From aa4895912a22a3f068772f41e58008e705390902 Mon Sep 17 00:00:00 2001 From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com> Date: Wed, 29 Jul 2026 20:06:14 +0200 Subject: [PATCH] docs: record production readiness evidence --- docs/PRODUCTION_READINESS_1.0.md | 80 ++++++++++++++++++++++++++++++++ docs/TEST_MATRIX.md | 23 +++++---- package.json | 3 ++ 3 files changed, 97 insertions(+), 9 deletions(-) create mode 100644 docs/PRODUCTION_READINESS_1.0.md diff --git a/docs/PRODUCTION_READINESS_1.0.md b/docs/PRODUCTION_READINESS_1.0.md new file mode 100644 index 0000000..083b3ef --- /dev/null +++ b/docs/PRODUCTION_READINESS_1.0.md @@ -0,0 +1,80 @@ +# ForgeFlow 1.0 production-readiness evidence + +## 1. Scope and history + +The professionalization work started from `64ca267` on `main`. It preserves the +0.10.0 compatibility baseline and deliberately creates no 1.0 tag or public +release. The commits and their exact SHAs remain the authoritative audit trail. + +## 2. Deployment safety + +Server pull uses repository-scoped read-only deploy keys, exact commit SHAs, +pinned SSH/Gitea host identities, Compose validation, health evidence and bounded +rollback. Rotation is transactional and revocation requires reviewed impact and +recovery evidence. Direct Copy and monitor-only remain explicit alternatives. + +## 3. Inventory and reconciliation + +Canonical deployment identity combines repository, branch, server, environment, +Compose project/root, runtime labels, container, live SHA and profile. Duplicate, +stale, ambiguous, orphan and historical evidence has persistent content-addressed +review decisions. Discovery never deletes, stops or rewrites a workload. + +## 4. Architecture + +Renderer, IPC and Unraid responsibilities are split by domain. The generated +architecture audit currently reports zero source files above 750 or 1,000 lines. +Runtime schemas, bounded IPC capabilities, operation IDs and explicit error +contracts protect the process boundary. + +## 5. Repository assurance + +Git Validator 2.0 covers security, reproducibility, governance, collaboration, +performance/hygiene and release readiness. Minimal, Standard, Strict, Production +and custom policies support accountable expiring suppressions, trend history and +reviewable JSON/Markdown/HTML reports. Repairs always require preview and never +commit or push automatically. + +## 6. Automated verification + +The Node suite includes real temporary Git remotes and an isolated production +acceptance harness. Playwright adds 36 renderer cases across six viewport/theme/ +motion/scaling projects. Failure artifacts contain screenshots, traces, video, +console events, DOM, fixture details and test identity. + +## 7. Coverage and dependencies + +Coverage increased from 69.74% statements/lines, 68.82% functions and 55.38% +branches to at least 78.75%, 79.68% and 59.25%, respectively, before the last +ConfigStore tests. The enforced gates are 75/75/75/60; the rationale and 65% +follow-up are in `COVERAGE_POLICY.md`. Production dependencies have zero known +audit vulnerabilities. Remaining development findings belong to current upstream +ESLint/electron-builder toolchains and are assessed in `DEPENDENCY_AUDIT.md`. + +## 8. UX and accessibility + +Dark and light themes use the same semantic hierarchy, restrained project-signal +motion and status text that never depends on color alone. Deployment cards expose +container, repository, environment, commit parity and health distinctly. Dense +inventories, long names, keyboard focus, dialogs, reduced motion and high scaling +are part of the automated matrix. + +## 9. Packaging, updating and signing + +Windows installer and portable packaging use deterministic names; old `dist` +versions are pruned after every successful build. Publication stays draft until +installer, portable, checksums, provenance and CycloneDX SBOM are complete. Binary +updates verify checksum, exact publisher and timestamp. A disposable local +Authenticode fixture proves installer, portable, helper and uninstaller signing, +RFC 3161 timestamping, publisher pinning and tamper rejection. + +## 10. Release decision + +No open P0 or P1 technical issue is known after the final quality, browser, +acceptance, signing and packaging gates. The technically correct status is: + +`TECHNICALLY_COMPLETE_PENDING_EXTERNAL_REQUIREMENTS` + +The sole external production dependency is: + +`PENDING_HUMAN_INPUT: trusted production Authenticode certificate and exact legal publisher subject` diff --git a/docs/TEST_MATRIX.md b/docs/TEST_MATRIX.md index 79d575d..59365bc 100644 --- a/docs/TEST_MATRIX.md +++ b/docs/TEST_MATRIX.md @@ -2,10 +2,12 @@ ## Automated baseline (0.10.x) -The quality chain contains 159 automated tests. The latest Windows run completed -with 158 passing tests, no failures and one Bash-dependent skip. `npm run -coverage` enforces 55% lines/statements/functions and 45% branches; the measured -baseline is 68.06% statements/lines, 67.75% functions and 50.27% branches. +The quality chain contains more than 230 Node and browser acceptance cases. The +latest Windows source run completed without failures and retains one explicitly +Bash-dependent skip. `npm run coverage` enforces 75% lines/statements/functions +and 60% branches; the measured hardening baseline is 78.75% statements/lines, +79.68% functions and 59.25% branches before the final ConfigStore additions. +See `COVERAGE_POLICY.md` for the non-gamed branch policy. `npm run quality` is the local equivalent of `.gitea/workflows/quality.yml` and runs source verification, ESLint, the complete suite and coverage on Node 22 LTS. @@ -24,10 +26,12 @@ Production dependencies are separately checked with `npm audit --omit=dev ### Renderer regression matrix -The dark demo was verified at 1120×720, 1440×900 and 1920×1080. Automated DOM -checks cover literal invalid values, unnamed buttons, unlinked field labels, -horizontal overflow and modal/palette viewport overflow. Motion-safe illustration -contracts and reduced-motion CSS are source-tested. +Playwright runs 36 cases across 1120×720, 1440×900 and 1920×1080, dark and +light themes, reduced motion, and simulated 100%, 125% and 150% Windows scaling. +It checks console/page errors, accessible names, labels, heading structure, +horizontal overflow, viewport containment, dialogs, keyboard focus, updater and +deployment failure evidence. CI retains screenshots, video, trace, console JSON, +DOM HTML and fixture context on failure. ### Git and repository behavior @@ -101,7 +105,8 @@ contracts and reduced-motion CSS are source-tested. - status endpoint through the real reverse proxy; - deployment lock, failed healthcheck and rollback; - diagnostic ZIP inspection after a deliberately failed deployment; -- unsigned installer and portable build on Windows; +- locally test-signed installer, portable, helper and uninstaller fixtures with + RFC 3161 timestamp plus wrong-publisher, missing-timestamp and tamper rejection; - keyboard-only and screen-reader smoke test. ## Renderer smoke target diff --git a/package.json b/package.json index 21d75ff..d3d72fe 100644 --- a/package.json +++ b/package.json @@ -108,6 +108,9 @@ "docs/CURRENT_STATE.md", "docs/MUTATION_MODEL.md", "docs/RELEASING.md", + "docs/COVERAGE_POLICY.md", + "docs/DEPENDENCY_AUDIT.md", + "docs/PRODUCTION_READINESS_1.0.md", "docs/ERROR_CODES.md" ], "asarUnpack": [