M37: complete production acceptance hardening

2026-08-10 23:19:26 +02:00
parent 9dfbd7c4bf
commit 26819354ee
4 changed files with 35 additions and 5 deletions
@@ -2817,3 +2817,22 @@ evidence yet."
  session probe 401.
 - Exact next action: run complete clean backend/frontend acceptance and the full five-minute
  browser suite, then commit/push, back up and deploy.
+
+## M37 — complete local acceptance and production guard calibration (2026-08-10)
+
+- The complete backend suite passed **249/249** against an isolated clean PostgreSQL
+  database. Ruff is clean, mypy reports no issues across 58 source files and the final
+  migration/seed path remains reproducible.
+- The complete Playwright matrix passed **153/153 in 5.7 minutes** with one worker. This
+  covers the five-minute scenario, recruiter entry, booking readiness/rescheduling,
+  operational CRUD, Data Quality resolution, privacy, RAG/MCP evidence, three locales,
+  keyboard behavior and responsive layouts from 360 px through 1440 px.
+- Frontend TypeScript lint and production build passed; the production dependency audit
+  reports zero vulnerabilities. The rebuilt Nginx configuration passes `nginx -t`.
+- Demo reset cooldown is now explicitly passed into the API container. Acceptance can set
+  it to zero without weakening the advisory/process locks, while production defaults to
+  60 seconds. Login throttling remains active at ten requests/second with a 100-request
+  burst so a public demo is protected without rejecting the deterministic acceptance run.
+- Exact next action: commit and push M37, create and verify a live PostgreSQL backup,
+  deploy the committed archive, migrate to `c24f6a9d013e`, then repeat live acceptance and
+  restore the public reset cooldown to 60 seconds.