From 673f94315c4f8ab34613721460056de2f96bfbc4 Mon Sep 17 00:00:00 2001 From: SimpleTest Date: Mon, 20 Jul 2026 02:58:58 +0300 Subject: [PATCH] docs: align completion plan with final evidence --- docs/local-hardening-plan.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/local-hardening-plan.md b/docs/local-hardening-plan.md index f9c77cd..1a100d8 100644 --- a/docs/local-hardening-plan.md +++ b/docs/local-hardening-plan.md @@ -10,13 +10,13 @@ item below unless the evidence column explicitly describes a local mock. | Browser E2E | Manual headed-Chrome scenarios exist; no committed browser suite | A fresh uniquely named Compose project runs two-user urgent help, Activity, moderation, privacy, and error paths; traces are retained on failure; its exact volume is removed | | Android UI | Two JVM unit-test files; no `androidTest` source set | Emulator instrumentation covers deep links, permissions, foreground tracking, notification Stop, lifecycle, and network failure | | CI and quality | No tracked CI workflow or static/security analysis dependencies | The same containerized gates pass locally and are represented in a validated CI workflow | -| Localization and accessibility | Completed locally: product copy and custom validation messages are extracted; EN/UK/RU catalogs and localized category descriptions/structured values are implemented | 508 default and 40 error messages are current; RU/UK have no empty/fuzzy entries; 171 backend tests and all 8 browser specs pass, including locale persistence, keyboard, axe, themes, responsive widths, and reconnect | +| Localization and accessibility | Completed locally: product copy and custom validation messages are extracted; EN/UK/RU catalogs and localized category descriptions/structured values are implemented | 508 default and 40 error messages are current; RU/UK have no empty/fuzzy entries; 174 backend tests and all 30 browser scenarios pass across Chromium, Firefox and WebKit, including locale persistence, keyboard, axe, themes, responsive widths, and reconnect | | Database scale | Core discovery/chat/moderation lists call unbounded `Repo.all()` | Cursor-bounded queries pass behavior tests and measured `EXPLAIN ANALYZE` checks on an isolated generated dataset | | Load and resilience | Public/readiness/heartbeat k6 profile exists | Authenticated writes, chat, tracking, reconnect, rolling replacement, and worker retry profiles pass without touching staging data | | Observability | Completed locally: protected per-process metrics feed a pinned Prometheus/Grafana/Alertmanager profile | All 3 direct web targets are up before/after the drill; a verified replica stop delivers firing and resolved webhooks; Grafana datasource/dashboard and an empty DB-count diff are retained | | Backup | Completed locally: a plaintext-free Restic stream is retained in pinned local MinIO | The encrypted repository passes full-data checking and fresh-database restore; corrupted configuration and an interrupted upload fail closed, leave no snapshot, and their temporary buckets are removed | | External boundaries | Completed locally: real Assent/Req, Swoosh/gen_smtp, and the provider-neutral push adapter run against an internal protocol mock | Success, rejection, retry, replay, timeout, PKCE/state, one-time-code, and idempotency paths pass without host ports or retained secrets; acceptance/chat product events pass through an ephemeral PostGIS database and two Oban workers | -| Final regression | 167 Phoenix tests plus reproducible browser and Android device suites | Browser, Android, API, DB, WebSocket, backup, monitoring, failure, cleanup, docs, and clean Git are verified from the final commits | +| Final regression | 174 Phoenix tests plus reproducible browser and Android device suites | Browser, Android, API, DB, WebSocket, backup, monitoring, failure, cleanup, docs, and clean Git are verified from the final commits | The goal remains open while any row lacks reproducible local evidence. @@ -59,7 +59,7 @@ The goal remains open while any row lacks reproducible local evidence. - The containerized `scripts/quality.sh` gate passes ShellCheck, Hadolint, actionlint, all Compose renders, Helm lint, a Trivy scan of tracked source and the rendered Kubernetes manifest, compiler/xref/Credo/Sobelow/Dialyzer/Hex - checks, 167 Phoenix tests, both npm audits, and Trivy scans of the backup, + checks, 174 Phoenix tests, both npm audits, and Trivy scans of the backup, MinIO server/client, external-mock, and production release images. It creates random one-run database credentials and removes its exact volume, networks, images, and source snapshot. @@ -79,19 +79,19 @@ The goal remains open while any row lacks reproducible local evidence. - The isolated three-web/two-worker load profile now uses real password login, authenticated LiveView joins, tracking start, HTTP position writes, private chat writes, and explicit tracking stop. A measured 30-second run completed - all 1,888 authenticated chains and 240 heartbeat sockets with no functional + all 1,765 authenticated chains and 240 heartbeat sockets with no functional failure, retained no current positions after stop, passed cross-node PubSub and readiness, and restored every tracked table count after exact fixture cleanup. - The same isolated profile now passes deliberate web/worker BEAM crashes, sequential replacement of every replica, exact five-node cluster/PubSub checks, and an Oban job that records one failure before succeeding on its - second attempt. A 758-sample readiness probe observed no final HTTP failure + second attempt. A 725-sample readiness probe observed no HTTP failure and the probe job/domain fixtures were absent afterward. - The project-owned kind cluster also passes a full web/worker rolling restart: all four pod UIDs changed, all replacements became Ready with zero restarts, the four-node cluster/PubSub probe passed, and database counts were unchanged. - The local single-node NodePort needed two reconnect attempts across 362 + The local single-node NodePort needed two one-retry samples across 395 ultimately successful samples; this is recorded rather than presented as raw transport continuity. - The isolated observability profile scrapes all three web containers by direct