From 1dda417a94766233dbfdee7a537fbff88a6bcf3f Mon Sep 17 00:00:00 2001 From: SimpleTest Date: Sun, 19 Jul 2026 20:32:26 +0300 Subject: [PATCH] docs: record final local pre-production verification --- docs/verification.md | 288 +++++++++++++++++++++++++++---------------- 1 file changed, 182 insertions(+), 106 deletions(-) diff --git a/docs/verification.md b/docs/verification.md index 69ea68b..35c7d11 100644 --- a/docs/verification.md +++ b/docs/verification.md @@ -16,26 +16,27 @@ results from product limits and unknown production properties. | Consent-driven live tracking | Implemented and cross-client verified | On API 37, Android started `TrackingService` as a location foreground service with a persistent Stop notification. After Home minimized the Activity, an emulator coordinate change reached PostGIS. Notification Stop removed the service, notification, active session, and raw position. | Browsers stop with the page. Android has no `ACCESS_BACKGROUND_LOCATION`, unattended start, or route history. | | Privacy settings | Implemented and browser-verified | The profile exposed hidden, approximate public, exact for active match, and explicit exact-public options. Blocking and current-position cleanup have automated tests. | Exact public location remains a user opt-in; legal privacy and retention text still requires jurisdiction-specific review before launch. | | Reputation and anti-abuse | Implemented at MVP level | Handover codes, two-party completion, double-blind reviews, unique-counterpart ranking, optional movement/proximity evidence, reports, blocks, abuse signals, and moderator audit paths have automated tests. | The system is not bot-proof and does not claim identity verification. No punitive numeric policy is enabled without measured and approved thresholds. | -| Social profiles | Manual links implemented; GitHub verification implemented and automated-tested | Manual links cannot set verification fields. The optional GitHub flow uses state, PKCE, a user-bound one-time session, unique provider ownership, and an audit record; 171 tests pass, including callback replay/state checks. The local protocol drill also performs real HTTP token/user exchanges without returning an access token to the application. | The staging operator has not supplied GitHub OAuth credentials, so the real external provider redirect/callback remains disabled and has not been browser-verified. Other providers remain manual/unverified. | +| Social profiles | Manual links implemented; optional GitHub verification implemented and automated-tested | Manual links cannot set verification fields. The optional GitHub flow uses state, PKCE, a user-bound one-time session, unique provider ownership, and an audit record; the final 172-test suite includes callback replay/state checks. The local protocol drill also performs real HTTP token/user exchanges without returning an access token to the application. | GitHub OAuth credentials are intentionally absent and are not required for registration or the help flow. The real external provider redirect/callback remains disabled and unverified; other providers remain manual/unverified. | | Voluntary thanks | Implemented as an external optional link | A helper can expose an optional link after completion; the UI states that the platform does not process the payment. | The platform does not provide payments, escrow, refunds, tax reporting, or payment guarantees. | -| Android client | Local and public-staging clients implemented and emulator-verified | The native packages `org.whoneedhelp.mobile.debug` and `org.whoneedhelp.mobile.staging` launch the same authenticated LiveView app. Public HTTPS login, map, two-way chat, permission prompts, minimized foreground-service location updates, notification Stop, deep-link routing, and server cleanup were exercised on API 37. | Production signing, Play Store publication, verified Android App Links, unattended/background-permission tracking, and iOS are not implemented. | -| Multiple web/worker instances | Implemented and locally failure/rollout-verified | The isolated Compose profile passed BEAM crashes and sequential replacement with 3 web/2 worker replicas, all five nodes joined, PubSub passed, and 758/758 readiness requests succeeded. The project-owned kind cluster replaced all 2 web/2 worker pod UIDs under `maxUnavailable=0`; all four replacement pods joined and PubSub passed. | Local PostGIS is a single instance. Production database HA, backups, and recovery are operator work and are not claimed complete. | +| Android client | Local and public-staging clients implemented and emulator-verified | The native packages `org.whoneedhelp.mobile.debug` and `org.whoneedhelp.mobile.staging` launch the same authenticated LiveView app. Six lifecycle, permission, deep-link, foreground tracking, network-failure, notification-Stop, and Activity-destruction tests passed on each of API 30, 34, and 37. The API 37 staging smoke loaded the public home and Safety routes over HTTPS with zero observed load/TLS errors. | Production signing, Play Store publication, verified Android App Links, unattended/background-permission tracking, and iOS are not implemented. | +| Multiple web/worker instances | Implemented and locally failure/rollout-verified | The final isolated Compose drill passed BEAM crashes and sequential replacement with 3 web/2 worker replicas: all five nodes joined, PubSub passed, and 744/744 readiness requests succeeded. The project-owned kind cluster replaced all 2 web/2 worker pod UIDs under `maxUnavailable=0`; all four replacement pods joined, PubSub passed, and 363/363 samples ultimately succeeded. | Local PostGIS is a single instance. Production database HA, backups, and recovery are operator work and are not claimed complete. | | Local observability | Implemented and protocol-verified | Pinned Prometheus scraped all 3 direct load web targets with a file Bearer credential; Grafana provisioned a healthy datasource and four-panel dashboard; Alertmanager delivered firing and resolved webhooks for an induced scoped replica stop. | Local delivery does not establish production retention, notification-provider reliability, on-call policy, or measured alert thresholds. | -| Encrypted local backup | Implemented and failure-verified | Pinned Restic streamed PostgreSQL custom format into pinned local MinIO with no host plaintext dump, passed full-data checking and a fresh-database restore, rejected a corrupted repository, and published no snapshot for an interrupted upload. | The retained MinIO volume is on the same workstation; this is not off-site storage, database HA, or a production RPO/RTO/retention claim. | +| Encrypted local backup | Implemented and failure-verified | Pinned Restic streamed PostgreSQL custom format into pinned local MinIO with no host plaintext dump, passed full-data checking and a fresh-database restore, rejected a corrupted repository, and published no snapshot for an interrupted upload. The one-run MinIO project and volume were removed after retaining the non-secret evidence. | The drill proves the local mechanism, not off-site durability, database HA, or a production RPO/RTO/retention policy. | | External protocol boundaries | Implemented and locally failure-verified | The production release used its configured Assent/Req and Swoosh/gen_smtp clients against an internal-only mock; OAuth and SMTP success/rejection/retry/replay/timeout paths passed. The HTTP push boundary passed disabled, retry, rejection, timeout, and idempotency paths. Request acceptance and new-chat transactions created durable jobs processed by two Oban worker replicas; the chat event completed on Oban attempt 2 after an injected temporary failure. | This does not verify external provider availability or device delivery. FCM/APNs token registration and provider selection remain external work; SMTP exactly-once delivery is not claimed. | ## Reproducible checks -- The isolated Phoenix suite completed on 2026-07-19 with 171 +- The isolated Phoenix suite completed on 2026-07-19 with 172 tests and 0 failures after cursor pagination, database aggregation, and the full localization changes on Elixir 1.20.2 and Erlang/OTP 29.0.3. - `mix compile --force --warnings-as-errors` and `mix format --check-formatted`: passed against the same final source. - `./scripts/quality.sh` passed ShellCheck 0.11.0, Hadolint 2.14.0 at warning - threshold, actionlint 1.7.12, all eight Compose renders, Helm lint, Trivy - source/rendered-manifest scanning, xref, Credo high-priority checks, Sobelow - strict/private checks, Hex audit, 167 Phoenix tests, both npm audits, and the + threshold, actionlint 1.7.12, every configured Compose profile render, Helm + lint, Trivy source/rendered-manifest scanning, xref, Credo high-priority + checks, Sobelow strict/private checks, Hex audit, 172 Phoenix tests, both npm + audits, and the backup/MinIO/mc/external-mock/release-image vulnerability scans. The rendered Helm manifest reported zero HIGH/CRITICAL misconfigurations; the Alpine backup, MinIO, mc, and external-mock images and the Debian 13.6 release image @@ -56,14 +57,18 @@ results from product limits and unknown production properties. observed database constraint changed from exactly one of 3 urgent-help targets to exactly one of 5 urgent-help/Activity targets. - `mix format --check-formatted`: passed in the final run. -- Android local Docker build target: `testDebugUnitTest`, `lintDebug`, - `assembleDebug`, and `assembleDebugAndroidTest` passed. The isolated API 37 - runner then passed 5/5 instrumentation tests for denied/granted location - permission, deep-link lifecycle, foreground location upload, notification - Stop, and disconnected-Stop retry state. The public-staging target ran the - unit tests plus `lintStaging` and `assembleStaging`; both final artifacts - retain the documented hashes. Evidence for the final device run is - `output/android-instrumentation/20260719053610-2122819`. +- Android local Docker build targets `testDebugUnitTest`, `lintDebug`, + `assembleDebug`, and `assembleDebugAndroidTest` passed. The isolated runners + then passed 6/6 instrumentation tests on API 30, API 34, and API 37. The + sixth test verifies that the foreground service survives Home plus Activity + destruction and remains user-stoppable. The public-staging target passed + unit tests, `lintStaging`, and `assembleStaging`; the API 37 staging smoke + loaded `/` and `/safety` from the temporary HTTPS origin with no observed + load/TLS errors. Evidence is retained at + `output/android-instrumentation/api30/20260719162757-2877617`, + `output/android-instrumentation/api34/20260719163525-3053597`, + `output/android-instrumentation/api37-0/20260719164309-3237374`, and + `output/android-staging-smoke/20260719171121-3924350`. - Release Android guard: a staging/release build with a non-HTTPS `WNH_BASE_URL` failed at its dedicated preflight; the successful staging build used the explicit temporary HTTPS origin. @@ -76,44 +81,42 @@ results from product limits and unknown production properties. containers also used read-only root filesystems and dropped capabilities. The cross-node probe observed all four BEAM nodes, and live/readiness returned `ok`/`ready`. Database counts remained `0 users / 0 help requests`. -- The isolated Compose resilience drill observed a restart count increase for - one crashed web and worker BEAM process, replaced every replica sequentially, - observed all 5 cluster nodes, passed PubSub, and completed a real Oban retry - on attempt 2 after one recorded error. Its exact job row and all fixture - domain rows were absent afterward; 758 readiness samples had no final - failure. -- The reproducible kind rolling drill advanced both Deployments from revision - 19 to 20, replaced all four pod UIDs, observed all 4 BEAM nodes, passed - PubSub, and left the database-count diff empty. All 362 readiness samples - ultimately returned 200; two samples needed one reconnect attempt each - during local single-node NodePort endpoint replacement. -- The canonical local observability drill matched all 3 generated/active +- The final isolated Compose resilience drill observed a restart count increase + for one crashed web and worker BEAM process, replaced every replica + sequentially, observed all 5 cluster nodes, passed PubSub, and completed a + real Oban retry on attempt 2 after one recorded error. Its exact job row and + all fixture domain rows were absent afterward; all 744 readiness samples + succeeded. +- The final reproducible kind rolling drill replaced all four pod UIDs, + observed all 4 BEAM nodes, passed PubSub, and left the database-count diff + empty. All 363 readiness samples ultimately returned 200; two samples needed + one reconnect attempt each during local single-node NodePort endpoint + replacement. +- The final local observability drill matched all 3 generated/active Prometheus instance targets, checked the provisioned Grafana datasource and four-panel dashboard, received firing and resolved Alertmanager webhooks for the exact stopped/recovered web replica, restored every target to `up`, and left the application-table count diff empty. Its retained evidence contains neither the metrics token nor the random Grafana password. Final evidence is retained at - `output/observability/final-observability-20260719a`. + `output/observability/final-observability-current-20260719`. - The observability stop command changed only the four scoped monitoring container states. All app/database/worker container IDs stayed unchanged and running, and the checked user/request/message counts were identical before and after. A subsequent full drill returned all monitoring services to healthy. -- The encrypted S3 canonical drill restored 23 public application tables, all +- The final encrypted S3 drill restored 23 public application tables, all 10 current migrations, 14 categories, and PostGIS 3.6.4 into a fresh - temporary database. `restic check --read-data` passed for the retained - repository. Flipping the first byte of an isolated cloned repository made + temporary database. `restic check --read-data` passed before cleanup. + Flipping the first byte of an isolated cloned repository made both `check` and `dump` exit nonzero. Stopping the exact backup container after uploaded encrypted objects produced exit 130 and zero snapshots; Restic identified and pruned 32.809 MiB of unreferenced packs, then passed a - second full-data check. Only the retained canonical bucket remained, the - restore database and interruption container were absent, no configured - secret appeared in retained evidence, and the source database count diff was - empty. The obsolete successful-run bucket was then removed; only the final - canonical bucket remains. Evidence is retained at - `output/backups-s3/final-backup-20260719a`; the retained MinIO bucket is - `wnh-backup-final-backup-20260719a`. + second full-data check. The source database count diff was empty and no + configured secret appeared in retained evidence. The scoped MinIO project, + repository volume, and runtime directories were subsequently removed; the + evidence remains at + `output/backups-s3/final-backup-current-20260719`. - The latest external-boundary drill passed real client-side OAuth token and user HTTP exchanges, PKCE/state checks, provider denial, one-time-code replay, a fresh flow after a temporary token error, and timeout failure. It also @@ -127,18 +130,19 @@ results from product limits and unknown production properties. payload. Every retained file is mode `0600`, no generated credential was retained, no host port was published, and the exact project, volume, network, and one-run images were absent after cleanup. Evidence is retained at - `output/external-boundaries/push-product-pass3-20260719`. -- The committed browser suite passed its 1/1 bootstrap and all 8/8 Chromium - specs against a fresh PostGIS volume with two web and two worker replicas on - 2026-07-19. The retained successful-run artifact directory is - `output/e2e/20260719053436-2083768`. + `output/external-boundaries/final-boundaries-20260719`. +- The committed browser suite passed its 1/1 bootstrap and all 27/27 scenarios: + 9 each in Chromium, Firefox, and WebKit, against a fresh PostGIS volume with + two web and two worker replicas on 2026-07-19. The retained successful-run + artifact directory is `output/e2e/20260719162432-2790071`. It covered axe checks across four pages and two themes, keyboard navigation, three responsive widths, Activity/moderation/privacy, the two-user medicine handover and blind reviews, public boundaries, local raster maps, and an - offline LiveSocket transport failure/reconnect. It also verified persistent - Russian/Ukrainian public language selection and the selected Ukrainian - locale inside an authenticated LiveView. The uniquely named Compose volume - and networks were removed. + offline LiveSocket transport failure/reconnect. Each browser also recovered + active chat and tracking after its serving BEAM node stopped. It verified + persistent Russian/Ukrainian public language selection and the selected + Ukrainian locale inside an authenticated LiveView. The uniquely named + Compose volume and networks were removed. - The default localization domain contains 508 current messages and the errors domain contains 40. Russian and Ukrainian catalogs have no empty or fuzzy current entries. Category names, descriptions, structured-field labels and @@ -153,9 +157,11 @@ results from product limits and unknown production properties. two consecutive request pages matched the first 50 ordered rows with no gap or duplicate. Exact observations and their non-SLO limitations are recorded in `docs/performance.md`. -- Browser verification used headed Chrome. The authenticated matched-request - page rendered its chat, MapLibre marker, and live-location controls with no - console errors or warnings after the foreground-service rollout. +- Browser verification used the required headed Chrome wrapper. The final + public homepage rendered its account/language controls, urgent-medicine hero, + help steps, Safety link, and three language choices. The browser reported + zero console errors or warnings; the document, fingerprinted CSS/JS, and logo + requests all returned HTTP 200. The browser was left open. Local generated evidence (ignored by Git): @@ -274,16 +280,15 @@ Certbot renewal timer were active. This verifies the current staging path; it does not make the workstation or gateway a production availability environment. -On 2026-07-19 a new read-only check resolved the origin to `77.110.101.144`; +Earlier on 2026-07-19 a read-only check resolved the origin to `77.110.101.144`; HTTP redirected to HTTPS, and the homepage, Safety page, and readiness endpoint returned HTTP 200 with successful TLS verification. The certificate still had the exact SAN and the same expiry. The backing ordinary Compose project was healthy and its four-node PubSub probe passed. It contained 2 users, 1 help -request, 7 messages, and 8 applied migrations. Because that public-facing data -cannot be assumed disposable, the final local regression did not migrate or -replace that project without separate operator approval; current source was -instead rebuilt and exercised in the isolated Compose profiles and the -project-owned kind cluster. +request, 7 messages, and 8 applied migrations. At that checkpoint no mutation +was performed before a validated backup/restore and explicit authorization. +The later authorized rollout is recorded below; this paragraph is historical, +not the current deployment state. A mode-`0600` custom-format backup of that exact database was then created at `output/backups/compose-20260719-060810.dump` with SHA-256 @@ -374,10 +379,13 @@ Local ignored browser evidence: The public-staging APK was built with the explicit ignored `.env` `WNH_BASE_URL`, installed on the API 37 emulator, and connected to -`https://whoneedhelp.imalto.site`. Android package inspection found exactly one -matching Activity for the configured HTTPS host and no matching Activity for -`attacker.example`. A standard implicit `ACTION_VIEW` launch of `/safety` -opened the native `MainActivity` and displayed the public Safety rules. +`https://whoneedhelp.imalto.site`. Android package inspection found the exact +configured HTTPS authority and no filter for `attacker.example`. Because the +manifest intentionally does not claim App Link verification, a normal same-host +implicit `ACTION_VIEW` may show Android's resolver. Selecting the application +opened its native `MainActivity`; both `/` and `/safety` loaded from the public +origin with no observed WebView load or TLS errors. The external origin +resolved to the browser rather than the app. The manifest intentionally sets `android:autoVerify="false"`: this is a same-origin HTTPS deep link, not a claimed verified Android App Link. Enabling @@ -452,57 +460,125 @@ this verification window. ## Final full-stack regression -The complete local regression was repeated against application commit -`0ad71f6` on 2026-07-19: +The final application source under test was commit `c6aa3d1`; the later +documentation-only commit does not alter the tested runtime. -- `./scripts/quality.sh` passed the full static/security/dependency gate and - 167/167 Phoenix tests. The isolated external-service drill also passed on the - same source and removed its exact one-run project and images. -- The fresh browser project passed its 1/1 bootstrap and all 8/8 Chromium - scenarios, then removed its containers, two networks, and PostgreSQL volume. -- Android debug and public-staging builds repeated unit tests, lint, and APK - assembly. The network-isolated API 37 emulator passed 5/5 device tests and - was removed with its one-run image. A non-HTTPS staging/release origin failed - at the dedicated Gradle guard. -- The database-scale project measured 50,000 rows per large table before and - after the cursor-index migration, verified consecutive cursor pages, and - removed its database volume and image. -- The 3-web/2-worker load run passed 35,316/35,316 public checks, 39,108 HTTP - requests with zero failures, 1,888 authenticated write/tracking chains, and - 240 heartbeat WebSockets. Exact fixture cleanup restored the pre-run - application-table counts and PubSub passed. -- The Compose failure drill observed both BEAM container restarts, replaced all - five replicas, passed 758 readiness samples, and completed and removed the - one-failure/second-attempt Oban probe. The current-image kind rollout replaced - all four pod UIDs under `maxUnavailable=0`, passed all 362 readiness samples, - cluster/PubSub, and an empty database-count diff. -- Prometheus matched all three current web targets; Grafana provisioning passed; - Alertmanager delivered firing and resolved webhooks around one exact replica - stop/recovery; the database-count diff was empty. -- Restic/MinIO passed encrypted stream backup, full-data check, fresh-database - restore, corrupted-repository rejection, and interruption without a snapshot. - Temporary buckets/databases/containers were absent afterward, the obsolete - retained bucket was removed, and only the final canonical bucket remains. -- The ordinary public-facing Compose project first passed read-only - live/readiness, cluster/PubSub, public HTTPS, DNS, TLS, backup/restore, and - isolated upgrade rehearsal checks. After explicit approval, it was backed up - again, migrated from 8 to 10 migrations, and replaced with the current - 2-web/2-worker release. Its application-table count diff remained empty; - schema, health, cluster/PubSub, public HTTP/TLS/WebSocket, logs, localization, - and the protected-route browser flow passed after rollout. +- `./scripts/quality.sh` passed the complete static, formatting, compiler, + xref, Credo, Sobelow, Dialyzer, dependency-audit, manifest, secret, and image + gates. ExUnit reported 172 passed. The final log is + `output/regression/final-20260719/quality-current.log`. +- The isolated browser project passed its bootstrap 1/1 and 27/27 scenarios: + 9 in each of Chromium, Firefox, and WebKit, with no skipped, flaky, or + unexpected result. The suite includes accessibility, responsive navigation, + medicine handover, blind reviews, Activity privacy/moderation, localization, + reconnect, and active chat/tracking recovery after the serving BEAM node + stops. Evidence is `output/e2e/20260719162432-2790071`. +- Android debug and staging unit/lint/build gates passed. Six instrumentation + tests passed independently on API 30, 34, and 37, including the foreground + tracking service surviving Home plus Activity destruction. The separate API + 37 public-staging smoke loaded home and Safety over the exact temporary HTTPS + origin, matched no external-origin app filter, and observed zero load/TLS + errors. +- A real public Chromium two-user scenario registered isolated requester/helper + fixtures, completed medicine discovery, acceptance, realtime chat, consent + tracking, handover, both confirmations, and blind reviews. It passed 1/1 in + 12.8 seconds. Exact fixture cleanup removed its users and domain rows; the + before/after public database diff was empty. Evidence is + `output/staging-e2e/20260719170530-3787963`. +- The 600.5-second authenticated soak completed 271,072 iterations and 767,225 + HTTP requests with zero failed HTTP requests. All 703,995 public checks + passed; expected-response latency was 2.337 ms average, 5.705 ms p95, and + 175.955 ms maximum in this local run. Eight authenticated sessions completed + 31,607 request-page/LiveView/chat/tracking start-update-stop chains and 4,800 + heartbeat WebSockets without an authenticated or WebSocket error. The + database observed zero rollbacks, deadlocks, conflicts, or temporary files + during the measured interval. Exact fixture cleanup restored every tracked + table count. These are observations, not production SLOs or capacity limits; + evidence is `output/performance/authenticated-soak-10m-20260719`. +- The final isolated Compose failure/replacement drill used 3 web and 2 worker + replicas. All five nodes rejoined, PubSub passed, 744/744 readiness samples + succeeded, and the injected Oban job completed on attempt 2 after exactly one + recorded error. Evidence is + `output/resilience/final-resilience-current-20260719`. +- The final project-owned kind rolling drill replaced all four web/worker pod + UIDs, left all four replacements Ready with zero restarts, passed PubSub and + an empty database diff, and completed 363/363 readiness samples; two needed + one retry during the local single-node endpoint change. The current retained + kind release is Helm revision 13 with 2/2 web, 2/2 worker, and PostGIS 1/1 + Ready. Evidence is `output/resilience/final-kind-current-20260719`. +- Prometheus matched all three direct web targets before and after the scoped + failure; Grafana provisioning passed; Alertmanager delivered both firing and + resolved webhooks for `who_need_help_load-web-19`; the database diff was + empty. Evidence is + `output/observability/final-observability-current-20260719`. +- Restic/MinIO passed encrypted streaming backup, full-data repository check, + fresh-database restore, corrupted-repository fail-closed checks, and + interruption after uploaded objects with zero published snapshots. The + source database diff was empty. Evidence is + `output/backups-s3/final-backup-current-20260719`; the one-run MinIO project + and volume were removed after the drill. +- The database-scale harness used 50,000 configured rows per large table, + captured 16 before/after plans, selected every asserted cursor index, and + verified consecutive request pages without a gap or duplicate. The exact + observations and limits are in + `output/db-scale/20260719164620-3314314` and `docs/performance.md`. +- OAuth, SMTP, and HTTP-push boundaries passed success, rejection, timeout, + retry, replay, and deduplication checks against local internal-only + counterparts. Product acceptance and chat events produced durable jobs + consumed by two worker replicas; message content was excluded from push. + GitHub OAuth remains optional and disabled without credentials. Evidence is + `output/external-boundaries/final-boundaries-20260719`. +- A clean tracked-archive deployment at `c6aa3d1` applied all 10 migrations, + repeated migration idempotently, seeded 14 categories without duplication, + started 2 web and 2 worker replicas, passed HTTP/Mailpit/cluster/PubSub, and + left its project, image, volume, and extracted workspace absent after + cleanup. Evidence is + `output/portability/20260719171321-3973031-61769f`. +- The ordinary public Compose database was backed up to mode-`0600` + `output/backups/compose-20260719-165722.dump` with SHA-256 + `5b4d8a78665c5d47863af8e1e885684b110d94c278474e37c8465e0814f7000f`. + The archive passed catalog validation and an isolated restore before rollout. + The current public image ID is + `sha256:009f6754fb57a410f16252205bbfa1467a08b82a733de59c3c80e431afa8fc42` + on 2 healthy web and 2 running worker replicas. The deployment diff was + empty; the final read-only observation remains 2 users, 1 request, 7 + messages, 4 ended tracking sessions, and 10 migrations. +- After the workstation restart, the public route initially timed out because + its existing OpenVPN connection was down. Inspection confirmed Nginx still + targeted the assigned client address `10.8.0.14`; reactivating the existing + `client1` NetworkManager profile restored that address and the public path. + The final observation returned HTTPS 200, HTTP 301 to HTTPS, and the correct + `77.110.101.144` endpoint. Headed Chrome then rendered the homepage with zero + console errors or warnings; its document, CSS, JS, and logo requests returned + 200. The visible browser was left open. +- Scoped cleanup left zero containers, volumes, and networks for the + `who_need_help_load` project and removed its ignored observability/backup-S3 + runtime directories. The reusable ordinary public Compose project and the + project-owned kind cluster intentionally remain running. ## Known work before a public production launch - Replace the temporary staging origin with the production-owned domain and - production-sign the Android app. -- Operate PostgreSQL/PostGIS with backups, recovery testing, and the required - availability model. + production infrastructure. The temporary origin is available only while the + workstation, Compose stack, VPN path, gateway, and their networks are up. +- Create a production Android signing identity, publish + `/.well-known/assetlinks.json` for the final application ID/fingerprint if + verified App Links are wanted, and complete store policy/release work. +- Operate PostgreSQL/PostGIS with off-site backups, recovery testing, monitoring, + and the availability model selected for real usage. +- Configure a real transactional email provider before public registration. + The current Compose mail path terminates at local Mailpit. +- Configure and verify a real mobile push provider and device-token lifecycle + if native push is required. The provider-neutral HTTP boundary and product + jobs are tested; FCM/APNs device delivery is not. - Load-test representative data and traffic, then set measured pool, resource, autoscaling, and action-limit policies. -- Repeat representative authenticated write, chat, tracking, and reconnect - load scenarios before deriving production capacity or autoscaling policy. - Publish jurisdiction-specific emergency contacts, privacy, retention, prohibited-items, and voluntary-payment guidance after legal review. -- Create and configure a GitHub OAuth App, then exercise the real external - provider redirect/callback in a headed browser. Until then staging keeps the - provider disabled and manual links remain unverified. +- Establish moderation/support operations and incident response for real users. +- If verified GitHub identity is desired, create and configure its OAuth App and + exercise the external redirect/callback. This is an optional enhancement, not + a registration or launch blocker. +- Production capacity, minimum CPU/RAM, database HA topology, and autoscaling + thresholds remain unknown until representative target-environment + measurements exist.