal storm:** repeated SIGTERM/SIGINT — process still exits cleanly once. --- ## Verification criteria - All checklist items above have a merged automated test or an explicitly documented CI-gated job with owner. - Verification notes from #22/#23/#25 that cite these gaps can be marked superseded by this issue. - No claim that mainnet ops probes (live withdraw, staging env restart) are covered here — those remain runbook items under DEPLOYMENT / #19.

PlasticDigits commented 2026-08-08 06:01:53 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

marked as related to #22

marked as related to #22

PlasticDigits commented 2026-08-08 06:01:53 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

marked as related to #23

marked as related to #23

PlasticDigits commented 2026-08-08 06:01:54 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

marked as related to #25

marked as related to #25

PlasticDigits commented 2026-08-08 09:58:25 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit 695e577065

mentioned in commit 695e57706584abbdd69ad0fe01c934ddcfe8092c

PlasticDigits commented 2026-08-08 09:58:36 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in merge request !45

mentioned in merge request !45

PlasticDigits commented 2026-08-08 09:58:57 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Coverage backfill implemented in !45 (worktree fix/issue-28-coverage-gaps).

Done (AC):

• M-8 UpdateMinter(None) / rotation clears MINTERS — ust1-integration-tests cw20_minter_integration
• BSC hang within BSC_RPC_TIMEOUT_SECS — oracle-service bsc::tests
• Graceful shutdown — operator_loop + shutdown_signal_with_hook tests (L-10)
• Equal-rate / policy-skip do not record liveness — decide_tick_action + run_once_* wiremock
• Oracle pause fail-closed in integration suite — oracle_paused_blocks_deposit_and_withdraw_while_rate_fresh
• TEST-16 status documented; gated localterra-e2e / make test-localterra-smoke (skip-clean without LCD)
• Skills + DEPLOYMENT + README crosslinked; cargo test / clippy green

Not done (documented): full LocalTerra wasm deploy automation; real SIGTERM-to-cargo-test process; mainnet ops probes.

Coverage backfill implemented in !45 (worktree `fix/issue-28-coverage-gaps`). **Done (AC):** - [x] M-8 `UpdateMinter(None)` / rotation clears `MINTERS` — `ust1-integration-tests` `cw20_minter_integration` - [x] BSC hang within `BSC_RPC_TIMEOUT_SECS` — `oracle-service` `bsc::tests` - [x] Graceful shutdown — `operator_loop` + `shutdown_signal_with_hook` tests (L-10) - [x] Equal-rate / policy-skip do not record liveness — `decide_tick_action` + `run_once_*` wiremock - [x] Oracle pause fail-closed in integration suite — `oracle_paused_blocks_deposit_and_withdraw_while_rate_fresh` - [x] TEST-16 status documented; gated `localterra-e2e` / `make test-localterra-smoke` (skip-clean without LCD) - [x] Skills + DEPLOYMENT + README crosslinked; `cargo test` / clippy green **Not done (documented):** full LocalTerra wasm deploy automation; real SIGTERM-to-cargo-test process; mainnet ops probes.

PlasticDigits commented 2026-08-08 10:00:17 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit cf2c31a130

mentioned in commit cf2c31a130a788b77e00575e2419edf4110cfc67

PlasticDigits (Migrated from gitlab.com) closed this issue 2026-08-08 10:00:17 +00:00

PlasticDigits commented 2026-08-08 10:11:30 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit 4747039a50

mentioned in commit 4747039a5091e9601467822326bdbf0ba8e759d3

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

issue/50

renovate/configure

No results found.

Labels

Clear labels   

enhancement

  

governance

  

QA

  

testing

No labels

enhancement

governance

QA

testing

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/ust1-window#28

No description provided.