Extract shared verify script helpers and remove legacy TimeCurve script (#324) #489

Merged

PlasticDigits merged 2 commits from local1/324-verify-anvil-helpers into main 2026-06-14 07:11:44 +00:00

Conversation 8 Commits 2 Files changed -

PlasticDigits commented 2026-06-14 05:52:46 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Summary

• Add scripts/lib/verify_anvil_common.sh (Anvil spawn/warp/send/deploy/registry) and scripts/lib/verify_indexer_stack.sh (Postgres reset, indexer spawn, /v1/status wait).
• Refactor seven indexer-backed verify scripts to source the shared libs (~500 net lines removed).
• Delete legacy verify-timecurve-post-end-gates-anvil.sh (Arena v2 incompatible); update anvil_rich_state.sh hint.
• Fix dead doc links: e2e-anvil.md → existing surface-shells.spec.ts; arena-views.md relative paths + #pay-modes anchor; extend check-doc-anchors.sh for arena-views.
• Fix stale integration_stage2 WarBow BP expectation (1000 after epoch-1 buy) so verify scripts’ embedded cargo test passes.

Verification checklist

Acceptance item	Command	Result
Shared libs used by ≥5 verify scripts	rg verify_anvil_common scripts/verify-*-anvil.sh (7 matches)	PASS
Legacy TimeCurve post-end script removed	test ! -f scripts/verify-timecurve-post-end-gates-anvil.sh && rg verify-timecurve-post-end (only audits/ history)	PASS
e2e-anvil.md links existing spec files	manual review + test -f frontend/e2e/surface-shells.spec.ts	PASS
verify-podium-live-anvil.sh still PASS	bash scripts/verify-podium-live-anvil.sh	PASS (OK read_block=24)
Test plan: wallet profile	bash scripts/verify-wallet-profile-anvil.sh	PASS
Test plan: dev wallet seed regression	bash scripts/verify-evm-dev-wallet-seed-anvil.sh	PASS
Test plan: doc anchors	bash scripts/check-doc-anchors.sh	PASS
Line count drop	git diff --stat vs main	PASS (−652 / +278 lines)
pkill scope not broadened	shared lib uses anvil.*${PORT} + yieldomega-indexer only	PASS

Follow-ups

• WarBow gas optimization for large boards (issue comment) is separate from this tooling refactor.

---

Note

Low Risk
Dev/CI verify scripting and documentation only; shared cleanup keeps Anvil pkill port-scoped and does not broaden process kill scope.

Overview
Introduces scripts/lib/verify_anvil_common.sh (port-scoped Anvil lifecycle, warp/send helpers, registry writes) and scripts/lib/verify_indexer_stack.sh (Postgres reset, indexer boot, /v1/status wait), then rewires seven indexer-backed scripts/verify-*-anvil.sh scripts to source them for a large net line reduction.

Removes scripts/verify-timecurve-post-end-gates-anvil.sh as Arena v2–incompatible legacy tooling, adds scripts/test-verify-anvil-lib.sh to guard shared-lib contracts (pkill scope, script count, deleted TimeCurve script), and touches docs/check scripts so e2e-anvil.md, arena-views.md, and check-doc-anchors.sh point at real specs/anchors.

Updates a stale integration_stage2 WarBow BP expectation (1000 after epoch-1 buy) so embedded cargo test in verify flows passes again.

^{Reviewed by Cursor Bugbot for commit 9fa6a0b5ee. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary - Add `scripts/lib/verify_anvil_common.sh` (Anvil spawn/warp/send/deploy/registry) and `scripts/lib/verify_indexer_stack.sh` (Postgres reset, indexer spawn, `/v1/status` wait). - Refactor seven indexer-backed verify scripts to source the shared libs (~500 net lines removed). - Delete legacy `verify-timecurve-post-end-gates-anvil.sh` (Arena v2 incompatible); update `anvil_rich_state.sh` hint. - Fix dead doc links: `e2e-anvil.md` → existing `surface-shells.spec.ts`; `arena-views.md` relative paths + `#pay-modes` anchor; extend `check-doc-anchors.sh` for arena-views. - Fix stale `integration_stage2` WarBow BP expectation (1000 after epoch-1 buy) so verify scripts’ embedded `cargo test` passes. ## Verification checklist | Acceptance item | Command | Result | |-----------------|---------|--------| | Shared libs used by ≥5 verify scripts | `rg verify_anvil_common scripts/verify-*-anvil.sh` (7 matches) | **PASS** | | Legacy TimeCurve post-end script removed | `test ! -f scripts/verify-timecurve-post-end-gates-anvil.sh && rg verify-timecurve-post-end` (only `audits/` history) | **PASS** | | `e2e-anvil.md` links existing spec files | manual review + `test -f frontend/e2e/surface-shells.spec.ts` | **PASS** | | `verify-podium-live-anvil.sh` still PASS | `bash scripts/verify-podium-live-anvil.sh` | **PASS** (`OK read_block=24`) | | Test plan: wallet profile | `bash scripts/verify-wallet-profile-anvil.sh` | **PASS** | | Test plan: dev wallet seed regression | `bash scripts/verify-evm-dev-wallet-seed-anvil.sh` | **PASS** | | Test plan: doc anchors | `bash scripts/check-doc-anchors.sh` | **PASS** | | Line count drop | `git diff --stat` vs main | **PASS** (−652 / +278 lines) | | pkill scope not broadened | shared lib uses `anvil.*${PORT}` + `yieldomega-indexer` only | **PASS** | ## Follow-ups - WarBow gas optimization for large boards (issue comment) is separate from this tooling refactor. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Dev/CI verify scripting and documentation only; shared cleanup keeps Anvil pkill port-scoped and does not broaden process kill scope. > > **Overview** > Introduces **`scripts/lib/verify_anvil_common.sh`** (port-scoped Anvil lifecycle, warp/send helpers, registry writes) and **`scripts/lib/verify_indexer_stack.sh`** (Postgres reset, indexer boot, `/v1/status` wait), then rewires **seven** indexer-backed **`scripts/verify-*-anvil.sh`** scripts to source them for a large net line reduction. > > Removes **`scripts/verify-timecurve-post-end-gates-anvil.sh`** as Arena v2–incompatible legacy tooling, adds **`scripts/test-verify-anvil-lib.sh`** to guard shared-lib contracts (pkill scope, script count, deleted TimeCurve script), and touches docs/check scripts so **`e2e-anvil.md`**, **`arena-views.md`**, and **`check-doc-anchors.sh`** point at real specs/anchors. > > Updates a stale **`integration_stage2`** WarBow BP expectation (1000 after epoch-1 buy) so embedded **`cargo test`** in verify flows passes again. > > ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 9fa6a0b5ee3fc3fbe24250479ece1df654bfe2d7. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).} <!-- /CURSOR_SUMMARY -->

PlasticDigits commented 2026-06-14 05:54:47 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !489

Commit reviewed: c602d64379f0438ca719720155aee8d22e7dff49

Scope: Shared verify-script helpers (verify_anvil_common.sh, verify_indexer_stack.sh), refactor of seven verify-*-anvil.sh scripts, removal of legacy verify-timecurve-post-end-gates-anvil.sh, doc/anchor fixes, and integration_stage2 WarBow BP test expectation (750 → 1000).

Method: Full MR diff review; traced env/argument flow in new shared libs and all call sites; compared extracted helpers against prior inline implementations; no production contract, indexer API, or frontend runtime code changes beyond a test assertion.

Outcome: FINDINGS: 0 medium+

Inline threads: None (no medium+ issues on this diff).

Areas examined (no findings)

Area	Result
Shell / SQL injection (pg_reset_db, export "$1", die_fn, pkill)	db_name defaults to hardcoded yieldomega_indexer at all 7 call sites (same inline SQL as pre-refactor). Extra indexer env is only INDEXER_RPC_METRICS_LOG_SEC=15 (literal). die_fn is always die. pkill patterns unchanged (anvil.*${PORT}, yieldomega-indexer). Local dev-only scripts; no attacker-controlled sink to production.
Process kill scope	Not broadened vs pre-refactor; Anvil scoped by port regex, indexer by binary name.
EVM / contract surface	No Solidity or deploy-logic changes; anvil_rich_state.sh echo text only.
Indexer / API auth	No indexer source changes; test-only BP expectation aligns with current resolve_warbow_battle_points behavior.
Secret leakage	Deleted legacy script removed well-known Anvil dev keys from tree (reduction, not exposure).
Docs / frontend	Path and anchor fixes only; no runtime XSS or auth changes.

Security review: no medium+ findings on this diff.

## Security review — MR !489 **Commit reviewed:** `c602d64379f0438ca719720155aee8d22e7dff49` **Scope:** Shared verify-script helpers (`verify_anvil_common.sh`, `verify_indexer_stack.sh`), refactor of seven `verify-*-anvil.sh` scripts, removal of legacy `verify-timecurve-post-end-gates-anvil.sh`, doc/anchor fixes, and `integration_stage2` WarBow BP test expectation (`750` → `1000`). **Method:** Full MR diff review; traced env/argument flow in new shared libs and all call sites; compared extracted helpers against prior inline implementations; no production contract, indexer API, or frontend runtime code changes beyond a test assertion. **Outcome:** `FINDINGS: 0` medium+ **Inline threads:** None (no medium+ issues on this diff). ### Areas examined (no findings) | Area | Result | |------|--------| | Shell / SQL injection (`pg_reset_db`, `export "$1"`, `die_fn`, `pkill`) | `db_name` defaults to hardcoded `yieldomega_indexer` at all 7 call sites (same inline SQL as pre-refactor). Extra indexer env is only `INDEXER_RPC_METRICS_LOG_SEC=15` (literal). `die_fn` is always `die`. `pkill` patterns unchanged (`anvil.*${PORT}`, `yieldomega-indexer`). Local dev-only scripts; no attacker-controlled sink to production. | | Process kill scope | Not broadened vs pre-refactor; Anvil scoped by port regex, indexer by binary name. | | EVM / contract surface | No Solidity or deploy-logic changes; `anvil_rich_state.sh` echo text only. | | Indexer / API auth | No indexer source changes; test-only BP expectation aligns with current `resolve_warbow_battle_points` behavior. | | Secret leakage | Deleted legacy script removed well-known Anvil dev keys from tree (reduction, not exposure). | | Docs / frontend | Path and anchor fixes only; no runtime XSS or auth changes. | Security review: **no medium+ findings** on this diff.

PlasticDigits commented 2026-06-14 06:54:44 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

added 100 commits

• c602d643...862964db - 99 commits from branch main
• 9fa6a0b5 - Merge branch 'main' into local1/324-verify-anvil-helpers

Compare with previous version

added 100 commits <ul><li>c602d643...862964db - 99 commits from branch <code>main</code></li><li>9fa6a0b5 - Merge branch &#39;main&#39; into local1/324-verify-anvil-helpers</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/119/diffs?diff_id=1850611328&start_sha=c602d64379f0438ca719720155aee8d22e7dff49)

PlasticDigits commented 2026-06-14 06:54:47 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Resolved merge conflicts with main by keeping main's parameterized verify helpers (verify_anvil_common.sh, verify_indexer_stack.sh, yieldomega_verify_boot_indexer_stack) and updated doc anchors/redirects.

Conflicted verify scripts now use the shared boot stack + VERIFY_SCRIPT_PREFIX pattern from main. Sanity: bash scripts/check-doc-anchors.sh and bash scripts/test-verify-anvil-lib.sh PASS.

Resolved merge conflicts with `main` by keeping main's parameterized verify helpers (`verify_anvil_common.sh`, `verify_indexer_stack.sh`, `yieldomega_verify_boot_indexer_stack`) and updated doc anchors/redirects. Conflicted verify scripts now use the shared boot stack + `VERIFY_SCRIPT_PREFIX` pattern from main. Sanity: `bash scripts/check-doc-anchors.sh` and `bash scripts/test-verify-anvil-lib.sh` PASS.

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 06:54:50 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 06:54:56 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

PlasticDigits commented 2026-06-14 06:56:57 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !489

Commit reviewed: 9fa6a0b5ee3fc3fbe24250479ece1df654bfe2d7

Scope: Shared verify-script helpers (verify_anvil_common.sh, verify_indexer_stack.sh, yieldomega_verify_boot_indexer_stack), refactor of seven indexer-backed verify-*-anvil.sh scripts, removal of legacy verify-timecurve-post-end-gates-anvil.sh, scripts/test-verify-anvil-lib.sh, doc/anchor fixes (e2e-anvil.md, arena-views.md, check-doc-anchors.sh), and merge-conflict resolution vs main (parameterized helpers + VERIFY_SCRIPT_PREFIX).

Method: Re-read prior security review on c602d643; diffed c602d643..9fa6a0b5 for merge-resolution changes; traced env/argument flow in shared libs and all seven call sites; compared extracted helpers against pre-refactor inline implementations. No production Solidity, indexer API, or frontend runtime changes in MR scope.

Outcome: FINDINGS: 0 medium+

Inline threads: None (no medium+ issues on this diff).

Merge-resolution delta vs prior review (c602d643 → 9fa6a0b5)

Change	Security impact
Removed export "$1" varargs loop from yieldomega_verify_start_indexer	Improvement — arbitrary env injection path eliminated; callers set fixed exports (e.g. INDEXER_RPC_METRICS_LOG_SEC=15) before yieldomega_verify_boot_indexer_stack.
Parameterized RPC/port/log args; yieldomega_verify_kill_pid_if_set with numeric guard	Neutral/improved — tighter kill scope vs unvalidated PID kill.
yieldomega_verify_boot_indexer_stack adds Multicall3 ensure (#307)	Local Anvil dev-only; canonical bytecode deploy, no new remote attack surface.

Areas examined (no findings)

Area	Result
Shell / SQL injection (pg_reset_*, pkill, cast/psql interpolation)	db_name defaults to hardcoded yieldomega_indexer / yieldomega_indexer_test at all call sites (same inline SQL as pre-refactor). pkill patterns unchanged (anvil.*${port}, yieldomega-indexer). Local dev-only scripts; no attacker-controlled input reaches production sinks.
Process kill scope	Not broadened; Anvil port-regex scoped; indexer by binary name; PID kill numeric-validated.
EVM / contract surface	No Solidity or deploy-logic changes in MR scope; anvil_rich_state.sh echo text only.
Indexer / API auth	No indexer source changes in MR scope.
Secret leakage	Deleted legacy TimeCurve script removes well-known Anvil dev keys from tree (reduction, not exposure). verify-donate-pools-anvil.sh dev key is pre-existing.
Docs / frontend	Path and anchor fixes only; no runtime XSS or auth changes.

Security review: no medium+ findings on this diff.

## Security review — MR !489 **Commit reviewed:** `9fa6a0b5ee3fc3fbe24250479ece1df654bfe2d7` **Scope:** Shared verify-script helpers (`verify_anvil_common.sh`, `verify_indexer_stack.sh`, `yieldomega_verify_boot_indexer_stack`), refactor of seven indexer-backed `verify-*-anvil.sh` scripts, removal of legacy `verify-timecurve-post-end-gates-anvil.sh`, `scripts/test-verify-anvil-lib.sh`, doc/anchor fixes (`e2e-anvil.md`, `arena-views.md`, `check-doc-anchors.sh`), and merge-conflict resolution vs `main` (parameterized helpers + `VERIFY_SCRIPT_PREFIX`). **Method:** Re-read prior security review on `c602d643`; diffed `c602d643..9fa6a0b5` for merge-resolution changes; traced env/argument flow in shared libs and all seven call sites; compared extracted helpers against pre-refactor inline implementations. No production Solidity, indexer API, or frontend runtime changes in MR scope. **Outcome:** `FINDINGS: 0` medium+ **Inline threads:** None (no medium+ issues on this diff). ### Merge-resolution delta vs prior review (`c602d643` → `9fa6a0b5`) | Change | Security impact | |--------|-----------------| | Removed `export "$1"` varargs loop from `yieldomega_verify_start_indexer` | **Improvement** — arbitrary env injection path eliminated; callers set fixed exports (e.g. `INDEXER_RPC_METRICS_LOG_SEC=15`) before `yieldomega_verify_boot_indexer_stack`. | | Parameterized RPC/port/log args; `yieldomega_verify_kill_pid_if_set` with numeric guard | **Neutral/improved** — tighter kill scope vs unvalidated PID kill. | | `yieldomega_verify_boot_indexer_stack` adds Multicall3 ensure (#307) | Local Anvil dev-only; canonical bytecode deploy, no new remote attack surface. | ### Areas examined (no findings) | Area | Result | |------|--------| | Shell / SQL injection (`pg_reset_*`, `pkill`, `cast`/`psql` interpolation) | `db_name` defaults to hardcoded `yieldomega_indexer` / `yieldomega_indexer_test` at all call sites (same inline SQL as pre-refactor). `pkill` patterns unchanged (`anvil.*${port}`, `yieldomega-indexer`). Local dev-only scripts; no attacker-controlled input reaches production sinks. | | Process kill scope | Not broadened; Anvil port-regex scoped; indexer by binary name; PID kill numeric-validated. | | EVM / contract surface | No Solidity or deploy-logic changes in MR scope; `anvil_rich_state.sh` echo text only. | | Indexer / API auth | No indexer source changes in MR scope. | | Secret leakage | Deleted legacy TimeCurve script removes well-known Anvil dev keys from tree (reduction, not exposure). `verify-donate-pools-anvil.sh` dev key is pre-existing. | | Docs / frontend | Path and anchor fixes only; no runtime XSS or auth changes. | Security review: **no medium+ findings** on this diff.

PlasticDigits commented 2026-06-14 07:11:44 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit fc23dc3381

mentioned in commit fc23dc3381815fad3f9098bd1440fb7c9863ced3

PlasticDigits (Migrated from gitlab.com) merged commit fc23dc3381 into main 2026-06-14 07:11:44 +00:00

PlasticDigits commented 2026-06-14 12:17:14 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in issue #324

mentioned in issue #324

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:open_issues

  

agents

  

agent:security_audit

  

agent:verify

  

area

timecurve

  

arena

  

arena-v2

  

audit

  

block:feature_review

  

block:security

  

bug

  

contracts

  

design

  

devops

  

docs

Documentation

  

documentation

  

enhancement

  

epic

Epic / umbrella issue

  

feature

  

frontend

  

indexer

  

low priority

Low priority, investigate other issues first

  

megaeth

  

operations

  

ops

Deploy and operations

  

performance

  

QA

  

qa checklist

  

referrals

  

removal

Legacy removal

  

security

  

smart-contracts

  

tech-debt

  

testing

  

time-arena

TimeArena v2 revamp

  

timecurve

  

visual-qa

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:open_issues

agents

agent:security_audit

agent:verify

area

timecurve

arena

arena-v2

audit

block:feature_review

block:security

bug

contracts

design

devops

docs

documentation

enhancement

epic

feature

frontend

indexer

low priority

megaeth

operations

ops

performance

QA

qa checklist

referrals

removal

security

smart-contracts

tech-debt

testing

time-arena

timecurve

visual-qa

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!489

No description provided.