code/yieldomega
Watch
4
0
Fork
You've already forked yieldomega
 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity

DevOps: Idempotent Anvil dev-wallet seeding on re-deploy (e2e-anvil / KEY_EVM_* minter alignment) #281

New issue
Closed
opened 2026-06-02 14:15:18 +00:00 by PlasticDigits · 17 comments
PlasticDigits commented 2026-06-02 14:15:18 +00:00 (Migrated from gitlab.com)

Context

Local Anvil workflows (scripts/e2e-anvil.sh, scripts/start-local-anvil-stack.sh, scripts/lib/anvil_deploy_dev.sh) optionally seed KEY_EVM_1..3 wallets after DeployDev so manual QA, Rabby import, and bot swarms have ETH + DOUB + Play CRED (+ mock CL8Y) without relying solely on the Playwright mock connector.

Current codebase

Piece Behavior
contracts/script/DeployDev.s.sol Broadcasts as deployer from PRIVATE_KEY or default Anvil account #0 (0xac09…). Grants MINTER_ROLE on Doubloon and PlayCred to deployer, mints E2E_MOCK_WALLET (0xf39F…, Anvil #0).
scripts/lib/anvil_deploy_dev.sh When YIELDOMEGA_SEED_EVM_DEV_WALLETS=1 (default), calls scripts/seed-evm-dev-wallets-anvil.sh with parsed DOUB, CRED, optional CL8Y.
scripts/seed-evm-dev-wallets-anvil.sh Uses DEPLOYER_PK defaulting to KEY_EVM_1 (scripts/lib/evm_dev_keys.sh) to mint DOUB/CRED (and CL8Y) to ADDR_EVM_1..3. set -euo pipefail — any revert aborts the script.
scripts/e2e-anvil.sh Invokes deploy + seed before npm run build and Playwright. Failure in seed prevents build/E2E from running.
Playwright With VITE_E2E_MOCK_WALLET=1, wallet writes use the mock connector; E2E can pass when seed is disabled via YIELDOMEGA_SEED_EVM_DEV_WALLETS=0.

Observed failure (Cloud Agent / re-deploy): second consecutive bash scripts/e2e-anvil.sh (or re-run deploy on an existing Anvil without chain reset) can fail in seed with:

AccessControlUnauthorizedAccount(<minter-caller>, <MINTER_ROLE>)

Example caller: address derived from KEY_EVM_1 when it does not match the DeployDev broadcaster that received MINTER_ROLE on the newly deployed token proxies. yieldomega_anvil_deploy_dev returns non-zero; e2e-anvil.sh exits before Vite build.

Related invariants / docs: docs/testing/e2e-anvil.md · AGENTS.md (on-chain seed) · INV-DEPLOY-259-DEV-SEED (DeployDev mock wallet only, not multi-wallet seed).

Why this is needed

  1. Developer ergonomics: Re-running E2E or stack scripts on the same Anvil port is common; seed must not be a footgun.
  2. Cloud / CI parity: Cursor Cloud and other environments may set KEY_EVM_* secrets that differ from Foundry’s default PRIVATE_KEY; seed and deploy must stay aligned.
  3. Manual QA: Rabby and three-wallet scenarios depend on seeded balances; disabling seed (YIELDOMEGA_SEED_EVM_DEV_WALLETS=0) is a workaround, not a product fix.
  4. Fail-fast vs fail-opaque: Today a seed revert looks like a broken E2E pipeline rather than a clear “minter mismatch” diagnostic.

Constraints and guardrails

  • Dev-only: No mainnet/testnet changes; keep DevOnlyChainGuard semantics.
  • Never use Anvil dev keys on public networks (AGENTS.md).
  • Minimal scope: Bash/Forge deploy scripts only unless a tiny onchain helper is strictly necessary (prefer off-chain cast + role checks).
  • Do not weaken production AccessControl on Doubloon / PlayCred.
  • Playwright mock wallet path must remain supported; seed fix must not break VITE_E2E_MOCK_WALLET=1 flows.
  • Idempotent seeding: Safe to run twice (already-funded wallets should not revert the whole pipeline).
  • Document any new env vars in docs/testing/e2e-anvil.md and AGENTS.md if behavior changes.

Relevant files

Recommended direction

Pick one primary approach (or combine 1 + 3):

  1. Align minter identity: Ensure the key that seeds is always the same address that DeployDev grants MINTER_ROLE — e.g. seed script defaults DEPLOYER_PK from PRIVATE_KEY (same default as DeployDev.s.sol) and only falls back to KEY_EVM_1 when explicitly documented; OR grant MINTER_ROLE in DeployDev to ADDR_EVM_1 (and optionally 2–3) in addition to deployer when vm.envBool("YIELDOMEGA_SEED_DEV_WALLETS") is set.
  2. Pre-flight diagnostics: Before minting, cast call hasRole(MINTER_ROLE, caller) on DOUB/CRED; on failure print actionable message (mismatched KEY_EVM_1 vs PRIVATE_KEY, stale Anvil state, wrong DOUB address).
  3. Idempotent seed: Skip mint when balance ≥ target threshold; optionally use grantRole only in deploy script, never from seed.
  4. E2E redeploy hygiene (optional): Document or automate Anvil reset between full E2E runs if chain state causes duplicate-proxy confusion — secondary to minter alignment.

Avoid: silently disabling seed on error without logging (hides misconfiguration).

Acceptance criteria

  • bash scripts/e2e-anvil.sh completes (build + 6 Playwright anvil-arena-* specs green) twice in a row on the same machine without setting YIELDOMEGA_SEED_EVM_DEV_WALLETS=0, with default seed enabled.
  • bash scripts/seed-evm-dev-wallets-anvil.sh succeeds when run manually immediately after yieldomega_anvil_deploy_dev (from anvil_deploy_dev.sh).
  • Re-running seed on already-seeded wallets does not exit non-zero (idempotent or no-op).
  • When KEY_EVM_1 intentionally differs from deployer and cannot mint, script exits with a clear error naming env vars to fix (not opaque AccessControl hex).
  • Cloud-agent path: seed works when KEY_EVM_1..3 are set to non-default secrets iff deploy grants minter to those addresses (document the contract).
  • Docs updated: e2e-anvil.md troubleshooting subsection for seed / minter mismatch.

Test plan — functional paths

# Path Steps Expected
1 Fresh Anvil Start Anvil → e2e-anvil.sh once Seed OK, 6 E2E pass
2 Re-deploy same Anvil Run e2e-anvil.sh again without manual anvil restart Seed OK, 6 E2E pass
3 Manual seed only DeployDev via anvil_deploy_dev.sh → run seed-evm-dev-wallets-anvil.sh ETH + DOUB + CRED (+ CL8Y) on ADDR_EVM_1..3
4 Double seed Run seed script twice Second run succeeds
5 Seed disabled YIELDOMEGA_SEED_EVM_DEV_WALLETS=0 → e2e-anvil.sh E2E still passes (mock wallet)
6 Mismatched keys Set KEY_EVM_1 ≠ deployer, no grant to that address Fail with documented message (or pass only if grant extended)
7 Kumbaya on Default YIELDOMEGA_DEPLOY_KUMBAYA=1 + seed No regression in ETH buy E2E path
8 Stack script start-local-anvil-stack.sh (or documented subset) with default seed Wallets funded for manual /arena

Test plan — attack, hack, and abuse vectors

Vector Risk Test / mitigation
Granting MINTER_ROLE to extra dev addresses in DeployDev Dev deploy could mint unlimited DOUB/CRED on Anvil Restrict grants to chain id 31337 / allowlist only; never ship extra grants in DeployProduction; code review + grep grantRole in production scripts
Seed script with attacker-controlled DEPLOYER_PK Stolen key mints on local Anvil only Document that seed is local-only; do not run on public RPC; assert RPC host is loopback in script (optional hardening)
Using production DOUB/CRED addresses in env Mint on real tokens if roles exist Seed script should refuse non-dev chain ids (mirror DevOnlyChainGuard or cast chain-id check)
Idempotent skip hides compromise Skipping mint when balance high could mask wrong token address Verify DOUB/CRED addresses match latest deploy log; balance check uses correct contract
Logging private keys Leak in CI logs Never echo KEY_EVM_* / DEPLOYER_PK; redact in error messages
Unlimited mint to dev wallets Inflated local state breaks economic tests Cap mint amounts to documented QA values (existing constants); no change to production mint paths

Verification criteria

  • CI or agent log: two consecutive bash scripts/e2e-anvil.sh runs with Done. and 6 passed each.
  • cast call $DOUB "balanceOf(address)(uint256)" $ADDR_EVM_1 (and 2–3) shows expected balances after seed.
  • cast call $DOUB "hasRole(bytes32,address)(bool)" $(cast call $DOUB "MINTER_ROLE()(bytes32)") $DEPLOYER_ADDR is true for the seeding account.
  • No changes to production deploy scripts’ access control surface without separate security review.
  • Issue cross-link from closed verification notes on #256 (optional comment).

Labels

devops, testing, anvil, e2e

## Context Local Anvil workflows (`scripts/e2e-anvil.sh`, `scripts/start-local-anvil-stack.sh`, `scripts/lib/anvil_deploy_dev.sh`) optionally seed **`KEY_EVM_1..3`** wallets after **`DeployDev`** so manual QA, Rabby import, and bot swarms have ETH + DOUB + Play CRED (+ mock CL8Y) without relying solely on the Playwright mock connector. ## Current codebase | Piece | Behavior | |-------|----------| | [`contracts/script/DeployDev.s.sol`](contracts/script/DeployDev.s.sol) | Broadcasts as `deployer` from `PRIVATE_KEY` or default Anvil account #0 (`0xac09…`). Grants **`MINTER_ROLE`** on **`Doubloon`** and **`PlayCred`** to **`deployer`**, mints **`E2E_MOCK_WALLET`** (`0xf39F…`, Anvil #0). | | [`scripts/lib/anvil_deploy_dev.sh`](scripts/lib/anvil_deploy_dev.sh) | When **`YIELDOMEGA_SEED_EVM_DEV_WALLETS=1`** (default), calls [`scripts/seed-evm-dev-wallets-anvil.sh`](scripts/seed-evm-dev-wallets-anvil.sh) with parsed **`DOUB`**, **`CRED`**, optional **`CL8Y`**. | | [`scripts/seed-evm-dev-wallets-anvil.sh`](scripts/seed-evm-dev-wallets-anvil.sh) | Uses **`DEPLOYER_PK`** defaulting to **`KEY_EVM_1`** ([`scripts/lib/evm_dev_keys.sh`](scripts/lib/evm_dev_keys.sh)) to `mint` DOUB/CRED (and CL8Y) to **`ADDR_EVM_1..3`**. **`set -euo pipefail`** — any revert aborts the script. | | [`scripts/e2e-anvil.sh`](scripts/e2e-anvil.sh) | Invokes deploy + seed before **`npm run build`** and Playwright. Failure in seed prevents build/E2E from running. | | Playwright | With **`VITE_E2E_MOCK_WALLET=1`**, wallet writes use the mock connector; E2E can pass when seed is disabled via **`YIELDOMEGA_SEED_EVM_DEV_WALLETS=0`**. | **Observed failure (Cloud Agent / re-deploy):** second consecutive **`bash scripts/e2e-anvil.sh`** (or re-run deploy on an existing Anvil without chain reset) can fail in seed with: ```text AccessControlUnauthorizedAccount(<minter-caller>, <MINTER_ROLE>) ``` Example caller: address derived from **`KEY_EVM_1`** when it **does not** match the **`DeployDev`** broadcaster that received **`MINTER_ROLE`** on the **newly deployed** token proxies. **`yieldomega_anvil_deploy_dev`** returns non-zero; **`e2e-anvil.sh`** exits before Vite build. **Related invariants / docs:** [`docs/testing/e2e-anvil.md`](docs/testing/e2e-anvil.md) · [`AGENTS.md`](AGENTS.md) (on-chain seed) · **`INV-DEPLOY-259-DEV-SEED`** (DeployDev mock wallet only, not multi-wallet seed). ## Why this is needed 1. **Developer ergonomics:** Re-running E2E or stack scripts on the same Anvil port is common; seed must not be a footgun. 2. **Cloud / CI parity:** Cursor Cloud and other environments may set **`KEY_EVM_*`** secrets that differ from Foundry’s default **`PRIVATE_KEY`**; seed and deploy must stay aligned. 3. **Manual QA:** Rabby and three-wallet scenarios depend on seeded balances; disabling seed (`YIELDOMEGA_SEED_EVM_DEV_WALLETS=0`) is a workaround, not a product fix. 4. **Fail-fast vs fail-opaque:** Today a seed revert looks like a broken E2E pipeline rather than a clear “minter mismatch” diagnostic. ## Constraints and guardrails - **Dev-only:** No mainnet/testnet changes; keep [`DevOnlyChainGuard`](contracts/script/DevOnlyChainGuard.sol) semantics. - **Never use Anvil dev keys on public networks** ([`AGENTS.md`](AGENTS.md)). - **Minimal scope:** Bash/Forge deploy scripts only unless a tiny onchain helper is strictly necessary (prefer off-chain `cast` + role checks). - **Do not weaken production `AccessControl`** on **`Doubloon`** / **`PlayCred`**. - **Playwright mock wallet** path must remain supported; seed fix must not break **`VITE_E2E_MOCK_WALLET=1`** flows. - **Idempotent seeding:** Safe to run twice (already-funded wallets should not revert the whole pipeline). - Document any new env vars in [`docs/testing/e2e-anvil.md`](docs/testing/e2e-anvil.md) and [`AGENTS.md`](AGENTS.md) if behavior changes. ## Relevant files - [`scripts/seed-evm-dev-wallets-anvil.sh`](scripts/seed-evm-dev-wallets-anvil.sh) - [`scripts/lib/anvil_deploy_dev.sh`](scripts/lib/anvil_deploy_dev.sh) - [`scripts/lib/evm_dev_keys.sh`](scripts/lib/evm_dev_keys.sh) - [`scripts/e2e-anvil.sh`](scripts/e2e-anvil.sh) - [`scripts/start-local-anvil-stack.sh`](scripts/start-local-anvil-stack.sh) (if it shares deploy helper) - [`contracts/script/DeployDev.s.sol`](contracts/script/DeployDev.s.sol) - [`docs/testing/e2e-anvil.md`](docs/testing/e2e-anvil.md) - [`AGENTS.md`](AGENTS.md) ## Recommended direction Pick one primary approach (or combine 1 + 3): 1. **Align minter identity:** Ensure the key that seeds is always the same address that **`DeployDev`** grants **`MINTER_ROLE`** — e.g. seed script defaults **`DEPLOYER_PK`** from **`PRIVATE_KEY`** (same default as **`DeployDev.s.sol`**) and only falls back to **`KEY_EVM_1`** when explicitly documented; OR grant **`MINTER_ROLE`** in **`DeployDev`** to **`ADDR_EVM_1`** (and optionally 2–3) in addition to **`deployer`** when `vm.envBool("YIELDOMEGA_SEED_DEV_WALLETS")` is set. 2. **Pre-flight diagnostics:** Before minting, `cast call` **`hasRole(MINTER_ROLE, caller)`** on DOUB/CRED; on failure print actionable message (mismatched **`KEY_EVM_1`** vs **`PRIVATE_KEY`**, stale Anvil state, wrong **`DOUB`** address). 3. **Idempotent seed:** Skip mint when balance ≥ target threshold; optionally use **`grantRole`** only in deploy script, never from seed. 4. **E2E redeploy hygiene (optional):** Document or automate Anvil reset between full E2E runs if chain state causes duplicate-proxy confusion — secondary to minter alignment. Avoid: silently disabling seed on error without logging (hides misconfiguration). ## Acceptance criteria - [ ] **`bash scripts/e2e-anvil.sh`** completes (**build + 6 Playwright `anvil-arena-*` specs green**) **twice in a row** on the same machine without setting **`YIELDOMEGA_SEED_EVM_DEV_WALLETS=0`**, with default seed enabled. - [ ] **`bash scripts/seed-evm-dev-wallets-anvil.sh`** succeeds when run manually immediately after **`yieldomega_anvil_deploy_dev`** (from [`anvil_deploy_dev.sh`](scripts/lib/anvil_deploy_dev.sh)). - [ ] Re-running seed on already-seeded wallets does **not** exit non-zero (idempotent or no-op). - [ ] When **`KEY_EVM_1`** intentionally differs from deployer and cannot mint, script exits with a **clear error** naming env vars to fix (not opaque AccessControl hex). - [ ] Cloud-agent path: seed works when **`KEY_EVM_1..3`** are set to non-default secrets **iff** deploy grants minter to those addresses (document the contract). - [ ] Docs updated: [`e2e-anvil.md`](docs/testing/e2e-anvil.md) troubleshooting subsection for seed / minter mismatch. ## Test plan — functional paths | # | Path | Steps | Expected | |---|------|-------|----------| | 1 | Fresh Anvil | Start Anvil → `e2e-anvil.sh` once | Seed OK, 6 E2E pass | | 2 | Re-deploy same Anvil | Run `e2e-anvil.sh` again without manual `anvil` restart | Seed OK, 6 E2E pass | | 3 | Manual seed only | DeployDev via `anvil_deploy_dev.sh` → run `seed-evm-dev-wallets-anvil.sh` | ETH + DOUB + CRED (+ CL8Y) on **`ADDR_EVM_1..3`** | | 4 | Double seed | Run seed script twice | Second run succeeds | | 5 | Seed disabled | `YIELDOMEGA_SEED_EVM_DEV_WALLETS=0` → `e2e-anvil.sh` | E2E still passes (mock wallet) | | 6 | Mismatched keys | Set **`KEY_EVM_1`** ≠ deployer, no grant to that address | Fail with documented message (or pass only if grant extended) | | 7 | Kumbaya on | Default `YIELDOMEGA_DEPLOY_KUMBAYA=1` + seed | No regression in ETH buy E2E path | | 8 | Stack script | `start-local-anvil-stack.sh` (or documented subset) with default seed | Wallets funded for manual `/arena` | ## Test plan — attack, hack, and abuse vectors | Vector | Risk | Test / mitigation | |--------|------|-------------------| | **Granting `MINTER_ROLE` to extra dev addresses in `DeployDev`** | Dev deploy could mint unlimited DOUB/CRED on Anvil | Restrict grants to **chain id 31337 / allowlist** only; never ship extra grants in **`DeployProduction`**; code review + grep `grantRole` in production scripts | | **Seed script with attacker-controlled `DEPLOYER_PK`** | Stolen key mints on local Anvil only | Document that seed is **local-only**; do not run on public RPC; assert RPC host is loopback in script (optional hardening) | | **Using production `DOUB`/`CRED` addresses in env** | Mint on real tokens if roles exist | Seed script should refuse non-dev chain ids (mirror **`DevOnlyChainGuard`** or `cast chain-id` check) | | **Idempotent skip hides compromise** | Skipping mint when balance high could mask wrong token address | Verify **`DOUB`/`CRED`** addresses match latest deploy log; balance check uses correct contract | | **Logging private keys** | Leak in CI logs | Never echo **`KEY_EVM_*`** / **`DEPLOYER_PK`**; redact in error messages | | **Unlimited mint to dev wallets** | Inflated local state breaks economic tests | Cap mint amounts to documented QA values (existing constants); no change to production mint paths | ## Verification criteria - [ ] CI or agent log: two consecutive **`bash scripts/e2e-anvil.sh`** runs with **`Done.`** and **6 passed** each. - [ ] `cast call $DOUB "balanceOf(address)(uint256)" $ADDR_EVM_1` (and 2–3) shows expected balances after seed. - [ ] `cast call $DOUB "hasRole(bytes32,address)(bool)" $(cast call $DOUB "MINTER_ROLE()(bytes32)") $DEPLOYER_ADDR` is true for the seeding account. - [ ] No changes to production deploy scripts’ access control surface without separate security review. - [ ] Issue cross-link from closed verification notes on [#256](https://gitlab.com/PlasticDigits/yieldomega/-/issues/256) (optional comment). ## Labels `devops`, `testing`, `anvil`, `e2e`
PlasticDigits commented 2026-06-02 14:15:26 +00:00 (Migrated from gitlab.com)

mentioned in issue #256

mentioned in issue #256
ghost1 commented 2026-06-03 11:31:29 +00:00 (Migrated from gitlab.com)

mentioned in commit 707e48a704

mentioned in commit 707e48a704327e9d8773183ca4111ddcf7382cfa
PlasticDigits commented 2026-06-03 11:32:36 +00:00 (Migrated from gitlab.com)

mentioned in commit ec10a7acb5

mentioned in commit ec10a7acb500fa076dfd1953b8f7b836321250f5
PlasticDigits commented 2026-06-03 11:32:36 +00:00 (Migrated from gitlab.com)

mentioned in merge request !405

mentioned in merge request !405
PlasticDigits commented 2026-06-03 11:32:45 +00:00 (Migrated from gitlab.com)

Implementation complete (!405)

Idempotent Anvil dev-wallet seeding with minter identity aligned to DeployDev — addresses the AccessControlUnauthorizedAccount failure on consecutive E2E / re-deploy runs (#281).

What changed

Area Change
scripts/lib/anvil_deployer_key.sh New shared resolver: seed minter follows DEPLOYER_PK → PRIVATE_KEY → Anvil #0 (same as DeployDev.s.sol), not KEY_EVM_1
scripts/seed-evm-dev-wallets-anvil.sh Idempotent mint (skip when balance ≥ target), loopback RPC + dev chain-id guards, pre-flight MINTER_ROLE with actionable errors
scripts/lib/anvil_deploy_dev.sh Exports aligned PRIVATE_KEY; auto-sets YIELDOMEGA_SEED_MINTER_ADDRESS when seed minter ≠ deploy broadcaster
contracts/script/DeployDev.s.sol Grants extra MINTER_ROLE on DOUB + PlayCred for YIELDOMEGA_SEED_MINTER_ADDRESS (dev chains only)
scripts/verify-evm-dev-wallet-seed-anvil.sh Extended: double-seed, re-deploy on same Anvil, mismatched-key diagnostic
Docs INV-DEPLOY-281-*, e2e-anvil.md §281, AGENTS.md, guardrails + skills/ cross-links

Merge request: https://gitlab.com/PlasticDigits/yieldomega/-/merge_requests/35

Agent verification (pre-merge)

Item Command Result
Dev-wallet seed smoke bash scripts/verify-evm-dev-wallet-seed-anvil.sh PASS
Anvil E2E (consecutive run 1) bash scripts/e2e-anvil.sh PASS — 6/6 specs
Anvil E2E (consecutive run 2) bash scripts/e2e-anvil.sh PASS — 6/6 specs

QA verification checklist

  • bash scripts/verify-evm-dev-wallet-seed-anvil.sh — idempotent double-seed + re-deploy on same Anvil
  • Two consecutive bash scripts/e2e-anvil.sh runs with default seed (YIELDOMEGA_SEED_EVM_DEV_WALLETS=1) — 6 Playwright specs green each
  • Manual seed after deploy: yieldomega_anvil_deploy_dev → seed-evm-dev-wallets-anvil.sh — ETH + DOUB + CRED (+ CL8Y) on ADDR_EVM_1..3
  • Intentional mismatch: set DEPLOYER_PK to a key without MINTER_ROLE — script exits with clear MINTER_ROLE missing message (not opaque AccessControl hex)
  • Cloud path: non-default KEY_EVM_1..3 secrets with default PRIVATE_KEY — wallets funded, Rabby/manual QA balances OK
  • YIELDOMEGA_SEED_EVM_DEV_WALLETS=0 → E2E still passes (mock wallet path)

Request

Please verify the checklist above on a fresh Cloud VM or local Foundry setup. Leaving this issue open until QA confirms.

QA agent team: please run the verification checklist when convenient.

## Implementation complete (!405) Idempotent Anvil dev-wallet seeding with minter identity aligned to `DeployDev` — addresses the `AccessControlUnauthorizedAccount` failure on consecutive E2E / re-deploy runs ([#281](https://gitlab.com/PlasticDigits/yieldomega/-/issues/281)). ### What changed | Area | Change | |------|--------| | **`scripts/lib/anvil_deployer_key.sh`** | New shared resolver: seed minter follows `DEPLOYER_PK` → `PRIVATE_KEY` → Anvil #0 (same as `DeployDev.s.sol`), **not** `KEY_EVM_1` | | **`scripts/seed-evm-dev-wallets-anvil.sh`** | Idempotent mint (skip when balance ≥ target), loopback RPC + dev chain-id guards, pre-flight `MINTER_ROLE` with actionable errors | | **`scripts/lib/anvil_deploy_dev.sh`** | Exports aligned `PRIVATE_KEY`; auto-sets `YIELDOMEGA_SEED_MINTER_ADDRESS` when seed minter ≠ deploy broadcaster | | **`contracts/script/DeployDev.s.sol`** | Grants extra `MINTER_ROLE` on DOUB + PlayCred for `YIELDOMEGA_SEED_MINTER_ADDRESS` (dev chains only) | | **`scripts/verify-evm-dev-wallet-seed-anvil.sh`** | Extended: double-seed, re-deploy on same Anvil, mismatched-key diagnostic | | **Docs** | `INV-DEPLOY-281-*`, [e2e-anvil.md §281](docs/testing/e2e-anvil.md#anvil-dev-wallet-seed-gitlab-281), AGENTS.md, guardrails + `skills/` cross-links | Merge request: https://gitlab.com/PlasticDigits/yieldomega/-/merge_requests/35 ### Agent verification (pre-merge) | Item | Command | Result | |------|---------|--------| | Dev-wallet seed smoke | `bash scripts/verify-evm-dev-wallet-seed-anvil.sh` | **PASS** | | Anvil E2E (consecutive run 1) | `bash scripts/e2e-anvil.sh` | **PASS** — 6/6 specs | | Anvil E2E (consecutive run 2) | `bash scripts/e2e-anvil.sh` | **PASS** — 6/6 specs | ### QA verification checklist - [ ] `bash scripts/verify-evm-dev-wallet-seed-anvil.sh` — idempotent double-seed + re-deploy on same Anvil - [ ] Two consecutive `bash scripts/e2e-anvil.sh` runs with default seed (`YIELDOMEGA_SEED_EVM_DEV_WALLETS=1`) — 6 Playwright specs green each - [ ] Manual seed after deploy: `yieldomega_anvil_deploy_dev` → `seed-evm-dev-wallets-anvil.sh` — ETH + DOUB + CRED (+ CL8Y) on `ADDR_EVM_1..3` - [ ] Intentional mismatch: set `DEPLOYER_PK` to a key without `MINTER_ROLE` — script exits with clear `MINTER_ROLE missing` message (not opaque AccessControl hex) - [ ] Cloud path: non-default `KEY_EVM_1..3` secrets with default `PRIVATE_KEY` — wallets funded, Rabby/manual QA balances OK - [ ] `YIELDOMEGA_SEED_EVM_DEV_WALLETS=0` → E2E still passes (mock wallet path) ### Request Please verify the checklist above on a fresh Cloud VM or local Foundry setup. Leaving this issue **open** until QA confirms. --- QA agent team: please run the verification checklist when convenient.
ghost1 commented 2026-06-03 11:41:50 +00:00 (Migrated from gitlab.com)

mentioned in commit 7f2cce9383

mentioned in commit 7f2cce93839962de73d36858cbb1a1ca26c21e05
PlasticDigits commented 2026-06-03 11:42:05 +00:00 (Migrated from gitlab.com)

mentioned in issue #279

mentioned in issue #279
ghost1 commented 2026-06-03 12:16:34 +00:00 (Migrated from gitlab.com)

mentioned in merge request !406

mentioned in merge request !406
ghost1 commented 2026-06-03 13:25:47 +00:00 (Migrated from gitlab.com)

mentioned in commit 356c93ed20

mentioned in commit 356c93ed2098d979ae8f9a65f4522c85447a2a60
PlasticDigits commented 2026-06-03 13:35:16 +00:00 (Migrated from gitlab.com)

mentioned in merge request !413

mentioned in merge request !413
PlasticDigits commented 2026-06-03 13:39:34 +00:00 (Migrated from gitlab.com)

mentioned in merge request !415

mentioned in merge request !415
PlasticDigits commented 2026-06-03 13:43:01 +00:00 (Migrated from gitlab.com)

mentioned in issue #287

mentioned in issue #287
PlasticDigits commented 2026-06-03 13:43:02 +00:00 (Migrated from gitlab.com)

mentioned in issue #289

mentioned in issue #289
PlasticDigits commented 2026-06-03 13:43:56 +00:00 (Migrated from gitlab.com)

mentioned in commit 8cca0afba2

mentioned in commit 8cca0afba2e64e704a308bba816e6b2b5c37ab22
PlasticDigits commented 2026-06-05 08:11:14 +00:00 (Migrated from gitlab.com)

Implementation verification complete (post-merge !405)

Verified on Cloud Agent VM (cursor/gitlab-issue-workflow-eca8 @ main after MR !405 merge). All acceptance criteria PASS.

Acceptance criteria

Criterion Command / step Result
Two consecutive e2e-anvil.sh with default seed bash scripts/e2e-anvil.sh × 2 PASS — 6/6 Playwright specs each, Done.
Manual seed after deploy Covered by verify-evm-dev-wallet-seed-anvil.sh (deploy → seed → balance asserts) PASS
Double-seed idempotency verify-evm-dev-wallet-seed-anvil.sh double-seed step PASS — skip mint when balance ≥ target
Re-deploy on same Anvil verify-evm-dev-wallet-seed-anvil.sh second DeployDev broadcast PASS — new DOUB/CRED proxies, wallets re-seeded
Mismatched key diagnostic verify-evm-dev-wallet-seed-anvil.sh mismatched DEPLOYER_PK PASS — exits with MINTER_ROLE missing (not opaque AccessControl hex)
Cloud path contract documented e2e-anvil.md § dev-wallet seed + INV-DEPLOY-281-* PASS — minter = DEPLOYER_PK → PRIVATE_KEY → Anvil #0; extra grant via YIELDOMEGA_SEED_MINTER_ADDRESS
Docs troubleshooting docs/testing/e2e-anvil.md#anvil-dev-wallet-seed-gitlab-281 PASS
Seed disabled E2E YIELDOMEGA_SEED_EVM_DEV_WALLETS=0 bash scripts/e2e-anvil.sh PASS — 6/6 specs (mock wallet path)
Kumbaya + seed (default) Default YIELDOMEGA_DEPLOY_KUMBAYA=1 in e2e-anvil.sh PASS — ETH buy spec green

Verification commands (logs)

bash scripts/verify-evm-dev-wallet-seed-anvil.sh  → PASS
bash scripts/e2e-anvil.sh                         → 6 passed, Done.
bash scripts/e2e-anvil.sh                         → 6 passed, Done.
YIELDOMEGA_SEED_EVM_DEV_WALLETS=0 bash scripts/e2e-anvil.sh → 6 passed, Done.

What shipped (!405)

  • scripts/lib/anvil_deployer_key.sh — minter PK aligned with DeployDev.s.sol (PRIVATE_KEY / Anvil #0, not KEY_EVM_1)
  • scripts/seed-evm-dev-wallets-anvil.sh — idempotent mint, loopback + dev chain guards, pre-flight MINTER_ROLE errors
  • DeployDev.s.sol — optional YIELDOMEGA_SEED_MINTER_ADDRESS extra minter grant (dev chains only)
  • scripts/verify-evm-dev-wallet-seed-anvil.sh — smoke for double-seed, re-deploy, mismatched-key diagnostic

Closing — no further code changes required on this branch.

## Implementation verification complete (post-merge !405) Verified on Cloud Agent VM (`cursor/gitlab-issue-workflow-eca8` @ `main` after MR !405 merge). All acceptance criteria **PASS**. ### Acceptance criteria | Criterion | Command / step | Result | |-----------|----------------|--------| | Two consecutive `e2e-anvil.sh` with default seed | `bash scripts/e2e-anvil.sh` × 2 | **PASS** — 6/6 Playwright specs each, `Done.` | | Manual seed after deploy | Covered by `verify-evm-dev-wallet-seed-anvil.sh` (deploy → seed → balance asserts) | **PASS** | | Double-seed idempotency | `verify-evm-dev-wallet-seed-anvil.sh` double-seed step | **PASS** — skip mint when balance ≥ target | | Re-deploy on same Anvil | `verify-evm-dev-wallet-seed-anvil.sh` second DeployDev broadcast | **PASS** — new DOUB/CRED proxies, wallets re-seeded | | Mismatched key diagnostic | `verify-evm-dev-wallet-seed-anvil.sh` mismatched `DEPLOYER_PK` | **PASS** — exits with `MINTER_ROLE missing` (not opaque AccessControl hex) | | Cloud path contract documented | `e2e-anvil.md` § dev-wallet seed + `INV-DEPLOY-281-*` | **PASS** — minter = `DEPLOYER_PK` → `PRIVATE_KEY` → Anvil #0; extra grant via `YIELDOMEGA_SEED_MINTER_ADDRESS` | | Docs troubleshooting | `docs/testing/e2e-anvil.md#anvil-dev-wallet-seed-gitlab-281` | **PASS** | | Seed disabled E2E | `YIELDOMEGA_SEED_EVM_DEV_WALLETS=0 bash scripts/e2e-anvil.sh` | **PASS** — 6/6 specs (mock wallet path) | | Kumbaya + seed (default) | Default `YIELDOMEGA_DEPLOY_KUMBAYA=1` in `e2e-anvil.sh` | **PASS** — ETH buy spec green | ### Verification commands (logs) ```text bash scripts/verify-evm-dev-wallet-seed-anvil.sh → PASS bash scripts/e2e-anvil.sh → 6 passed, Done. bash scripts/e2e-anvil.sh → 6 passed, Done. YIELDOMEGA_SEED_EVM_DEV_WALLETS=0 bash scripts/e2e-anvil.sh → 6 passed, Done. ``` ### What shipped (!405) - `scripts/lib/anvil_deployer_key.sh` — minter PK aligned with `DeployDev.s.sol` (`PRIVATE_KEY` / Anvil #0, not `KEY_EVM_1`) - `scripts/seed-evm-dev-wallets-anvil.sh` — idempotent mint, loopback + dev chain guards, pre-flight `MINTER_ROLE` errors - `DeployDev.s.sol` — optional `YIELDOMEGA_SEED_MINTER_ADDRESS` extra minter grant (dev chains only) - `scripts/verify-evm-dev-wallet-seed-anvil.sh` — smoke for double-seed, re-deploy, mismatched-key diagnostic Closing — no further code changes required on this branch.
PlasticDigits (Migrated from gitlab.com) closed this issue 2026-06-05 08:11:23 +00:00
PlasticDigits commented 2026-06-08 08:45:13 +00:00 (Migrated from gitlab.com)

mentioned in commit 9ecde04ecb

mentioned in commit 9ecde04ecbc999c08ab0c416220733ef9342685a
PlasticDigits commented 2026-06-08 08:45:13 +00:00 (Migrated from gitlab.com)

mentioned in commit 748782130c

mentioned in commit 748782130c8034b41b019f218c6f88f64b0bf4a5
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
cac-design-issue-544
renovate/configure
No results found.
Labels
Clear labels   
agent:fix_bugfix

   
agent:fix_conflicts

   
agent:fix_security

   
agent:gap_analysis

   
agent:implement

   
agent:open_issues

   
agents

   
agent:security_audit

   
agent:verify
  
area
timecurve

  
arena

   
arena-v2

   
audit

   
block:feature_review

   
block:security

   
bug

   
contracts

   
design

   
devops

   
docs
Documentation

  
documentation

   
enhancement

   
epic
Epic / umbrella issue

  
feature

   
frontend

   
indexer

   
low priority
Low priority, investigate other issues first

  
megaeth

   
operations

   
ops
Deploy and operations

  
performance

   
QA

   
qa checklist

   
referrals

   
removal
Legacy removal

  
security

   
smart-contracts

   
tech-debt

   
testing

   
time-arena
TimeArena v2 revamp

  
timecurve

   
visual-qa
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:open_issues
agents
agent:security_audit
agent:verify
area
timecurve
arena
arena-v2
audit
block:feature_review
block:security
bug
contracts
design
devops
docs
documentation
enhancement
epic
feature
frontend
indexer
low priority
megaeth
operations
ops
performance
QA
qa checklist
referrals
removal
security
smart-contracts
tech-debt
testing
time-arena
timecurve
visual-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/yieldomega#281
No description provided.