docs: record final local pre-production verification
This commit is contained in:
parent
c6aa3d1ed2
commit
1dda417a94
|
|
@ -16,26 +16,27 @@ results from product limits and unknown production properties.
|
|||
| Consent-driven live tracking | Implemented and cross-client verified | On API 37, Android started `TrackingService` as a location foreground service with a persistent Stop notification. After Home minimized the Activity, an emulator coordinate change reached PostGIS. Notification Stop removed the service, notification, active session, and raw position. | Browsers stop with the page. Android has no `ACCESS_BACKGROUND_LOCATION`, unattended start, or route history. |
|
||||
| Privacy settings | Implemented and browser-verified | The profile exposed hidden, approximate public, exact for active match, and explicit exact-public options. Blocking and current-position cleanup have automated tests. | Exact public location remains a user opt-in; legal privacy and retention text still requires jurisdiction-specific review before launch. |
|
||||
| Reputation and anti-abuse | Implemented at MVP level | Handover codes, two-party completion, double-blind reviews, unique-counterpart ranking, optional movement/proximity evidence, reports, blocks, abuse signals, and moderator audit paths have automated tests. | The system is not bot-proof and does not claim identity verification. No punitive numeric policy is enabled without measured and approved thresholds. |
|
||||
| Social profiles | Manual links implemented; GitHub verification implemented and automated-tested | Manual links cannot set verification fields. The optional GitHub flow uses state, PKCE, a user-bound one-time session, unique provider ownership, and an audit record; 171 tests pass, including callback replay/state checks. The local protocol drill also performs real HTTP token/user exchanges without returning an access token to the application. | The staging operator has not supplied GitHub OAuth credentials, so the real external provider redirect/callback remains disabled and has not been browser-verified. Other providers remain manual/unverified. |
|
||||
| Social profiles | Manual links implemented; optional GitHub verification implemented and automated-tested | Manual links cannot set verification fields. The optional GitHub flow uses state, PKCE, a user-bound one-time session, unique provider ownership, and an audit record; the final 172-test suite includes callback replay/state checks. The local protocol drill also performs real HTTP token/user exchanges without returning an access token to the application. | GitHub OAuth credentials are intentionally absent and are not required for registration or the help flow. The real external provider redirect/callback remains disabled and unverified; other providers remain manual/unverified. |
|
||||
| Voluntary thanks | Implemented as an external optional link | A helper can expose an optional link after completion; the UI states that the platform does not process the payment. | The platform does not provide payments, escrow, refunds, tax reporting, or payment guarantees. |
|
||||
| Android client | Local and public-staging clients implemented and emulator-verified | The native packages `org.whoneedhelp.mobile.debug` and `org.whoneedhelp.mobile.staging` launch the same authenticated LiveView app. Public HTTPS login, map, two-way chat, permission prompts, minimized foreground-service location updates, notification Stop, deep-link routing, and server cleanup were exercised on API 37. | Production signing, Play Store publication, verified Android App Links, unattended/background-permission tracking, and iOS are not implemented. |
|
||||
| Multiple web/worker instances | Implemented and locally failure/rollout-verified | The isolated Compose profile passed BEAM crashes and sequential replacement with 3 web/2 worker replicas, all five nodes joined, PubSub passed, and 758/758 readiness requests succeeded. The project-owned kind cluster replaced all 2 web/2 worker pod UIDs under `maxUnavailable=0`; all four replacement pods joined and PubSub passed. | Local PostGIS is a single instance. Production database HA, backups, and recovery are operator work and are not claimed complete. |
|
||||
| Android client | Local and public-staging clients implemented and emulator-verified | The native packages `org.whoneedhelp.mobile.debug` and `org.whoneedhelp.mobile.staging` launch the same authenticated LiveView app. Six lifecycle, permission, deep-link, foreground tracking, network-failure, notification-Stop, and Activity-destruction tests passed on each of API 30, 34, and 37. The API 37 staging smoke loaded the public home and Safety routes over HTTPS with zero observed load/TLS errors. | Production signing, Play Store publication, verified Android App Links, unattended/background-permission tracking, and iOS are not implemented. |
|
||||
| Multiple web/worker instances | Implemented and locally failure/rollout-verified | The final isolated Compose drill passed BEAM crashes and sequential replacement with 3 web/2 worker replicas: all five nodes joined, PubSub passed, and 744/744 readiness requests succeeded. The project-owned kind cluster replaced all 2 web/2 worker pod UIDs under `maxUnavailable=0`; all four replacement pods joined, PubSub passed, and 363/363 samples ultimately succeeded. | Local PostGIS is a single instance. Production database HA, backups, and recovery are operator work and are not claimed complete. |
|
||||
| Local observability | Implemented and protocol-verified | Pinned Prometheus scraped all 3 direct load web targets with a file Bearer credential; Grafana provisioned a healthy datasource and four-panel dashboard; Alertmanager delivered firing and resolved webhooks for an induced scoped replica stop. | Local delivery does not establish production retention, notification-provider reliability, on-call policy, or measured alert thresholds. |
|
||||
| Encrypted local backup | Implemented and failure-verified | Pinned Restic streamed PostgreSQL custom format into pinned local MinIO with no host plaintext dump, passed full-data checking and a fresh-database restore, rejected a corrupted repository, and published no snapshot for an interrupted upload. | The retained MinIO volume is on the same workstation; this is not off-site storage, database HA, or a production RPO/RTO/retention claim. |
|
||||
| Encrypted local backup | Implemented and failure-verified | Pinned Restic streamed PostgreSQL custom format into pinned local MinIO with no host plaintext dump, passed full-data checking and a fresh-database restore, rejected a corrupted repository, and published no snapshot for an interrupted upload. The one-run MinIO project and volume were removed after retaining the non-secret evidence. | The drill proves the local mechanism, not off-site durability, database HA, or a production RPO/RTO/retention policy. |
|
||||
| External protocol boundaries | Implemented and locally failure-verified | The production release used its configured Assent/Req and Swoosh/gen_smtp clients against an internal-only mock; OAuth and SMTP success/rejection/retry/replay/timeout paths passed. The HTTP push boundary passed disabled, retry, rejection, timeout, and idempotency paths. Request acceptance and new-chat transactions created durable jobs processed by two Oban worker replicas; the chat event completed on Oban attempt 2 after an injected temporary failure. | This does not verify external provider availability or device delivery. FCM/APNs token registration and provider selection remain external work; SMTP exactly-once delivery is not claimed. |
|
||||
|
||||
## Reproducible checks
|
||||
|
||||
- The isolated Phoenix suite completed on 2026-07-19 with 171
|
||||
- The isolated Phoenix suite completed on 2026-07-19 with 172
|
||||
tests and 0 failures after cursor pagination, database aggregation, and the
|
||||
full localization changes
|
||||
on Elixir 1.20.2 and Erlang/OTP 29.0.3.
|
||||
- `mix compile --force --warnings-as-errors` and
|
||||
`mix format --check-formatted`: passed against the same final source.
|
||||
- `./scripts/quality.sh` passed ShellCheck 0.11.0, Hadolint 2.14.0 at warning
|
||||
threshold, actionlint 1.7.12, all eight Compose renders, Helm lint, Trivy
|
||||
source/rendered-manifest scanning, xref, Credo high-priority checks, Sobelow
|
||||
strict/private checks, Hex audit, 167 Phoenix tests, both npm audits, and the
|
||||
threshold, actionlint 1.7.12, every configured Compose profile render, Helm
|
||||
lint, Trivy source/rendered-manifest scanning, xref, Credo high-priority
|
||||
checks, Sobelow strict/private checks, Hex audit, 172 Phoenix tests, both npm
|
||||
audits, and the
|
||||
backup/MinIO/mc/external-mock/release-image vulnerability scans. The rendered
|
||||
Helm manifest reported zero HIGH/CRITICAL misconfigurations; the Alpine
|
||||
backup, MinIO, mc, and external-mock images and the Debian 13.6 release image
|
||||
|
|
@ -56,14 +57,18 @@ results from product limits and unknown production properties.
|
|||
observed database constraint changed from exactly one of 3 urgent-help
|
||||
targets to exactly one of 5 urgent-help/Activity targets.
|
||||
- `mix format --check-formatted`: passed in the final run.
|
||||
- Android local Docker build target: `testDebugUnitTest`, `lintDebug`,
|
||||
`assembleDebug`, and `assembleDebugAndroidTest` passed. The isolated API 37
|
||||
runner then passed 5/5 instrumentation tests for denied/granted location
|
||||
permission, deep-link lifecycle, foreground location upload, notification
|
||||
Stop, and disconnected-Stop retry state. The public-staging target ran the
|
||||
unit tests plus `lintStaging` and `assembleStaging`; both final artifacts
|
||||
retain the documented hashes. Evidence for the final device run is
|
||||
`output/android-instrumentation/20260719053610-2122819`.
|
||||
- Android local Docker build targets `testDebugUnitTest`, `lintDebug`,
|
||||
`assembleDebug`, and `assembleDebugAndroidTest` passed. The isolated runners
|
||||
then passed 6/6 instrumentation tests on API 30, API 34, and API 37. The
|
||||
sixth test verifies that the foreground service survives Home plus Activity
|
||||
destruction and remains user-stoppable. The public-staging target passed
|
||||
unit tests, `lintStaging`, and `assembleStaging`; the API 37 staging smoke
|
||||
loaded `/` and `/safety` from the temporary HTTPS origin with no observed
|
||||
load/TLS errors. Evidence is retained at
|
||||
`output/android-instrumentation/api30/20260719162757-2877617`,
|
||||
`output/android-instrumentation/api34/20260719163525-3053597`,
|
||||
`output/android-instrumentation/api37-0/20260719164309-3237374`, and
|
||||
`output/android-staging-smoke/20260719171121-3924350`.
|
||||
- Release Android guard: a staging/release build with a non-HTTPS
|
||||
`WNH_BASE_URL` failed at its dedicated preflight; the successful staging
|
||||
build used the explicit temporary HTTPS origin.
|
||||
|
|
@ -76,44 +81,42 @@ results from product limits and unknown production properties.
|
|||
containers also used read-only root filesystems and dropped capabilities.
|
||||
The cross-node probe observed all four BEAM nodes, and live/readiness returned
|
||||
`ok`/`ready`. Database counts remained `0 users / 0 help requests`.
|
||||
- The isolated Compose resilience drill observed a restart count increase for
|
||||
one crashed web and worker BEAM process, replaced every replica sequentially,
|
||||
observed all 5 cluster nodes, passed PubSub, and completed a real Oban retry
|
||||
on attempt 2 after one recorded error. Its exact job row and all fixture
|
||||
domain rows were absent afterward; 758 readiness samples had no final
|
||||
failure.
|
||||
- The reproducible kind rolling drill advanced both Deployments from revision
|
||||
19 to 20, replaced all four pod UIDs, observed all 4 BEAM nodes, passed
|
||||
PubSub, and left the database-count diff empty. All 362 readiness samples
|
||||
ultimately returned 200; two samples needed one reconnect attempt each
|
||||
during local single-node NodePort endpoint replacement.
|
||||
- The canonical local observability drill matched all 3 generated/active
|
||||
- The final isolated Compose resilience drill observed a restart count increase
|
||||
for one crashed web and worker BEAM process, replaced every replica
|
||||
sequentially, observed all 5 cluster nodes, passed PubSub, and completed a
|
||||
real Oban retry on attempt 2 after one recorded error. Its exact job row and
|
||||
all fixture domain rows were absent afterward; all 744 readiness samples
|
||||
succeeded.
|
||||
- The final reproducible kind rolling drill replaced all four pod UIDs,
|
||||
observed all 4 BEAM nodes, passed PubSub, and left the database-count diff
|
||||
empty. All 363 readiness samples ultimately returned 200; two samples needed
|
||||
one reconnect attempt each during local single-node NodePort endpoint
|
||||
replacement.
|
||||
- The final local observability drill matched all 3 generated/active
|
||||
Prometheus instance targets, checked the provisioned Grafana datasource and
|
||||
four-panel dashboard, received firing and resolved Alertmanager webhooks for
|
||||
the exact stopped/recovered web replica, restored every target to `up`, and
|
||||
left the application-table count diff empty. Its retained evidence contains
|
||||
neither the metrics token nor the random Grafana password. Final evidence is
|
||||
retained at
|
||||
`output/observability/final-observability-20260719a`.
|
||||
`output/observability/final-observability-current-20260719`.
|
||||
- The observability stop command changed only the four scoped monitoring
|
||||
container states. All app/database/worker container IDs stayed unchanged and
|
||||
running, and the checked user/request/message counts were identical before
|
||||
and after. A subsequent full drill returned all monitoring services to
|
||||
healthy.
|
||||
- The encrypted S3 canonical drill restored 23 public application tables, all
|
||||
- The final encrypted S3 drill restored 23 public application tables, all
|
||||
10 current migrations, 14 categories, and PostGIS 3.6.4 into a fresh
|
||||
temporary database. `restic check --read-data` passed for the retained
|
||||
repository. Flipping the first byte of an isolated cloned repository made
|
||||
temporary database. `restic check --read-data` passed before cleanup.
|
||||
Flipping the first byte of an isolated cloned repository made
|
||||
both `check` and `dump` exit nonzero. Stopping the exact backup container
|
||||
after uploaded encrypted objects produced exit 130 and zero snapshots;
|
||||
Restic identified and pruned 32.809 MiB of unreferenced packs, then passed a
|
||||
second full-data check. Only the retained canonical bucket remained, the
|
||||
restore database and interruption container were absent, no configured
|
||||
secret appeared in retained evidence, and the source database count diff was
|
||||
empty. The obsolete successful-run bucket was then removed; only the final
|
||||
canonical bucket remains. Evidence is retained at
|
||||
`output/backups-s3/final-backup-20260719a`; the retained MinIO bucket is
|
||||
`wnh-backup-final-backup-20260719a`.
|
||||
second full-data check. The source database count diff was empty and no
|
||||
configured secret appeared in retained evidence. The scoped MinIO project,
|
||||
repository volume, and runtime directories were subsequently removed; the
|
||||
evidence remains at
|
||||
`output/backups-s3/final-backup-current-20260719`.
|
||||
- The latest external-boundary drill passed real client-side OAuth token and
|
||||
user HTTP exchanges, PKCE/state checks, provider denial, one-time-code replay,
|
||||
a fresh flow after a temporary token error, and timeout failure. It also
|
||||
|
|
@ -127,18 +130,19 @@ results from product limits and unknown production properties.
|
|||
payload. Every retained file is mode `0600`, no generated credential was
|
||||
retained, no host port was published, and the exact project, volume, network,
|
||||
and one-run images were absent after cleanup. Evidence is retained at
|
||||
`output/external-boundaries/push-product-pass3-20260719`.
|
||||
- The committed browser suite passed its 1/1 bootstrap and all 8/8 Chromium
|
||||
specs against a fresh PostGIS volume with two web and two worker replicas on
|
||||
2026-07-19. The retained successful-run artifact directory is
|
||||
`output/e2e/20260719053436-2083768`.
|
||||
`output/external-boundaries/final-boundaries-20260719`.
|
||||
- The committed browser suite passed its 1/1 bootstrap and all 27/27 scenarios:
|
||||
9 each in Chromium, Firefox, and WebKit, against a fresh PostGIS volume with
|
||||
two web and two worker replicas on 2026-07-19. The retained successful-run
|
||||
artifact directory is `output/e2e/20260719162432-2790071`.
|
||||
It covered axe checks across four pages and two themes, keyboard navigation,
|
||||
three responsive widths, Activity/moderation/privacy, the two-user medicine
|
||||
handover and blind reviews, public boundaries, local raster maps, and an
|
||||
offline LiveSocket transport failure/reconnect. It also verified persistent
|
||||
Russian/Ukrainian public language selection and the selected Ukrainian
|
||||
locale inside an authenticated LiveView. The uniquely named Compose volume
|
||||
and networks were removed.
|
||||
offline LiveSocket transport failure/reconnect. Each browser also recovered
|
||||
active chat and tracking after its serving BEAM node stopped. It verified
|
||||
persistent Russian/Ukrainian public language selection and the selected
|
||||
Ukrainian locale inside an authenticated LiveView. The uniquely named
|
||||
Compose volume and networks were removed.
|
||||
- The default localization domain contains 508 current messages and the errors
|
||||
domain contains 40. Russian and Ukrainian catalogs have no empty or fuzzy
|
||||
current entries. Category names, descriptions, structured-field labels and
|
||||
|
|
@ -153,9 +157,11 @@ results from product limits and unknown production properties.
|
|||
two consecutive request pages matched the first 50 ordered rows with no gap
|
||||
or duplicate. Exact observations and their non-SLO limitations are recorded
|
||||
in `docs/performance.md`.
|
||||
- Browser verification used headed Chrome. The authenticated matched-request
|
||||
page rendered its chat, MapLibre marker, and live-location controls with no
|
||||
console errors or warnings after the foreground-service rollout.
|
||||
- Browser verification used the required headed Chrome wrapper. The final
|
||||
public homepage rendered its account/language controls, urgent-medicine hero,
|
||||
help steps, Safety link, and three language choices. The browser reported
|
||||
zero console errors or warnings; the document, fingerprinted CSS/JS, and logo
|
||||
requests all returned HTTP 200. The browser was left open.
|
||||
|
||||
Local generated evidence (ignored by Git):
|
||||
|
||||
|
|
@ -274,16 +280,15 @@ Certbot renewal timer were active. This verifies the current staging path; it
|
|||
does not make the workstation or gateway a production availability
|
||||
environment.
|
||||
|
||||
On 2026-07-19 a new read-only check resolved the origin to `77.110.101.144`;
|
||||
Earlier on 2026-07-19 a read-only check resolved the origin to `77.110.101.144`;
|
||||
HTTP redirected to HTTPS, and the homepage, Safety page, and readiness endpoint
|
||||
returned HTTP 200 with successful TLS verification. The certificate still had
|
||||
the exact SAN and the same expiry. The backing ordinary Compose project was
|
||||
healthy and its four-node PubSub probe passed. It contained 2 users, 1 help
|
||||
request, 7 messages, and 8 applied migrations. Because that public-facing data
|
||||
cannot be assumed disposable, the final local regression did not migrate or
|
||||
replace that project without separate operator approval; current source was
|
||||
instead rebuilt and exercised in the isolated Compose profiles and the
|
||||
project-owned kind cluster.
|
||||
request, 7 messages, and 8 applied migrations. At that checkpoint no mutation
|
||||
was performed before a validated backup/restore and explicit authorization.
|
||||
The later authorized rollout is recorded below; this paragraph is historical,
|
||||
not the current deployment state.
|
||||
|
||||
A mode-`0600` custom-format backup of that exact database was then created at
|
||||
`output/backups/compose-20260719-060810.dump` with SHA-256
|
||||
|
|
@ -374,10 +379,13 @@ Local ignored browser evidence:
|
|||
|
||||
The public-staging APK was built with the explicit ignored `.env`
|
||||
`WNH_BASE_URL`, installed on the API 37 emulator, and connected to
|
||||
`https://whoneedhelp.imalto.site`. Android package inspection found exactly one
|
||||
matching Activity for the configured HTTPS host and no matching Activity for
|
||||
`attacker.example`. A standard implicit `ACTION_VIEW` launch of `/safety`
|
||||
opened the native `MainActivity` and displayed the public Safety rules.
|
||||
`https://whoneedhelp.imalto.site`. Android package inspection found the exact
|
||||
configured HTTPS authority and no filter for `attacker.example`. Because the
|
||||
manifest intentionally does not claim App Link verification, a normal same-host
|
||||
implicit `ACTION_VIEW` may show Android's resolver. Selecting the application
|
||||
opened its native `MainActivity`; both `/` and `/safety` loaded from the public
|
||||
origin with no observed WebView load or TLS errors. The external origin
|
||||
resolved to the browser rather than the app.
|
||||
|
||||
The manifest intentionally sets `android:autoVerify="false"`: this is a
|
||||
same-origin HTTPS deep link, not a claimed verified Android App Link. Enabling
|
||||
|
|
@ -452,57 +460,125 @@ this verification window.
|
|||
|
||||
## Final full-stack regression
|
||||
|
||||
The complete local regression was repeated against application commit
|
||||
`0ad71f6` on 2026-07-19:
|
||||
The final application source under test was commit `c6aa3d1`; the later
|
||||
documentation-only commit does not alter the tested runtime.
|
||||
|
||||
- `./scripts/quality.sh` passed the full static/security/dependency gate and
|
||||
167/167 Phoenix tests. The isolated external-service drill also passed on the
|
||||
same source and removed its exact one-run project and images.
|
||||
- The fresh browser project passed its 1/1 bootstrap and all 8/8 Chromium
|
||||
scenarios, then removed its containers, two networks, and PostgreSQL volume.
|
||||
- Android debug and public-staging builds repeated unit tests, lint, and APK
|
||||
assembly. The network-isolated API 37 emulator passed 5/5 device tests and
|
||||
was removed with its one-run image. A non-HTTPS staging/release origin failed
|
||||
at the dedicated Gradle guard.
|
||||
- The database-scale project measured 50,000 rows per large table before and
|
||||
after the cursor-index migration, verified consecutive cursor pages, and
|
||||
removed its database volume and image.
|
||||
- The 3-web/2-worker load run passed 35,316/35,316 public checks, 39,108 HTTP
|
||||
requests with zero failures, 1,888 authenticated write/tracking chains, and
|
||||
240 heartbeat WebSockets. Exact fixture cleanup restored the pre-run
|
||||
application-table counts and PubSub passed.
|
||||
- The Compose failure drill observed both BEAM container restarts, replaced all
|
||||
five replicas, passed 758 readiness samples, and completed and removed the
|
||||
one-failure/second-attempt Oban probe. The current-image kind rollout replaced
|
||||
all four pod UIDs under `maxUnavailable=0`, passed all 362 readiness samples,
|
||||
cluster/PubSub, and an empty database-count diff.
|
||||
- Prometheus matched all three current web targets; Grafana provisioning passed;
|
||||
Alertmanager delivered firing and resolved webhooks around one exact replica
|
||||
stop/recovery; the database-count diff was empty.
|
||||
- Restic/MinIO passed encrypted stream backup, full-data check, fresh-database
|
||||
restore, corrupted-repository rejection, and interruption without a snapshot.
|
||||
Temporary buckets/databases/containers were absent afterward, the obsolete
|
||||
retained bucket was removed, and only the final canonical bucket remains.
|
||||
- The ordinary public-facing Compose project first passed read-only
|
||||
live/readiness, cluster/PubSub, public HTTPS, DNS, TLS, backup/restore, and
|
||||
isolated upgrade rehearsal checks. After explicit approval, it was backed up
|
||||
again, migrated from 8 to 10 migrations, and replaced with the current
|
||||
2-web/2-worker release. Its application-table count diff remained empty;
|
||||
schema, health, cluster/PubSub, public HTTP/TLS/WebSocket, logs, localization,
|
||||
and the protected-route browser flow passed after rollout.
|
||||
- `./scripts/quality.sh` passed the complete static, formatting, compiler,
|
||||
xref, Credo, Sobelow, Dialyzer, dependency-audit, manifest, secret, and image
|
||||
gates. ExUnit reported 172 passed. The final log is
|
||||
`output/regression/final-20260719/quality-current.log`.
|
||||
- The isolated browser project passed its bootstrap 1/1 and 27/27 scenarios:
|
||||
9 in each of Chromium, Firefox, and WebKit, with no skipped, flaky, or
|
||||
unexpected result. The suite includes accessibility, responsive navigation,
|
||||
medicine handover, blind reviews, Activity privacy/moderation, localization,
|
||||
reconnect, and active chat/tracking recovery after the serving BEAM node
|
||||
stops. Evidence is `output/e2e/20260719162432-2790071`.
|
||||
- Android debug and staging unit/lint/build gates passed. Six instrumentation
|
||||
tests passed independently on API 30, 34, and 37, including the foreground
|
||||
tracking service surviving Home plus Activity destruction. The separate API
|
||||
37 public-staging smoke loaded home and Safety over the exact temporary HTTPS
|
||||
origin, matched no external-origin app filter, and observed zero load/TLS
|
||||
errors.
|
||||
- A real public Chromium two-user scenario registered isolated requester/helper
|
||||
fixtures, completed medicine discovery, acceptance, realtime chat, consent
|
||||
tracking, handover, both confirmations, and blind reviews. It passed 1/1 in
|
||||
12.8 seconds. Exact fixture cleanup removed its users and domain rows; the
|
||||
before/after public database diff was empty. Evidence is
|
||||
`output/staging-e2e/20260719170530-3787963`.
|
||||
- The 600.5-second authenticated soak completed 271,072 iterations and 767,225
|
||||
HTTP requests with zero failed HTTP requests. All 703,995 public checks
|
||||
passed; expected-response latency was 2.337 ms average, 5.705 ms p95, and
|
||||
175.955 ms maximum in this local run. Eight authenticated sessions completed
|
||||
31,607 request-page/LiveView/chat/tracking start-update-stop chains and 4,800
|
||||
heartbeat WebSockets without an authenticated or WebSocket error. The
|
||||
database observed zero rollbacks, deadlocks, conflicts, or temporary files
|
||||
during the measured interval. Exact fixture cleanup restored every tracked
|
||||
table count. These are observations, not production SLOs or capacity limits;
|
||||
evidence is `output/performance/authenticated-soak-10m-20260719`.
|
||||
- The final isolated Compose failure/replacement drill used 3 web and 2 worker
|
||||
replicas. All five nodes rejoined, PubSub passed, 744/744 readiness samples
|
||||
succeeded, and the injected Oban job completed on attempt 2 after exactly one
|
||||
recorded error. Evidence is
|
||||
`output/resilience/final-resilience-current-20260719`.
|
||||
- The final project-owned kind rolling drill replaced all four web/worker pod
|
||||
UIDs, left all four replacements Ready with zero restarts, passed PubSub and
|
||||
an empty database diff, and completed 363/363 readiness samples; two needed
|
||||
one retry during the local single-node endpoint change. The current retained
|
||||
kind release is Helm revision 13 with 2/2 web, 2/2 worker, and PostGIS 1/1
|
||||
Ready. Evidence is `output/resilience/final-kind-current-20260719`.
|
||||
- Prometheus matched all three direct web targets before and after the scoped
|
||||
failure; Grafana provisioning passed; Alertmanager delivered both firing and
|
||||
resolved webhooks for `who_need_help_load-web-19`; the database diff was
|
||||
empty. Evidence is
|
||||
`output/observability/final-observability-current-20260719`.
|
||||
- Restic/MinIO passed encrypted streaming backup, full-data repository check,
|
||||
fresh-database restore, corrupted-repository fail-closed checks, and
|
||||
interruption after uploaded objects with zero published snapshots. The
|
||||
source database diff was empty. Evidence is
|
||||
`output/backups-s3/final-backup-current-20260719`; the one-run MinIO project
|
||||
and volume were removed after the drill.
|
||||
- The database-scale harness used 50,000 configured rows per large table,
|
||||
captured 16 before/after plans, selected every asserted cursor index, and
|
||||
verified consecutive request pages without a gap or duplicate. The exact
|
||||
observations and limits are in
|
||||
`output/db-scale/20260719164620-3314314` and `docs/performance.md`.
|
||||
- OAuth, SMTP, and HTTP-push boundaries passed success, rejection, timeout,
|
||||
retry, replay, and deduplication checks against local internal-only
|
||||
counterparts. Product acceptance and chat events produced durable jobs
|
||||
consumed by two worker replicas; message content was excluded from push.
|
||||
GitHub OAuth remains optional and disabled without credentials. Evidence is
|
||||
`output/external-boundaries/final-boundaries-20260719`.
|
||||
- A clean tracked-archive deployment at `c6aa3d1` applied all 10 migrations,
|
||||
repeated migration idempotently, seeded 14 categories without duplication,
|
||||
started 2 web and 2 worker replicas, passed HTTP/Mailpit/cluster/PubSub, and
|
||||
left its project, image, volume, and extracted workspace absent after
|
||||
cleanup. Evidence is
|
||||
`output/portability/20260719171321-3973031-61769f`.
|
||||
- The ordinary public Compose database was backed up to mode-`0600`
|
||||
`output/backups/compose-20260719-165722.dump` with SHA-256
|
||||
`5b4d8a78665c5d47863af8e1e885684b110d94c278474e37c8465e0814f7000f`.
|
||||
The archive passed catalog validation and an isolated restore before rollout.
|
||||
The current public image ID is
|
||||
`sha256:009f6754fb57a410f16252205bbfa1467a08b82a733de59c3c80e431afa8fc42`
|
||||
on 2 healthy web and 2 running worker replicas. The deployment diff was
|
||||
empty; the final read-only observation remains 2 users, 1 request, 7
|
||||
messages, 4 ended tracking sessions, and 10 migrations.
|
||||
- After the workstation restart, the public route initially timed out because
|
||||
its existing OpenVPN connection was down. Inspection confirmed Nginx still
|
||||
targeted the assigned client address `10.8.0.14`; reactivating the existing
|
||||
`client1` NetworkManager profile restored that address and the public path.
|
||||
The final observation returned HTTPS 200, HTTP 301 to HTTPS, and the correct
|
||||
`77.110.101.144` endpoint. Headed Chrome then rendered the homepage with zero
|
||||
console errors or warnings; its document, CSS, JS, and logo requests returned
|
||||
200. The visible browser was left open.
|
||||
- Scoped cleanup left zero containers, volumes, and networks for the
|
||||
`who_need_help_load` project and removed its ignored observability/backup-S3
|
||||
runtime directories. The reusable ordinary public Compose project and the
|
||||
project-owned kind cluster intentionally remain running.
|
||||
|
||||
## Known work before a public production launch
|
||||
|
||||
- Replace the temporary staging origin with the production-owned domain and
|
||||
production-sign the Android app.
|
||||
- Operate PostgreSQL/PostGIS with backups, recovery testing, and the required
|
||||
availability model.
|
||||
production infrastructure. The temporary origin is available only while the
|
||||
workstation, Compose stack, VPN path, gateway, and their networks are up.
|
||||
- Create a production Android signing identity, publish
|
||||
`/.well-known/assetlinks.json` for the final application ID/fingerprint if
|
||||
verified App Links are wanted, and complete store policy/release work.
|
||||
- Operate PostgreSQL/PostGIS with off-site backups, recovery testing, monitoring,
|
||||
and the availability model selected for real usage.
|
||||
- Configure a real transactional email provider before public registration.
|
||||
The current Compose mail path terminates at local Mailpit.
|
||||
- Configure and verify a real mobile push provider and device-token lifecycle
|
||||
if native push is required. The provider-neutral HTTP boundary and product
|
||||
jobs are tested; FCM/APNs device delivery is not.
|
||||
- Load-test representative data and traffic, then set measured pool, resource,
|
||||
autoscaling, and action-limit policies.
|
||||
- Repeat representative authenticated write, chat, tracking, and reconnect
|
||||
load scenarios before deriving production capacity or autoscaling policy.
|
||||
- Publish jurisdiction-specific emergency contacts, privacy, retention,
|
||||
prohibited-items, and voluntary-payment guidance after legal review.
|
||||
- Create and configure a GitHub OAuth App, then exercise the real external
|
||||
provider redirect/callback in a headed browser. Until then staging keeps the
|
||||
provider disabled and manual links remain unverified.
|
||||
- Establish moderation/support operations and incident response for real users.
|
||||
- If verified GitHub identity is desired, create and configure its OAuth App and
|
||||
exercise the external redirect/callback. This is an optional enhancement, not
|
||||
a registration or launch blocker.
|
||||
- Production capacity, minimum CPU/RAM, database HA topology, and autoscaling
|
||||
thresholds remain unknown until representative target-environment
|
||||
measurements exist.
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user