Publish DevRunbook source

evidence/functional-visual-audit-2026-07-28.md

@@ -0,0 +1,49 @@
+# Functional and visual production audit — 2026-07-28
+
+## Scope
+
+The deployed Unraid release candidate on a private validation host was
+audited in an authenticated browser session before its requested move to port
+`1231`. The audit used the real PostgreSQL-backed application and did not rely
+on mocked production paths.
+
+## Functional evidence
+
+- Local authentication succeeded with the restricted validation account. Its
+  temporary audit credential was replaced by the original operator-managed
+  credential immediately after browser verification.
+- Library search for `accessibility` updated the URL to
+  `/library?q=accessibility` and returned the matching two-playbook result set.
+- Library, Collections, Repositories, Compose, Prompt Lab, Operations and
+  Integrations all rendered an accessible main landmark and page heading.
+- Creating an Accessibility Audit composer draft opened the governed seven-step
+  composer and rendered its live deterministic prompt preview.
+- The incomplete draft correctly remained blocked by compatibility and prompt
+  lint findings rather than permitting generation.
+- The optional Gitea integration rendered the explicit no-connection degraded
+  state and confirmed that local use remains available without Gitea.
+- `Ctrl+K` opened the keyboard-accessible command palette with focus in its
+  expanded search combobox and a navigable listbox.
+- System/light theme controls updated the document color scheme. The original
+  system-theme preference was restored after the check.
+- Browser warnings and errors across the audited session: zero.
+
+## Visual and responsive evidence
+
+- Desktop Library and Composer were visually reviewed at `1440 x 1000`.
+- Mobile Library, Collections, Repositories, Composer, Prompt Lab, Operations
+  and Integrations were checked at `390 x 844`.
+- Every measured primary route had `scrollWidth <= viewport width`; no
+  horizontal page overflow was observed.
+- The repaired Operations queue remained contained at the mobile breakpoint.
+- Navigation, typography, lifecycle/risk badges, cards, controls, prompt code
+  blocks, error states, focus state and bottom mobile navigation remained
+  legible and visually coherent in dark and light color schemes.
+- The application exposed a skip link, semantic banner/navigation/main regions,
+  named controls and structured dialog/listbox semantics in the inspected DOM.
+
+## Outcome
+
+No new functional, visual, console or responsive defect was found. No product
+code change was required by this audit. Deployment evidence for the subsequent
+Gitea push and port `1231` rollout is recorded separately in `CURRENT_STATE.md`.

evidence/performance-report.json

@@ -0,0 +1,26 @@
+{
+  "schemaVersion": 1,
+  "releaseCommit": "2e4d5d2",
+  "measuredAt": "2026-07-27T13:30:00Z",
+  "environment": {
+    "host": "Unraid validation server",
+    "node": "24",
+    "postgresql": "17.9",
+    "architecture": "linux/amd64"
+  },
+  "dataset": {
+    "playbookIdentities": 1000,
+    "versionsPerIdentity": 10,
+    "totalVersions": 10000,
+    "iterations": 30
+  },
+  "resultsMilliseconds": {
+    "searchP95": 241.913,
+    "searchTargetP95": 500,
+    "detailP95": 24.469,
+    "detailTargetP95": 400
+  },
+  "outcome": "passed",
+  "command": "pnpm release:benchmark --seed-and-benchmark --iterations=30",
+  "notes": "Executed against an isolated, explicitly acknowledged benchmark database. The disposable database and container resources were removed after recording results."
+}

evidence/security-scan-report.md

@@ -0,0 +1,18 @@
+# Release security scan report
+
+Release candidate scans were executed on the Unraid validation host on
+2026-07-27.
+
+| Check | Result | Evidence |
+| --- | --- | --- |
+| Production dependency audit | Pass | `pnpm audit --prod` reported no high or critical findings. One moderate `esbuild` development-server advisory remains through `better-auth > drizzle-kit`; the affected development server is not present or exposed in the production web/worker runtime. |
+| Runtime web image | Pass | Trivy 0.69.3 with `--scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1` reported zero findings for the Debian and Node package inventories. |
+| Runtime worker image | Pass | The same Trivy policy reported zero findings. |
+| Repository secret history | Pass | Gitleaks 8.28.0 scanned 153 commits and approximately 4.99 MB with no leaks. Two exact local-development/CI encryption fixtures are narrowly classified in `.gitleaks.toml`; no file-wide exclusion is used. |
+| Production license inventory | Pass | `pnpm licenses list --prod --json` inventoried 161 package records under 0BSD, Apache-2.0, BSD-2-Clause, BSD-3-Clause, CC-BY-4.0, ISC, LGPL-3.0-or-later, MIT, MPL-2.0 and Unlicense. No prohibited or unclassified license was found. |
+| Application security tests | Pass | The configured suite passed 2 files and 11 tests, including dependency and production-boundary checks. |
+
+The Node base image originally included unused npm, Corepack and Yarn files
+with high/critical findings in their bundled tooling. Commit `601e59e` removes
+those package managers from long-running runtime images; they remain available
+only in build/migration tooling where required.