Link issue 297 guardrails #438

Merged

PlasticDigits merged 1 commit from cursor/issue-297-art-motion-audio into main 2026-06-07 09:44:34 +00:00

Conversation 3 Commits 1 Files changed 1 +1

PlasticDigits commented 2026-06-07 09:44:18 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Summary

Related issues

Layers touched

Check every layer this MR modifies (delete unchecked lines):

• contracts (contracts/)
• indexer (indexer/)
• frontend (frontend/)
• scripts / devops (scripts/, .cursor/, CI)
• docs only (no runtime behavior change)
• bots (bots/)

Verification

For each touched layer, add one row: item → command → PASS / FAIL / SKIP.

Use the smallest check that proves the change — do not require Docker, Postgres, or Vite unless this MR touches those layers. Command reference: AGENTS.md § Cloud agent verification · docs/testing/ci.md.

Layer	Command	Result

Common commands (copy rows as needed):

Layer	Command
contracts	cd contracts && forge test
contracts (static)	Slither workflow / local slither (high-severity gate)
indexer	cd indexer && cargo clippy --all-targets -- -D warnings && cargo test
indexer + arena	bash scripts/verify-wallet-profile-anvil.sh
frontend	cd frontend && npm run typecheck && npm run lint && npm test
Anvil deploy / KEY_EVM_* / seed	bash scripts/verify-evm-dev-wallet-seed-anvil.sh (must PASS, not SKIP)
Postgres (Cloud VM)	bash scripts/verify-cloud-postgres.sh
Docker (full stack only)	bash scripts/verify-docker-cloud-agent.sh
Playwright Anvil E2E	bash scripts/e2e-anvil.sh
Doc gates	bash scripts/check-doc-anchors.sh (+ retired-term / arena-naming scripts if docs touched)

Licensing & compliance

• New or changed original files remain AGPL-3.0 (or exception is called out below).
• No incompatible third-party code added without NOTICE / maintainer approval.
• Network-facing changes (indexer API, deployed frontend) — Corresponding Source / AGPL obligations considered (docs/licensing.md).

Notes for reviewers

Author checklist

• Diff is scoped to the stated problem (no drive-by refactors).
• Arena v2 guardrails respected when touching product code (.cursor/skills/yieldomega-guardrails/SKILL.md).
• Dev keys are Anvil-only; no secrets committed (scripts/lib/evm_dev_keys.sh).

## Summary <!-- What changed, why, and how reviewers should think about risk (user-visible vs internal). --> ## Related issues <!-- Closes #NNN · Related to #NNN · none --> ## Layers touched Check every layer this MR modifies (delete unchecked lines): - [ ] **contracts** (`contracts/`) - [ ] **indexer** (`indexer/`) - [ ] **frontend** (`frontend/`) - [ ] **scripts / devops** (`scripts/`, `.cursor/`, CI) - [ ] **docs only** (no runtime behavior change) - [ ] **bots** (`bots/`) ## Verification For **each touched layer**, add one row: *item → command → PASS / FAIL / SKIP*. Use the **smallest** check that proves the change — do not require Docker, Postgres, or Vite unless this MR touches those layers. Command reference: [`AGENTS.md` § Cloud agent verification](../../AGENTS.md#cloud-agent-verification-when-to-run-what) · [`docs/testing/ci.md`](../../docs/testing/ci.md). | Layer | Command | Result | |-------|---------|--------| | | | | **Common commands (copy rows as needed):** | Layer | Command | |-------|---------| | contracts | `cd contracts && forge test` | | contracts (static) | Slither workflow / local `slither` (high-severity gate) | | indexer | `cd indexer && cargo clippy --all-targets -- -D warnings && cargo test` | | indexer + arena | `bash scripts/verify-wallet-profile-anvil.sh` | | frontend | `cd frontend && npm run typecheck && npm run lint && npm test` | | Anvil deploy / `KEY_EVM_*` / seed | `bash scripts/verify-evm-dev-wallet-seed-anvil.sh` (**must PASS**, not SKIP) | | Postgres (Cloud VM) | `bash scripts/verify-cloud-postgres.sh` | | Docker (full stack only) | `bash scripts/verify-docker-cloud-agent.sh` | | Playwright Anvil E2E | `bash scripts/e2e-anvil.sh` | | Doc gates | `bash scripts/check-doc-anchors.sh` (+ retired-term / arena-naming scripts if docs touched) | ## Licensing & compliance - [ ] New or changed **original** files remain **AGPL-3.0** (or exception is called out below). - [ ] No incompatible third-party code added without `NOTICE` / maintainer approval. - [ ] **Network-facing** changes (indexer API, deployed frontend) — Corresponding Source / AGPL obligations considered ([`docs/licensing.md`](../../docs/licensing.md)). <!-- Licensing exceptions or AGPL notes for reviewers: --> ## Notes for reviewers <!-- Breaking changes, deploy/migration steps, invariant IDs (INV-*), manual Rabby QA, screenshots. --> ## Author checklist - [ ] Diff is scoped to the stated problem (no drive-by refactors). - [ ] Arena v2 guardrails respected when touching product code ([`.cursor/skills/yieldomega-guardrails/SKILL.md`](../../.cursor/skills/yieldomega-guardrails/SKILL.md)). - [ ] Dev keys are **Anvil-only**; no secrets committed ([`scripts/lib/evm_dev_keys.sh`](../../scripts/lib/evm_dev_keys.sh)).

PlasticDigits commented 2026-06-07 09:44:35 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit 1485cb6811

mentioned in commit 1485cb68111ef935cb43950e9741908b7001a793

PlasticDigits (Migrated from gitlab.com) merged commit 1485cb6811 into main 2026-06-07 09:44:35 +00:00

ghost1 commented 2026-06-07 09:46:54 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review (automated)

Commit reviewed: 047ef4d70e18cf26095cbf952167ed274de6adbb
Scope: .cursor/skills/yieldomega-guardrails/SKILL.md — single added guardrail item (9e) linking issue #297 art/motion/audio invariants and QA references for agent contributors.

Method: Inspected MR diff and traced whether the change introduces attacker-controlled input paths, authn/authz boundaries, secret exposure, injection sinks, or other runtime security surface. Prior MR discussions contained no prior security-review threads to re-validate.

Outcome: FINDINGS: 0 (no medium, high, or critical issues on this diff).

Rationale: The change is documentation-only (Cursor agent skill / contributor guardrails). It adds cross-links to existing design docs, manual QA checklists, and already-documented verification commands (check-art-readme-consumers.sh, frontend typecheck/lint/tests). No contracts, indexer, frontend runtime code, scripts, secrets, or network-facing behavior is modified. No new dependencies or executable logic are introduced.

Inline threads: None (no findings requiring line-level comments).

## Security review (automated) **Commit reviewed:** `047ef4d70e18cf26095cbf952167ed274de6adbb` **Scope:** `.cursor/skills/yieldomega-guardrails/SKILL.md` — single added guardrail item (9e) linking issue #297 art/motion/audio invariants and QA references for agent contributors. **Method:** Inspected MR diff and traced whether the change introduces attacker-controlled input paths, authn/authz boundaries, secret exposure, injection sinks, or other runtime security surface. Prior MR discussions contained no prior security-review threads to re-validate. **Outcome:** **FINDINGS: 0** (no medium, high, or critical issues on this diff). **Rationale:** The change is documentation-only (Cursor agent skill / contributor guardrails). It adds cross-links to existing design docs, manual QA checklists, and already-documented verification commands (`check-art-readme-consumers.sh`, frontend typecheck/lint/tests). No contracts, indexer, frontend runtime code, scripts, secrets, or network-facing behavior is modified. No new dependencies or executable logic are introduced. **Inline threads:** None (no findings requiring line-level comments).

PlasticDigits commented 2026-06-08 08:45:13 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit 045c0beb78

mentioned in commit 045c0beb78ee8a7e63dd5e3033fa207d6c9b9c38

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:open_issues

  

agents

  

agent:security_audit

  

agent:verify

  

area

timecurve

  

arena

  

arena-v2

  

audit

  

block:feature_review

  

block:security

  

bug

  

contracts

  

design

  

devops

  

docs

Documentation

  

documentation

  

enhancement

  

epic

Epic / umbrella issue

  

feature

  

frontend

  

indexer

  

low priority

Low priority, investigate other issues first

  

megaeth

  

operations

  

ops

Deploy and operations

  

performance

  

QA

  

qa checklist

  

referrals

  

removal

Legacy removal

  

security

  

smart-contracts

  

tech-debt

  

testing

  

time-arena

TimeArena v2 revamp

  

timecurve

  

visual-qa

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:open_issues

agents

agent:security_audit

agent:verify

area

timecurve

arena

arena-v2

audit

block:feature_review

block:security

bug

contracts

design

devops

docs

documentation

enhancement

epic

feature

frontend

indexer

low priority

megaeth

operations

ops

performance

QA

qa checklist

referrals

removal

security

smart-contracts

tech-debt

testing

time-arena

timecurve

visual-qa

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!438

No description provided.