who_need_help/docs/local-hardening-plan.md

Who Need Help — local hardening completion plan

This plan deliberately excludes buying a domain, renting another server, and real third-party credentials. The existing local Docker/kind environments and the temporary whoneedhelp.imalto.site staging origin are sufficient for every item below unless the evidence column explicitly describes a local mock.

Area	Observed baseline	Local completion evidence
Browser E2E	Manual headed-Chrome scenarios exist; no committed browser suite	A fresh uniquely named Compose project runs two-user urgent help, Activity, moderation, privacy, and error paths; traces are retained on failure; its exact volume is removed
Android UI	Two JVM unit-test files; no androidTest source set	Emulator instrumentation covers deep links, permissions, foreground tracking, notification Stop, lifecycle, and network failure
CI and quality	No tracked CI workflow or static/security analysis dependencies	The same containerized gates pass locally and are represented in a validated CI workflow
Localization and accessibility	Completed locally: product copy and custom validation messages are extracted; EN/UK/RU catalogs and localized category descriptions/structured values are implemented	508 default and 40 error messages are current; RU/UK have no empty/fuzzy entries; 163 backend tests and all 8 browser specs pass, including locale persistence, keyboard, axe, themes, responsive widths, and reconnect
Database scale	Core discovery/chat/moderation lists call unbounded Repo.all()	Cursor-bounded queries pass behavior tests and measured EXPLAIN ANALYZE checks on an isolated generated dataset
Load and resilience	Public/readiness/heartbeat k6 profile exists	Authenticated writes, chat, tracking, reconnect, rolling replacement, and worker retry profiles pass without touching staging data
Observability	Completed locally: protected per-process metrics feed a pinned Prometheus/Grafana/Alertmanager profile	All 3 direct web targets are up before/after the drill; a verified replica stop delivers firing and resolved webhooks; Grafana datasource/dashboard and an empty DB-count diff are retained
Backup	Validated local custom-format dump and restore drill exist	An encrypted artifact is uploaded to local S3-compatible MinIO and restored into a fresh database; corruption and interrupted-upload checks fail closed
External boundaries	Mailpit and a fake GitHub strategy cover parts of SMTP/OAuth	Local protocol-level SMTP/OAuth mocks and the applicable push adapter boundary cover success, rejection, retry, replay, and timeout
Final regression	163 Phoenix tests plus reproducible browser and Android device suites	Browser, Android, API, DB, WebSocket, backup, monitoring, failure, cleanup, docs, and clean Git are verified from the final commits

The goal remains open while any row lacks reproducible local evidence.

Verified progress

• The isolated browser harness now generates independent local secrets, starts two web and two worker replicas behind Traefik, and removes only its uniquely named Compose project and PostGIS volume.
• The browser suite passes public/authentication boundaries and the complete two-user medicine flow: Mailpit confirmation, category-driven request, matching, bidirectional realtime chat, handover verification, bilateral completion, and double-blind review reveal.
• A separate browser scenario passes Activity creation, participant approval, bidirectional private group chat, a report scoped to the selected message, block/unblock, inherited location privacy, manual social-link removal, category-proposal rejection, report resolution, account restriction, and enforcement of that restriction. Its administrator is created in the isolated database through the existing audited one-time bootstrap command.
• Browser console errors, page errors, and unexpected failed requests are test failures. Playwright traces, screenshots, video, JSON/HTML reports, and Compose logs are retained in ignored output on failure.
• The browser gate also passes axe checks on the home, safety, login, and registration pages in both light and dark themes, keyboard skip navigation, and 360/768/1440-pixel overflow checks. Its local raster-tile endpoint exists only in the E2E-compiled image, and map scenarios wait for MapLibre idle before navigation.
• A forced LiveSocket transport loss while Chromium is offline exposes the reconnect alert, and restoring the network clears it and reconnects the authenticated LiveView.
• The isolated API 37 Android suite passes five device tests: missing and granted location permission, same-origin deep-link routing across Activity recreation, native foreground location upload, notification Stop with remote cleanup, and a disconnected Stop request with visible retry state. It uses an in-process loopback fixture, runs its emulator without external networking, retains diagnostics on failure, and removes its exact container and image.
• The containerized scripts/quality.sh gate passes ShellCheck, Hadolint, actionlint, all Compose renders, Helm lint, a Trivy scan of tracked source and the rendered Kubernetes manifest, compiler/xref/Credo/Sobelow/Dialyzer/Hex checks, 163 Phoenix tests, both npm audits, and a Trivy scan of the production release image. It creates random one-run database credentials and removes its exact volume, networks, images, and source snapshot.
• The checked-in GitHub Actions workflow runs the same isolated backend/security gate, browser E2E suite, and Android unit/lint/APK build. The workflow itself passes actionlint and uses a commit-pinned checkout action without persisted credentials.
• The hardened local kind manifests also passed a runtime rollout: PostGIS, Mailpit, both web replicas, and both worker replicas became Ready as non-root containers with read-only root filesystems, dropped capabilities, and RuntimeDefault seccomp where configured. The cross-node PubSub probe passed.
• EN/UK/RU extraction and catalogs are now complete for current product UI and custom validation messages. Locale selection persists for public pages and authenticated LiveViews; category descriptions and structured values follow that browser locale. The localization browser specs run in the same isolated two-web/two-worker gate as the accessibility checks.
• The isolated three-web/two-worker load profile now uses real password login, authenticated LiveView joins, tracking start, HTTP position writes, private chat writes, and explicit tracking stop. A measured 30-second run completed all 1,880 authenticated chains and 240 heartbeat sockets with no functional failure, retained no current positions after stop, passed cross-node PubSub and readiness, and restored every tracked table count after exact fixture cleanup.
• The same isolated profile now passes deliberate web/worker BEAM crashes, sequential replacement of every replica, exact five-node cluster/PubSub checks, and an Oban job that records one failure before succeeding on its second attempt. A 743-sample readiness probe observed no final HTTP failure and the probe job/domain fixtures were absent afterward.
• The project-owned kind cluster also passes a full web/worker rolling restart: all four pod UIDs changed, all replacements became Ready with zero restarts, the four-node cluster/PubSub probe passed, and database counts were unchanged. The local single-node NodePort needed three reconnect attempts across 305 ultimately successful samples; this is recorded rather than presented as raw transport continuity.
• The isolated observability profile scrapes all three web containers by direct target with a file-based Bearer credential, provisions a four-panel Grafana dashboard, and routes the up == 0 rule through Alertmanager. The canonical drill observed both firing and resolved webhooks for the exact stopped replica, restored all three targets, and left database counts unchanged.
• The remaining rows above are still pending; this document is not a completion claim for the entire hardening goal.