# Who Need Help — local hardening completion plan

This plan deliberately excludes buying a domain, renting another server, and
real third-party credentials. The existing local Docker/kind environments and
the temporary `whoneedhelp.imalto.site` staging origin are sufficient for every
item below unless the evidence column explicitly describes a local mock.

| Area | Observed baseline | Local completion evidence |
| --- | --- | --- |
| Browser E2E | Manual headed-Chrome scenarios exist; no committed browser suite | A fresh uniquely named Compose project runs two-user urgent help, Activity, moderation, privacy, and error paths; traces are retained on failure; its exact volume is removed |
| Android UI | Two JVM unit-test files; no `androidTest` source set | Emulator instrumentation covers deep links, permissions, foreground tracking, notification Stop, lifecycle, and network failure |
| CI and quality | No tracked CI workflow or static/security analysis dependencies | The same containerized gates pass locally and are represented in a validated CI workflow |
| Localization and accessibility | Navigation/error Gettext coverage exists, but most product copy is hard-coded English | EN/UK/RU catalogs cover product UI; extraction is current; automated accessibility, keyboard, responsive, and contrast checks pass |
| Database scale | Core discovery/chat/moderation lists call unbounded `Repo.all()` | Cursor-bounded queries pass behavior tests and measured `EXPLAIN ANALYZE` checks on an isolated generated dataset |
| Load and resilience | Public/readiness/heartbeat k6 profile exists | Authenticated writes, chat, tracking, reconnect, rolling replacement, and worker retry profiles pass without touching staging data |
| Observability | Protected Prometheus text endpoint exists | Local Prometheus/Grafana/Alertmanager profile scrapes every replica and an induced isolated failure exercises alert delivery |
| Backup | Validated local custom-format dump and restore drill exist | An encrypted artifact is uploaded to local S3-compatible MinIO and restored into a fresh database; corruption and interrupted-upload checks fail closed |
| External boundaries | Mailpit and a fake GitHub strategy cover parts of SMTP/OAuth | Local protocol-level SMTP/OAuth mocks and the applicable push adapter boundary cover success, rejection, retry, replay, and timeout |
| Final regression | 149 Phoenix tests and manual cross-client evidence | Browser, Android, API, DB, WebSocket, backup, monitoring, failure, cleanup, docs, and clean Git are verified from the final commits |

The goal remains open while any row lacks reproducible local evidence.

## Verified progress

- The isolated browser harness now generates independent local secrets, starts
  two web and two worker replicas behind Traefik, and removes only its uniquely
  named Compose project and PostGIS volume.
- The browser suite passes public/authentication boundaries and the complete
  two-user medicine flow: Mailpit confirmation, category-driven request,
  matching, bidirectional realtime chat, handover verification, bilateral
  completion, and double-blind review reveal.
- A separate browser scenario passes Activity creation, participant approval,
  bidirectional private group chat, a report scoped to the selected message,
  block/unblock, inherited location privacy, manual social-link removal,
  category-proposal rejection, report resolution, account restriction, and
  enforcement of that restriction. Its administrator is created in the
  isolated database through the existing audited one-time bootstrap command.
- Browser console errors, page errors, and unexpected failed requests are
  test failures. Playwright traces, screenshots, video, JSON/HTML reports, and
  Compose logs are retained in ignored output on failure.
- The isolated API 37 Android suite passes five device tests: missing and
  granted location permission, same-origin deep-link routing across Activity
  recreation, native foreground location upload, notification Stop with remote
  cleanup, and a disconnected Stop request with visible retry state. It uses an
  in-process loopback fixture, runs its emulator without external networking,
  retains diagnostics on failure, and removes its exact container and image.
- The remaining rows above are still pending. Browser accessibility,
  responsive, offline, and reconnect checks remain part of their respective
  later rows; this document is not a completion claim.