M44: harden release integrity and assurance

2026-08-21 18:32:02 +02:00
parent 9e4fca5708
commit acd8b82b09
55 changed files with 1081 additions and 335 deletions
@@ -1,5 +1,32 @@
 # Project state

+## M44 — release integrity and assurance hardening (2026-08-21)
+
+- Replaced mutable archive overlays with checksum-verified, commit-named release staging,
+  OCI revision-labelled API/web images, health-gated promotion and automatic application
+  rollback. Routine deployment no longer resets persisted demo data.
+- Scheduled backups now execute a weekly real restore into a disposable database and gate
+  health on both backup and restore-drill freshness. The isolated drill passed at Alembic
+  `4f2b9c8d7e61` with restored counts `2 users / 50 vehicles / 254 bookings / 1 audit event`.
+- Added Alertmanager routing with a continuous watchdog and an authenticated fifth n8n
+  workflow targeting the existing watched M365 owner mailbox. Added weekly Renovate,
+  API/web image vulnerability scans, tag-triggered CycloneDX SBOM evidence and immutable
+  image metadata.
+- Contract drift is now executable for OpenAPI, events, MCP endpoints and all five n8n
+  workflows. RAGcore generation failures open a bounded circuit breaker so grounded search
+  fallback avoids repeated five-second delays; provider-stage outcomes and retrieval scores
+  are measurable.
+- Added Axe accessibility, platform-independent visual regression, non-destructive
+  Chromium/Firefox canaries, frontend asset budgets and source-growth budgets. The checks
+  found and fixed two real WCAG contrast defects.
+- Validation: backend **271/271**, Playwright **155/155** in 4.6 minutes, live-safe canary
+  **4/4**, focused knowledge/observability **42/42**, frontend lint/build/audit/budgets,
+  contract gate, Compose rendering, Prometheus/Alertmanager validation and shell parsing
+  passed. The user approved the repository security policy before it was written.
+- Exact next action: commit and push M44, create a production backup, publish/test the alert
+  receiver, deploy the exact archive, run the non-destructive production canary and record
+  M45 live evidence.
+
 ## M43 — publish and redeploy review remediation (2026-08-21)

 - Published M41 hardening commit `24dcb3494c522fadf536fa9d6826450227aeff4e`