Extract shared verify script helpers and remove legacy TimeCurve script #480

Merged

PlasticDigits merged 2 commits from verify/issue-324-shared-verify-helpers into main 2026-06-14 05:07:54 +00:00

Conversation 8 Commits 2 Files changed 1 +2

PlasticDigits commented 2026-06-14 02:52:01 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Summary

• Add scripts/lib/verify_anvil_common.sh (Anvil spawn/warp/send/cleanup) and scripts/lib/verify_indexer_stack.sh (Postgres reset, registry JSON, indexer start, /v1/status wait).
• Refactor seven indexer-backed verify scripts to source the shared libs (~480 lines removed net).
• Delete legacy verify-timecurve-post-end-gates-anvil.sh; update anvil_rich_state.sh message.
• Fix dead doc links: e2e-anvil.md collection spec → surface-shells.spec.ts; arena-views.md frontend paths + #pay-modes anchor.
• Fix stale integration_stage2 WarBow BP expectation (250 + 750 after hard-reset buy, no WarBow epoch roll in fixture).

Verification checklist

Acceptance item	Command	Result
Shared libs used by ≥5 verify scripts	rg 'verify_anvil_common|verify_indexer_stack' scripts/verify-*-anvil.sh scripts/verify-indexer-rpc-metrics.sh | wc -l	PASS — 28 source lines (7 scripts × 2 libs)
Legacy TimeCurve post-end script removed	rg verify-timecurve-post-end --glob '!audits/**'	PASS — only audits/audit_full_*.md (history)
e2e-anvil.md links only existing specs	rg anvil-collection docs/ + test ! -f frontend/e2e/anvil-collection.spec.ts	PASS
verify-podium-live-anvil.sh still PASS	bash scripts/verify-podium-live-anvil.sh	PASS — read_block=27, live_rows=12
Wallet profile regression	bash scripts/verify-wallet-profile-anvil.sh	PASS
Dev wallet seed regression	bash scripts/verify-evm-dev-wallet-seed-anvil.sh	PASS
Doc anchors	bash scripts/check-doc-anchors.sh	PASS — 66 anchors
#pay-modes anchor	rg 'id=\"pay-modes\"' docs/frontend/arena-views.md	PASS

Related: GitLab #324 (parent gap analysis #309).

---

Note

Low Risk
Documentation-only change with no runtime, auth, or deployment impact.

Overview
Anvil E2E documentation now states that the Collection flow was removed and that placeholder routes are covered by frontend/e2e/surface-shells.spec.ts (non-Anvil UI smoke), replacing any stale reference to a dedicated Collection Anvil spec such as anvil-collection.spec.ts.

^{Reviewed by Cursor Bugbot for commit 69aaa8eda0. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary - Add `scripts/lib/verify_anvil_common.sh` (Anvil spawn/warp/send/cleanup) and `scripts/lib/verify_indexer_stack.sh` (Postgres reset, registry JSON, indexer start, `/v1/status` wait). - Refactor seven indexer-backed verify scripts to source the shared libs (~480 lines removed net). - Delete legacy `verify-timecurve-post-end-gates-anvil.sh`; update `anvil_rich_state.sh` message. - Fix dead doc links: `e2e-anvil.md` collection spec → `surface-shells.spec.ts`; `arena-views.md` frontend paths + `#pay-modes` anchor. - Fix stale `integration_stage2` WarBow BP expectation (250 + 750 after hard-reset buy, no WarBow epoch roll in fixture). ## Verification checklist | Acceptance item | Command | Result | |-----------------|---------|--------| | Shared libs used by ≥5 verify scripts | `rg 'verify_anvil_common\|verify_indexer_stack' scripts/verify-*-anvil.sh scripts/verify-indexer-rpc-metrics.sh \| wc -l` | **PASS** — 28 source lines (7 scripts × 2 libs) | | Legacy TimeCurve post-end script removed | `rg verify-timecurve-post-end --glob '!audits/**'` | **PASS** — only `audits/audit_full_*.md` (history) | | `e2e-anvil.md` links only existing specs | `rg anvil-collection docs/` + `test ! -f frontend/e2e/anvil-collection.spec.ts` | **PASS** | | `verify-podium-live-anvil.sh` still PASS | `bash scripts/verify-podium-live-anvil.sh` | **PASS** — `read_block=27, live_rows=12` | | Wallet profile regression | `bash scripts/verify-wallet-profile-anvil.sh` | **PASS** | | Dev wallet seed regression | `bash scripts/verify-evm-dev-wallet-seed-anvil.sh` | **PASS** | | Doc anchors | `bash scripts/check-doc-anchors.sh` | **PASS** — 66 anchors | | `#pay-modes` anchor | `rg 'id=\"pay-modes\"' docs/frontend/arena-views.md` | **PASS** | Related: GitLab #324 (parent gap analysis #309). <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Documentation-only change with no runtime, auth, or deployment impact. > > **Overview** > **Anvil E2E documentation** now states that the **Collection** flow was removed and that placeholder routes are covered by **`frontend/e2e/surface-shells.spec.ts`** (non-Anvil UI smoke), replacing any stale reference to a dedicated Collection Anvil spec such as `anvil-collection.spec.ts`. > > ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 69aaa8eda01925210aba653c89a3ba87b1bb6dde. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).} <!-- /CURSOR_SUMMARY -->

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 02:52:12 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 02:52:20 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

PlasticDigits commented 2026-06-14 02:56:53 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !480

Commit reviewed: f8484fc6587c04cd56e8f900ddd19b82f0231186

Scope: scripts/lib/verify_anvil_common.sh, scripts/lib/verify_indexer_stack.sh, refactored verify-*-anvil.sh / verify-indexer-rpc-metrics.sh, removal of verify-timecurve-post-end-gates-anvil.sh, doc link fixes (arena-views.md, e2e-anvil.md), integration_stage2 assertion update (warbow_battle_points 750 → 1000).

Method: Diff review with attacker-input tracing on new/changed shell helpers (command construction, psql/jq/cast sinks, process kill patterns, localhost bind paths). No production indexer/frontend/contract runtime paths are modified.

Outcome: FINDINGS: 0 medium+

Inline threads: None (no actionable medium+ issues on this diff).

Notes (informational, below reporting threshold)

• Changes are a mechanical extraction of existing local QA/bootstrap logic; behavior is equivalent to pre-refactor callers (indexer status wait extended to 180s in the shared helper only).
• verify_indexer_write_registry correctly parameterizes JSON via jq --arg / --argjson (no new injection surface).
• Indexer stack still binds LISTEN_ADDR to 127.0.0.1 and targets fixed local DB names — appropriate for dev-only verify scripts, not a production auth boundary.
• Deleted TimeCurve post-end gate script removed hardcoded Anvil dev keys from the tree; no new secret exposure introduced.

Security review: no medium+ findings on this diff.

## Security review — MR !480 **Commit reviewed:** `f8484fc6587c04cd56e8f900ddd19b82f0231186` **Scope:** `scripts/lib/verify_anvil_common.sh`, `scripts/lib/verify_indexer_stack.sh`, refactored `verify-*-anvil.sh` / `verify-indexer-rpc-metrics.sh`, removal of `verify-timecurve-post-end-gates-anvil.sh`, doc link fixes (`arena-views.md`, `e2e-anvil.md`), `integration_stage2` assertion update (`warbow_battle_points` 750 → 1000). **Method:** Diff review with attacker-input tracing on new/changed shell helpers (command construction, `psql`/`jq`/`cast` sinks, process kill patterns, localhost bind paths). No production indexer/frontend/contract runtime paths are modified. **Outcome:** `FINDINGS: 0` medium+ **Inline threads:** None (no actionable medium+ issues on this diff). ### Notes (informational, below reporting threshold) - Changes are a mechanical extraction of existing local QA/bootstrap logic; behavior is equivalent to pre-refactor callers (indexer status wait extended to 180s in the shared helper only). - `verify_indexer_write_registry` correctly parameterizes JSON via `jq --arg` / `--argjson` (no new injection surface). - Indexer stack still binds `LISTEN_ADDR` to `127.0.0.1` and targets fixed local DB names — appropriate for dev-only verify scripts, not a production auth boundary. - Deleted TimeCurve post-end gate script removed hardcoded Anvil dev keys from the tree; no new secret exposure introduced. Security review: no medium+ findings on this diff.

PlasticDigits commented 2026-06-14 02:59:19 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

added 61 commits

• f8484fc6...03a43d4a - 60 commits from branch main
• 69aaa8ed - Merge origin/main into verify/issue-324-shared-verify-helpers

Compare with previous version

added 61 commits <ul><li>f8484fc6...03a43d4a - 60 commits from branch <code>main</code></li><li>69aaa8ed - Merge origin/main into verify/issue-324-shared-verify-helpers</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/110/diffs?diff_id=1850561204&start_sha=f8484fc6587c04cd56e8f900ddd19b82f0231186)

PlasticDigits commented 2026-06-14 02:59:21 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Resolved merge conflicts with origin/main.

• Adopted main's yieldomega_verify_* shared helpers and refactored verify scripts (already landed via issue-324-verify-script-helpers).
• Kept this MR's e2e-anvil.md note that the removed collection spec is covered by surface-shells.spec.ts.
• anvil_rich_state.sh message and TimeCurve script removal align with main.

Sanity: bash scripts/check-doc-anchors.sh PASS, bash scripts/test-verify-anvil-lib.sh PASS.

Resolved merge conflicts with `origin/main`. - Adopted main's `yieldomega_verify_*` shared helpers and refactored verify scripts (already landed via `issue-324-verify-script-helpers`). - Kept this MR's `e2e-anvil.md` note that the removed collection spec is covered by `surface-shells.spec.ts`. - `anvil_rich_state.sh` message and TimeCurve script removal align with main. Sanity: `bash scripts/check-doc-anchors.sh` PASS, `bash scripts/test-verify-anvil-lib.sh` PASS.

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 02:59:38 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

PlasticDigits commented 2026-06-14 03:00:41 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !480

Commit reviewed: 69aaa8eda01925210aba653c89a3ba87b1bb6dde

Scope: Post-merge diff vs main — single file docs/testing/e2e-anvil.md (+2 lines) documenting that the removed Collection Anvil spec is covered by frontend/e2e/surface-shells.spec.ts. Verify-script helper extraction, TimeCurve script removal, and related refactors are already on main (not in this MR’s remaining diff).

Method: Diff review; traced whether the added markdown introduces attacker-controlled sinks, secret exposure, or auth/deployment boundary changes. Confirmed the linked spec path exists and is a standard Playwright UI smoke file (not referenced as executable content).

Outcome: FINDINGS: 0 medium+

Inline threads: None (no actionable medium+ issues on the current diff).

Security review: no medium+ findings on this diff.

## Security review — MR !480 **Commit reviewed:** `69aaa8eda01925210aba653c89a3ba87b1bb6dde` **Scope:** Post-merge diff vs `main` — single file `docs/testing/e2e-anvil.md` (+2 lines) documenting that the removed Collection Anvil spec is covered by `frontend/e2e/surface-shells.spec.ts`. Verify-script helper extraction, TimeCurve script removal, and related refactors are already on `main` (not in this MR’s remaining diff). **Method:** Diff review; traced whether the added markdown introduces attacker-controlled sinks, secret exposure, or auth/deployment boundary changes. Confirmed the linked spec path exists and is a standard Playwright UI smoke file (not referenced as executable content). **Outcome:** `FINDINGS: 0` medium+ **Inline threads:** None (no actionable medium+ issues on the current diff). Security review: no medium+ findings on this diff.

PlasticDigits commented 2026-06-14 05:07:55 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit e380776cdd

mentioned in commit e380776cdd62917846f527196be15fa22784a45f

PlasticDigits (Migrated from gitlab.com) merged commit e380776cdd into main 2026-06-14 05:07:55 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:open_issues

  

agents

  

agent:security_audit

  

agent:verify

  

area

timecurve

  

arena

  

arena-v2

  

audit

  

block:feature_review

  

block:security

  

bug

  

contracts

  

design

  

devops

  

docs

Documentation

  

documentation

  

enhancement

  

epic

Epic / umbrella issue

  

feature

  

frontend

  

indexer

  

low priority

Low priority, investigate other issues first

  

megaeth

  

operations

  

ops

Deploy and operations

  

performance

  

QA

  

qa checklist

  

referrals

  

removal

Legacy removal

  

security

  

smart-contracts

  

tech-debt

  

testing

  

time-arena

TimeArena v2 revamp

  

timecurve

  

visual-qa

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:open_issues

agents

agent:security_audit

agent:verify

area

timecurve

arena

arena-v2

audit

block:feature_review

block:security

bug

contracts

design

devops

docs

documentation

enhancement

epic

feature

frontend

indexer

low priority

megaeth

operations

ops

performance

QA

qa checklist

referrals

removal

security

smart-contracts

tech-debt

testing

time-arena

timecurve

visual-qa

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!480

No description provided.