Update governance commands to halt bridge#1776
Merged
Merged
Conversation
Adds the docs/resources/emergency-procedures.md file referenced by SUMMARY.md and governance-and-operational-processes.md in this PR, extending the on-call runbook with a Producing a halt-bridge preimage section that points to the live governance UI at app.snowbridge.network/governance alongside the snowbridge-preimage CLI. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds the operational runbook sections around the existing halt-bridge command reference: Detection signals (including bug bounty reports and visibly drained funds), Decision authority (solo halt only for visible exploits, otherwise 2/3 confirm to avoid spooking the community with a halt referendum), Comms during an incident (Slack first, then Element with Parity, then affected integrators, no public comms until fix is deployed), Submitting the preimage (Whitelisted Caller flow with Fellowship-whitelist timing), Verifying the halt (per-flag storage queries with Gateway-side caveat), Resuming the bridge (governance UI is the only practical path), and Post-mortem (Google Doc, 48h SLA). Also reframes the Producing a halt-bridge preimage and Resuming the bridge sections to make app.snowbridge.network/governance the primary path, with the snowbridge-preimage CLI as a fallback only. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Detection: trim to drained funds + verified-PoC bug bounty (HackenProof or direct); drop generic anomaly bullets. - Decision authority: distinguish solo halt (visible exploit, funds draining) from confirmed halt (2 team members agree) to avoid spooking the community with a halt referendum for a maybe-incident. Remove team-size denominators so the doc survives team-size changes. - Comms: name the #snowbridge-security Slack channel and Telegram as the integrator channel. - Halt path: governance page is primary; SDK (buildHaltBridgePreimage / buildResumeBridgePreimage) is the fallback. Drop snowbridge-preimage CLI from the runbook. - Submission: document the actual opengov-cli flow: Asset Hub batch (preimage note + public referendum, anyone) and Collectives Chain batch (Fellowship whitelist, rank-3+ Fellow only). Include the enactment-time default caveat. - Rename Emergency Pause to Halt scopes reference; rewrite scope list and failure-mode + verification tables to use UI form-field names instead of CLI flag names. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Restructure so halt-action sections (Producing, Halt scopes reference, Submitting, Verifying) sit directly under the intro for fast access under pressure; Detection, Decision authority, and Comms move below. Trim prose throughout: intro 2 paragraphs to 2 lines, scope bullets compressed to one sentence each, Decision authority converted to a table, numbered comms steps shortened. Protocol-relevant details (pallet names, V1/V2 distinctions, relayer-delivery caveats) kept; explanatory framing cut. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Lets the snowbridge-app governance UI emit two papi.how submission
links directly from a halt-bridge preimage, replacing the operator's
manual opengov-cli + Rust toolchain step:
1. Asset Hub batch URL: utility.forceBatch([preimage.notePreimage(
dispatchWhitelistedCallWithPreimage(call)), referenda.submit(
Origins(WhitelistedCaller), Lookup{hash, len}, After(n))]).
Anyone on the operator team can submit.
2. Collectives Fellowship URL: utility.forceBatch([fellowshipReferenda
.submit(FellowshipOrigins(Fellows), Inline(polkadotXcm.send to
Asset Hub carrying Transact(whitelist.whitelistCall(preimageHash))),
After(10))]). Must be submitted by a rank-3+ Fellow.
Mirrors joepetrowski/opengov-cli's polkadot_fellowship_referenda flow
(src/submit_referendum.rs ~L628-L811). Includes opengov_submission_check.ts
under @snowbridge/operations as a hex-parity check against a recorded
opengov-cli fixture, currently passes byte-for-byte on the live
Polkadot Asset Hub + Collectives runtimes.
resumeBridgeSubmissionUrls is a thin alias because the wire format
is identical; both halt and resume preimages go through the same
WhitelistedCaller track.
UI changes (copy-preimage button, submit-to-AH button, copy-Fellowship-
URL button in HaltBridgeForm.tsx) are intentionally out of scope and
will follow in snowbridge-app.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The governance page at app.snowbridge.network/governance now emits both the preimage AND the two papi.how submission links directly (Asset Hub batch + Fellowship whitelist), via the new buildHaltBridgeSubmissionUrls SDK helper. Reflect that as the primary path: - "Producing a halt-bridge preimage" -> "Producing the preimage and submission links": one step now, the page emits the URLs along with the preimage. - "Submitting the preimage" -> "Submitting": leads with "click Open on AH batch / Copy Fellowship link from the UI", no intermediate tooling. - Resuming section mirrors halt: UI emits both. - opengov-cli demoted to a fallback subsection under Submitting, for the case where the UI is unreachable. - SDK fallbacks updated to include buildHalt/ResumeBridgeSubmissionUrls alongside the preimage builders. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
claravanstaden
added a commit
to Snowfork/snowbridge-app
that referenced
this pull request
Jun 3, 2026
1.1.8 is the first release containing buildHaltBridgeSubmissionUrls and buildResumeBridgeSubmissionUrls (Snowfork/snowbridge#1776), which this PR's HaltBridgeForm depends on for the new submission links. Typecheck now passes against the installed package without the local dev overlay. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.