Extract shared verify script helpers and remove legacy TimeCurve script (#324) #471

Merged

PlasticDigits merged 2 commits from issue-324-verify-script-helpers into main 2026-06-14 02:34:18 +00:00

Conversation 8 Commits 2 Files changed 17 +418 -687

PlasticDigits commented 2026-06-13 13:11:21 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Summary

Extracts shared Anvil/indexer bootstrap helpers for indexer-backed verify scripts (#324, follow-up from #309).

• Adds scripts/lib/verify_anvil_common.sh (port-scoped cleanup, Anvil spawn, anvil_send, cooldown warp, guarded PID kill) and scripts/lib/verify_indexer_stack.sh (DeployDev export, registry JSON, Postgres reset, indexer build/start, /v1/status wait).
• Refactors 6 heavy verify scripts to source the shared stack lib (~500 net lines removed).
• Deletes legacy v1 verify-timecurve-post-end-gates-anvil.sh (Arena v2 incompatible); updates anvil_rich_state.sh message.
• Fixes doc dead links: removes missing anvil-collection.spec.ts reference, adds #pay-modes anchor, fixes arena-views.md relative paths, retargets broken manual-QA arena-views anchors; extends check-doc-anchors.sh for arena-views.
• Pre-builds indexer (cargo build --release) before background start so cold-compile VMs pass status wait.
• Fixes stale arena_wallet_stats_two_epochs_and_bonus_fields WarBow BP expectation (1000 cumulative across Last Buy epochs without WarBow roll — matches on-chain battlePoints semantics).

Acceptance checklist

Criterion	Command / step	Result
Shared libs used by ≥5 verify scripts	bash scripts/test-verify-anvil-lib.sh	PASS (6 scripts)
Legacy TimeCurve post-end script removed	test-verify-anvil-lib.sh + rg verify-timecurve-post-end (excl. audits/history)	PASS
e2e-anvil.md links only existing spec files	manual review + removed anvil-collection.spec.ts line	PASS
verify-podium-live-anvil.sh still PASS	bash scripts/verify-podium-live-anvil.sh	PASS
verify-wallet-profile-anvil.sh regression	bash scripts/verify-wallet-profile-anvil.sh	PASS
verify-evm-dev-wallet-seed-anvil.sh regression	bash scripts/verify-evm-dev-wallet-seed-anvil.sh	PASS
Doc anchors	bash scripts/check-doc-anchors.sh	PASS
Hermetic lib smoke	bash scripts/test-verify-anvil-lib.sh	PASS

Verification for third parties

bash scripts/test-verify-anvil-lib.sh
bash scripts/check-doc-anchors.sh
export PATH="$HOME/.foundry/bin:$HOME/.cargo/bin:$PATH"
bash scripts/bootstrap-cloud-postgres-native.sh   # if needed
bash scripts/verify-podium-live-anvil.sh
bash scripts/verify-wallet-profile-anvil.sh
bash scripts/verify-evm-dev-wallet-seed-anvil.sh

Confirm scripts/lib/verify_anvil_common.sh uses port-scoped pkill -f "anvil.*${port}" only (not bare pkill anvil).

Follow-ups

• Refactor remaining indexer verify scripts (verify-podium-timers-anvil.sh, verify-cred-buy-anvil.sh, …) onto the shared libs when touched next.

---

Note

Low Risk
Mostly script/docs/test refactors with no production runtime changes; verify scripts remain local/manual and behavior is guarded by hermetic smoke tests.

Overview
Introduces scripts/lib/verify_anvil_common.sh and verify_indexer_stack.sh with yieldomega_verify_boot_indexer_stack (port-scoped Anvil cleanup, DeployDev, registry JSON including AdminSellVault, Postgres reset, cargo build --release before indexer start, /v1/status wait). Six verify-*-anvil.sh scripts now source the stack instead of duplicating bootstrap (~500 lines removed).

Removes v1 verify-timecurve-post-end-gates-anvil.sh and updates anvil_rich_state.sh / e2e-anvil.md to note Arena v2 incompatibility. Adds scripts/test-verify-anvil-lib.sh (hermetic smoke: port-scoped pkill, ≥5 consumers, no legacy script).

Docs: fixes arena-views.md paths under frontend/, adds #pay-modes, trims dead E2E/collection references and broken manual-QA arena-views anchors; check-doc-anchors.sh also validates arena-views.md links.

Indexer: arena_wallet_stats_two_epochs_and_bonus_fields expects warbow_battle_points 1000 (was 750) to match cumulative Last Buy BP without a WarBow roll.

^{Reviewed by Cursor Bugbot for commit 4034dfd957. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Extracts shared Anvil/indexer bootstrap helpers for indexer-backed verify scripts ([#324](https://gitlab.com/PlasticDigits/yieldomega/-/issues/324), follow-up from [#309](https://gitlab.com/PlasticDigits/yieldomega/-/issues/309)). - Adds `scripts/lib/verify_anvil_common.sh` (port-scoped cleanup, Anvil spawn, `anvil_send`, cooldown warp, guarded PID kill) and `scripts/lib/verify_indexer_stack.sh` (DeployDev export, registry JSON, Postgres reset, indexer build/start, `/v1/status` wait). - Refactors **6** heavy verify scripts to source the shared stack lib (~500 net lines removed). - Deletes legacy v1 `verify-timecurve-post-end-gates-anvil.sh` (Arena v2 incompatible); updates `anvil_rich_state.sh` message. - Fixes doc dead links: removes missing `anvil-collection.spec.ts` reference, adds `#pay-modes` anchor, fixes `arena-views.md` relative paths, retargets broken manual-QA arena-views anchors; extends `check-doc-anchors.sh` for arena-views. - Pre-builds indexer (`cargo build --release`) before background start so cold-compile VMs pass status wait. - Fixes stale `arena_wallet_stats_two_epochs_and_bonus_fields` WarBow BP expectation (`1000` cumulative across Last Buy epochs without WarBow roll — matches on-chain `battlePoints` semantics). ## Acceptance checklist | Criterion | Command / step | Result | |-----------|----------------|--------| | Shared libs used by ≥5 verify scripts | `bash scripts/test-verify-anvil-lib.sh` | **PASS** (6 scripts) | | Legacy TimeCurve post-end script removed | `test-verify-anvil-lib.sh` + `rg verify-timecurve-post-end` (excl. audits/history) | **PASS** | | `e2e-anvil.md` links only existing spec files | manual review + removed `anvil-collection.spec.ts` line | **PASS** | | `verify-podium-live-anvil.sh` still PASS | `bash scripts/verify-podium-live-anvil.sh` | **PASS** | | `verify-wallet-profile-anvil.sh` regression | `bash scripts/verify-wallet-profile-anvil.sh` | **PASS** | | `verify-evm-dev-wallet-seed-anvil.sh` regression | `bash scripts/verify-evm-dev-wallet-seed-anvil.sh` | **PASS** | | Doc anchors | `bash scripts/check-doc-anchors.sh` | **PASS** | | Hermetic lib smoke | `bash scripts/test-verify-anvil-lib.sh` | **PASS** | ## Verification for third parties ```bash bash scripts/test-verify-anvil-lib.sh bash scripts/check-doc-anchors.sh export PATH="$HOME/.foundry/bin:$HOME/.cargo/bin:$PATH" bash scripts/bootstrap-cloud-postgres-native.sh # if needed bash scripts/verify-podium-live-anvil.sh bash scripts/verify-wallet-profile-anvil.sh bash scripts/verify-evm-dev-wallet-seed-anvil.sh ``` Confirm `scripts/lib/verify_anvil_common.sh` uses **port-scoped** `pkill -f "anvil.*${port}"` only (not bare `pkill anvil`). ## Follow-ups - Refactor remaining indexer verify scripts (`verify-podium-timers-anvil.sh`, `verify-cred-buy-anvil.sh`, …) onto the shared libs when touched next. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Mostly script/docs/test refactors with no production runtime changes; verify scripts remain local/manual and behavior is guarded by hermetic smoke tests. > > **Overview** > Introduces **`scripts/lib/verify_anvil_common.sh`** and **`verify_indexer_stack.sh`** with **`yieldomega_verify_boot_indexer_stack`** (port-scoped Anvil cleanup, DeployDev, registry JSON including **AdminSellVault**, Postgres reset, **`cargo build --release`** before indexer start, `/v1/status` wait). **Six** `verify-*-anvil.sh` scripts now source the stack instead of duplicating bootstrap (~500 lines removed). > > **Removes** v1 **`verify-timecurve-post-end-gates-anvil.sh`** and updates **`anvil_rich_state.sh`** / **`e2e-anvil.md`** to note Arena v2 incompatibility. Adds **`scripts/test-verify-anvil-lib.sh`** (hermetic smoke: port-scoped `pkill`, ≥5 consumers, no legacy script). > > **Docs:** fixes **`arena-views.md`** paths under `frontend/`, adds **`#pay-modes`**, trims dead E2E/collection references and broken manual-QA **`arena-views`** anchors; **`check-doc-anchors.sh`** also validates **`arena-views.md`** links. > > **Indexer:** **`arena_wallet_stats_two_epochs_and_bonus_fields`** expects **`warbow_battle_points` `1000`** (was `750`) to match cumulative Last Buy BP without a WarBow roll. > > ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4034dfd9571aa505dac250696e1a3fe262fb6344. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).} <!-- /CURSOR_SUMMARY -->

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:11:31 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:11:39 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

PlasticDigits commented 2026-06-13 13:13:15 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !471

Commit reviewed: c543a83d7397369a866e349c8b04bc7e2b24ec83
Scope: scripts/lib/verify_anvil_common.sh, scripts/lib/verify_indexer_stack.sh, refactored verify-*-anvil.sh scripts, deleted verify-timecurve-post-end-gates-anvil.sh, doc/anchor updates, integration_stage2 WarBow BP assertion (750 → 1000), anvil_rich_state.sh message.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Method

• Traced attacker-controlled inputs (ANVIL_PORT, DATABASE_URL, PORT, PG_URL, optional db_name args) through new shared helpers to sinks (pkill, psql -c, cast send, curl, file writes).
• Compared refactored behavior to pre-MR inline bootstrap in the six verify scripts (no new production/indexer/contract auth surfaces).
• Checked for injection (SQL/shell), SSRF, secret leakage, permission-boundary regressions, and EVM/on-chain logic changes (none beyond a dev-script echo).

Notes (below medium threshold)

Area	Assessment
yieldomega_verify_pg_reset_* SQL string interpolation	Pre-existing local-dev pattern; callers pass only default DB names via PG_URL. No remote input path; requires running verify scripts locally with attacker-controlled env — out of production threat model.
pkill -f 'yieldomega-indexer'	Unchanged from prior verify scripts / stack bootstrap; local dev-only process cleanup, not a cross-tenant boundary.
Port-scoped pkill -f "anvil.*${port}"	Improvement vs bare pkill anvil; test-verify-anvil-lib.sh enforces this.
yieldomega_verify_kill_pid_if_set	Numeric PID guard is a hardening improvement.
Deleted TimeCurve verify script	Removed hardcoded Anvil dev keys from an active script path (keys remain public Anvil defaults elsewhere).
Indexer/listener binding	Still 127.0.0.1 only — unchanged intent.

No inline threads (no medium+ items). No block:security label applied.

## Security review — MR !471 **Commit reviewed:** `c543a83d7397369a866e349c8b04bc7e2b24ec83` **Scope:** `scripts/lib/verify_anvil_common.sh`, `scripts/lib/verify_indexer_stack.sh`, refactored `verify-*-anvil.sh` scripts, deleted `verify-timecurve-post-end-gates-anvil.sh`, doc/anchor updates, `integration_stage2` WarBow BP assertion (`750` → `1000`), `anvil_rich_state.sh` message. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. ### Method - Traced attacker-controlled inputs (`ANVIL_PORT`, `DATABASE_URL`, `PORT`, `PG_URL`, optional `db_name` args) through new shared helpers to sinks (`pkill`, `psql -c`, `cast send`, `curl`, file writes). - Compared refactored behavior to pre-MR inline bootstrap in the six verify scripts (no new production/indexer/contract auth surfaces). - Checked for injection (SQL/shell), SSRF, secret leakage, permission-boundary regressions, and EVM/on-chain logic changes (none beyond a dev-script echo). ### Notes (below medium threshold) | Area | Assessment | |------|------------| | `yieldomega_verify_pg_reset_*` SQL string interpolation | Pre-existing local-dev pattern; callers pass only default DB names via `PG_URL`. No remote input path; requires running verify scripts locally with attacker-controlled env — out of production threat model. | | `pkill -f 'yieldomega-indexer'` | Unchanged from prior verify scripts / stack bootstrap; local dev-only process cleanup, not a cross-tenant boundary. | | Port-scoped `pkill -f "anvil.*${port}"` | Improvement vs bare `pkill anvil`; `test-verify-anvil-lib.sh` enforces this. | | `yieldomega_verify_kill_pid_if_set` | Numeric PID guard is a hardening improvement. | | Deleted TimeCurve verify script | Removed hardcoded Anvil dev keys from an active script path (keys remain public Anvil defaults elsewhere). | | Indexer/listener binding | Still `127.0.0.1` only — unchanged intent. | No inline threads (no medium+ items). No `block:security` label applied.

PlasticDigits commented 2026-06-13 14:13:14 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

added 31 commits

• c543a83d...8dd57052 - 30 commits from branch main
• 4034dfd9 - Merge origin/main into issue-324-verify-script-helpers

Compare with previous version

added 31 commits <ul><li>c543a83d...8dd57052 - 30 commits from branch <code>main</code></li><li>4034dfd9 - Merge origin/main into issue-324-verify-script-helpers</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/101/diffs?diff_id=1850345484&start_sha=c543a83d7397369a866e349c8b04bc7e2b24ec83)

PlasticDigits commented 2026-06-13 14:13:17 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Resolved merge conflicts with main by keeping the shared verify_indexer_stack.sh bootstrap path across all seven conflicted verify scripts (verify-donate-pools, verify-indexer-rpc-metrics, verify-last-buy-epoch, verify-podium-live, verify-podium-prize-preview, verify-vault-funding, verify-wallet-profile).

Integrated main's Multicall3 ensure (#307) into yieldomega_verify_boot_indexer_stack so chain-timer scripts no longer need inline Anvil/indexer bootstrap. Hermetic smoke: test-verify-anvil-lib.sh and check-doc-anchors.sh PASS.

Resolved merge conflicts with `main` by keeping the shared `verify_indexer_stack.sh` bootstrap path across all seven conflicted verify scripts (`verify-donate-pools`, `verify-indexer-rpc-metrics`, `verify-last-buy-epoch`, `verify-podium-live`, `verify-podium-prize-preview`, `verify-vault-funding`, `verify-wallet-profile`). Integrated `main`'s Multicall3 ensure (#307) into `yieldomega_verify_boot_indexer_stack` so chain-timer scripts no longer need inline Anvil/indexer bootstrap. Hermetic smoke: `test-verify-anvil-lib.sh` and `check-doc-anchors.sh` PASS.

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 14:13:32 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

PlasticDigits commented 2026-06-13 14:15:28 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !471

Commit reviewed: 4034dfd9571aa505dac250696e1a3fe262fb6344
Scope: scripts/lib/verify_anvil_common.sh, scripts/lib/verify_indexer_stack.sh (incl. Multicall3 ensure from #307), refactored verify-*-anvil.sh scripts (7 consumers post-merge), deleted verify-timecurve-post-end-gates-anvil.sh, doc/anchor updates, integration_stage2 WarBow BP assertion (750 → 1000), anvil_rich_state.sh message.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Method

• Re-reviewed after origin/main merge (4034dfd9); prior review on c543a83d superseded for merge-conflict integration (Multicall3 in yieldomega_verify_boot_indexer_stack, seven script consumers).
• Traced attacker-controlled inputs (ANVIL_PORT, INDEXER_PORT, DATABASE_URL, PG_URL, optional db_name args) through shared helpers to sinks (pkill, psql -c, cast send/cast publish, curl, registry file writes).
• Compared refactored behavior to pre-MR inline bootstrap; confirmed no new production/indexer auth surfaces, contract logic, or off-network listeners.
• Checked injection (SQL/shell), SSRF, secret leakage, permission-boundary regressions, supply-chain (Multicall3 pre-signed deploy tx), and EVM risks.

Notes (below medium threshold)

Area	Assessment
yieldomega_verify_pg_reset_* SQL string interpolation	Pre-existing local-dev pattern; callers pass only default DB names. No remote/untrusted input path.
pkill -f 'yieldomega-indexer'	Unchanged local-dev cleanup; not a cross-tenant production boundary.
Port-scoped pkill -f "anvil.*${port}"	Improvement vs bare pkill anvil; enforced by test-verify-anvil-lib.sh.
yieldomega_verify_kill_pid_if_set	Numeric PID guard is a hardening improvement.
Multicall3 ensure in boot stack	Canonical address + known mds1/multicall bytecode; local Anvil only.
Indexer LISTEN_ADDR	Still 127.0.0.1 only.
Deleted TimeCurve verify script	Removes hardcoded Anvil dev keys from an active script path.
WarBow BP test (1000)	Test expectation alignment only; no runtime/auth change.

No inline threads (no medium+ items). No block:security label applied.

## Security review — MR !471 **Commit reviewed:** `4034dfd9571aa505dac250696e1a3fe262fb6344` **Scope:** `scripts/lib/verify_anvil_common.sh`, `scripts/lib/verify_indexer_stack.sh` (incl. Multicall3 ensure from #307), refactored `verify-*-anvil.sh` scripts (7 consumers post-merge), deleted `verify-timecurve-post-end-gates-anvil.sh`, doc/anchor updates, `integration_stage2` WarBow BP assertion (`750` → `1000`), `anvil_rich_state.sh` message. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. ### Method - Re-reviewed after `origin/main` merge (`4034dfd9`); prior review on `c543a83d` superseded for merge-conflict integration (Multicall3 in `yieldomega_verify_boot_indexer_stack`, seven script consumers). - Traced attacker-controlled inputs (`ANVIL_PORT`, `INDEXER_PORT`, `DATABASE_URL`, `PG_URL`, optional `db_name` args) through shared helpers to sinks (`pkill`, `psql -c`, `cast send`/`cast publish`, `curl`, registry file writes). - Compared refactored behavior to pre-MR inline bootstrap; confirmed no new production/indexer auth surfaces, contract logic, or off-network listeners. - Checked injection (SQL/shell), SSRF, secret leakage, permission-boundary regressions, supply-chain (Multicall3 pre-signed deploy tx), and EVM risks. ### Notes (below medium threshold) | Area | Assessment | |------|------------| | `yieldomega_verify_pg_reset_*` SQL string interpolation | Pre-existing local-dev pattern; callers pass only default DB names. No remote/untrusted input path. | | `pkill -f 'yieldomega-indexer'` | Unchanged local-dev cleanup; not a cross-tenant production boundary. | | Port-scoped `pkill -f "anvil.*${port}"` | Improvement vs bare `pkill anvil`; enforced by `test-verify-anvil-lib.sh`. | | `yieldomega_verify_kill_pid_if_set` | Numeric PID guard is a hardening improvement. | | Multicall3 ensure in boot stack | Canonical address + known mds1/multicall bytecode; local Anvil only. | | Indexer `LISTEN_ADDR` | Still `127.0.0.1` only. | | Deleted TimeCurve verify script | Removes hardcoded Anvil dev keys from an active script path. | | WarBow BP test (`1000`) | Test expectation alignment only; no runtime/auth change. | No inline threads (no medium+ items). No `block:security` label applied.

PlasticDigits (Migrated from gitlab.com) merged commit 38bedf55af into main 2026-06-14 02:34:18 +00:00

PlasticDigits commented 2026-06-14 02:34:19 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit 38bedf55af

mentioned in commit 38bedf55af73d8d9fc3229210500aa4599d29cbc

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:open_issues

  

agents

  

agent:security_audit

  

agent:verify

  

area

timecurve

  

arena

  

arena-v2

  

audit

  

block:feature_review

  

block:security

  

bug

  

contracts

  

design

  

devops

  

docs

Documentation

  

documentation

  

enhancement

  

epic

Epic / umbrella issue

  

feature

  

frontend

  

indexer

  

low priority

Low priority, investigate other issues first

  

megaeth

  

operations

  

ops

Deploy and operations

  

performance

  

QA

  

qa checklist

  

referrals

  

removal

Legacy removal

  

security

  

smart-contracts

  

tech-debt

  

testing

  

time-arena

TimeArena v2 revamp

  

timecurve

  

visual-qa

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:open_issues

agents

agent:security_audit

agent:verify

area

timecurve

arena

arena-v2

audit

block:feature_review

block:security

bug

contracts

design

devops

docs

documentation

enhancement

epic

feature

frontend

indexer

low priority

megaeth

operations

ops

performance

QA

qa checklist

referrals

removal

security

smart-contracts

tech-debt

testing

time-arena

timecurve

visual-qa

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!471

No description provided.