M48: harden demo operations and offsite recovery

2026-08-21 22:17:49 +02:00
parent a24098c583
commit 00191e9b54
28 changed files with 1136 additions and 332 deletions
@@ -1,5 +1,33 @@
 # Project state

+## M48 — resilient synthetic-demo operations (2026-08-21)
+
+- Replaced routine Compose recreation with a stable Nginx gateway and a two-API/two-web
+  start-first promotion. The gateway atomically reloads revision-specific upstream aliases;
+  old replicas drain only after public readiness. A real rolling test sustained **300/300**
+  concurrent probes with zero failures. Database, backup and observability containers now
+  refresh only through an explicit infrastructure command.
+- Added an opt-in OneDrive off-site worker using rclone 1.75.0 rebuilt reproducibly with
+  patched Go 1.26.6. Every upload is downloaded, checksum/list verified and weekly restored
+  into a disposable database; retention and health markers are enforced. OAuth state stays
+  outside Git. The synthetic-only scope is explicit; introducing personal data remains out
+  of scope.
+- Added hourly external HTTPS/TLS and Chromium/Firefox canaries, an authenticated read-only
+  concurrency gate, healthchecks for all monitoring services, and tag evidence for the
+  API/web/backup images (CycloneDX, immutable metadata, hashes and provenance).
+- Split the two remaining source hotspots into bounded backend duplicate-scan and frontend
+  comparison/CSS modules, then tightened growth budgets around all extracted files.
+- Validation: backend **271/271**, Playwright **155/155**, frontend lint/build/audit,
+  Ruff, strict mypy, OpenAPI/event/MCP/n8n contracts, Compose rendering, ShellCheck,
+  actionlint, source budgets and shell/Python parsing passed. Read load sustained **360/360**
+  requests at concurrency 18 with p95 **292.6 ms**. Trivy 0.74 reports zero fixed
+  HIGH/CRITICAL findings for API and web; the first backup-tools scan caught stale Go
+  binaries, which were removed/rebuilt and then also scanned clean.
+- Exact next action: rebuild the final labelled backup-tools image, commit/push M48, create
+  and verify a production backup, deploy the exact archive, explicitly refresh monitoring,
+  run live acceptance and image scans, then record final evidence. OneDrive activation
+  remains a one-time interactive Microsoft OAuth action after deployment.
+
 ## M47 — final production acceptance evidence (2026-08-21)

 - Promoted immutable M46 revision `95c91797fa2c599443d69d9c96d83a85ee0711f7`