M48: harden demo operations and offsite recovery

scripts/check-source-budgets.py

@@ -5,10 +5,15 @@ from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[1]
 LINE_LIMITS = {
-    "backend/app/services/data_quality.py": 950,
-    "frontend/src/pages/DataQualityIssueDetail.tsx": 850,
+    "backend/app/services/data_quality.py": 900,
+    "backend/app/services/data_quality_duplicate_scan.py": 150,
+    "frontend/src/pages/DataQualityIssueDetail.tsx": 700,
+    "frontend/src/pages/data-quality/DuplicateCustomerPanel.tsx": 250,
+}
+BYTE_LIMITS = {
+    "frontend/src/styles.css": 78_000,
+    "frontend/src/styles-data-quality.css": 8_000,
 }
-BYTE_LIMITS = {"frontend/src/styles.css": 84_000}
 
 failures: list[str] = []
 for relative, limit in LINE_LIMITS.items():

scripts/generate-release-provenance.py

@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+"""Generate inspectable release provenance for the images built by CI."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import subprocess
+from pathlib import Path
+
+IMAGES = {
+    "api": "mobilityops-api-release",
+    "web": "mobilityops-web-release",
+    "backup_tools": "mobilityops-backup-tools-release",
+}
+
+
+def sha256(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def main() -> None:
+    revision = os.environ.get("GITHUB_SHA", "")
+    if len(revision) != 40:
+        raise SystemExit("GITHUB_SHA must contain the full release revision")
+    images: dict[str, dict[str, str]] = {}
+    for name, image in IMAGES.items():
+        details = json.loads(
+            subprocess.check_output(["docker", "image", "inspect", image], text=True)
+        )[0]
+        labels = details.get("Config", {}).get("Labels", {}) or {}
+        if labels.get("org.opencontainers.image.revision") != revision:
+            raise SystemExit(f"revision label mismatch for {image}")
+        sbom = Path(f"mobilityops-{name.replace('_', '-')}-sbom.cdx.json")
+        images[name] = {
+            "reference": image,
+            "local_image_id": details["Id"],
+            "revision": labels["org.opencontainers.image.revision"],
+            "sbom": sbom.name,
+            "sbom_sha256": sha256(sbom),
+        }
+    provenance = {
+        "schema": "mobilityops.release-provenance.v1",
+        "revision": revision,
+        "repository": os.environ.get("GITHUB_REPOSITORY", "MobilityOps"),
+        "ref": os.environ.get("GITHUB_REF", ""),
+        "workflow_run": os.environ.get("GITHUB_RUN_ID", ""),
+        "images": images,
+    }
+    Path("release-provenance.json").write_text(
+        json.dumps(provenance, indent=2, sort_keys=True) + "\n", encoding="utf-8"
+    )
+
+
+if __name__ == "__main__":
+    main()

scripts/run-readonly-load-smoke.py

@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""Small dependency-free concurrency gate for the persisted read paths."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import math
+import time
+import urllib.error
+import urllib.request
+from concurrent.futures import ThreadPoolExecutor, as_completed
+
+PATHS = (
+    "/api/v1/dashboard",
+    "/api/v1/vehicles?page=1&page_size=25",
+    "/api/v1/bookings?page=1&page_size=25&sort=operational",
+    "/api/v1/data-quality/issues?status=open&page=1&page_size=25",
+    "/api/v1/audit?page=1&page_size=25",
+    "/api/v1/system/status",
+)
+
+
+def request(url: str, cookie: str, timeout: float) -> tuple[float, int]:
+    started = time.perf_counter()
+    try:
+        with urllib.request.urlopen(
+            urllib.request.Request(url, headers={"Cookie": cookie}), timeout=timeout
+        ) as response:
+            response.read()
+            status = response.status
+    except urllib.error.HTTPError as error:
+        status = error.code
+    return (time.perf_counter() - started) * 1000, status
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--base-url", default="http://localhost:1228")
+    parser.add_argument("--requests", type=int, default=240)
+    parser.add_argument("--concurrency", type=int, default=12)
+    parser.add_argument("--timeout", type=float, default=5.0)
+    parser.add_argument("--max-p95-ms", type=float, default=1500.0)
+    args = parser.parse_args()
+    if args.requests < 1 or args.concurrency < 1:
+        raise SystemExit("requests and concurrency must be positive")
+
+    login = urllib.request.Request(
+        f"{args.base_url.rstrip('/')}/api/v1/demo/login",
+        data=json.dumps({"role": "operations_manager"}).encode(),
+        headers={"Content-Type": "application/json"},
+        method="POST",
+    )
+    with urllib.request.urlopen(login, timeout=args.timeout) as response:
+        cookie = response.headers.get("Set-Cookie", "").split(";", 1)[0]
+    if not cookie:
+        raise SystemExit("demo login returned no session cookie")
+
+    base = args.base_url.rstrip("/")
+    work = [f"{base}{PATHS[index % len(PATHS)]}" for index in range(args.requests)]
+    results: list[tuple[float, int]] = []
+    with ThreadPoolExecutor(max_workers=args.concurrency) as executor:
+        futures = [executor.submit(request, url, cookie, args.timeout) for url in work]
+        results.extend(future.result() for future in as_completed(futures))
+
+    failures = [status for _, status in results if status != 200]
+    durations = sorted(duration for duration, _ in results)
+    p95 = durations[max(0, math.ceil(len(durations) * 0.95) - 1)]
+    print(
+        f"read-only load smoke: requests={len(results)} concurrency={args.concurrency} "
+        f"failures={len(failures)} p95_ms={p95:.1f} max_ms={durations[-1]:.1f}"
+    )
+    if failures:
+        raise SystemExit(f"read-only load smoke returned non-200 statuses: {sorted(set(failures))}")
+    if p95 > args.max_p95_ms:
+        raise SystemExit(f"p95 {p95:.1f} ms exceeds {args.max_p95_ms:.1f} ms")
+
+
+if __name__ == "__main__":
+    main()
+