M40: record hardening deployment evidence

2026-08-17 03:31:10 +02:00
parent ae39a8947f
commit ca66083c8b
1 changed files with 35 additions and 0 deletions
@@ -1,5 +1,40 @@
 # Project state
 ## M40 — publish and redeploy M39 (2026-08-17)
 - Published three validated commits to Gitea `master`: the backend dependency and secret
  CI gates (`6859249`, `a9f48d6`) plus the complete M39 hardening milestone (`ae39a89`).
  A fresh fetch confirmed local `HEAD` and `origin/master` both resolved to
  `ae39a8947fff1ec1b60116556ed411567b11f0d2` before deployment.
 - Local validation used freshly rebuilt API/web images: isolated PostgreSQL backend suite
  **261 passed** (one Alembic configuration deprecation warning), Ruff clean, mypy clean
  across 59 source files, frontend lint and production build clean, full and production
  npm audits at **0 vulnerabilities**, Trivy/secret scan clean, and Playwright
  **153/153 passed in 3.1 minutes**.
 - Created and verified the pre-deployment custom-format backup
  `backups/postgres/mobilityops-20260817T011857Z.dump`; checksum verification and
  `pg_restore --list` both passed. The committed source archive matched locally and on
  Unraid at SHA-256 `473293921717b7f1363689f4a152493797778ceb91f284cc21b5b68600803de6`.
 - Deployed the exact committed archive to `/mnt/user/appdata/mobilityops`, preserving
  `.env`, `.deploy`, volumes and the central n8n. API/web were rebuilt and recreated;
  PostgreSQL data remained on its named volume. Production secrets were verified as
  non-empty/non-placeholder without exposing their values. Readiness is `ready`, API,
  database, web and backup are healthy, and Alembic is `0a4c1d2e3f5b (head)`.
 - Live Playwright acceptance completed **152/153** on the first pass. The sole failure was
  the expected honest degradation path: one RAGcore request exhausted both bounded 5 s
  calls (`/v1/answers` then `/v1/search`) and rendered “knowledge service unavailable”
  while returning HTTP 200 and leaving operations unaffected. The complete guided-demo
  test passed on immediate focused rerun in **11.3 s**. The final API/web critical-log
  scan is clean.
 - Final hand-off state: all five synthetic scenarios are ready; reset cooldown is restored
  to 60 seconds; RAGcore and MCP Hub report operational. Central n8n is healthy and all
  four Fleet Ops workflows are active. Its aggregate state is temporarily `degraded`
  solely because the hourly quality-scan heartbeat is stale; there are zero unexpected
  delivery failures and the one failed outbox row is the labelled demo scenario.
 - Exact next action: no code or deployment work remains. Confirm the next scheduled
  quality-scan heartbeat clears the temporary stale n8n state; investigate the central
  workflow scheduler only if it does not.
 ## M39 — Hardening review (2026-08-16)
 Full-repository audit (backend, frontend, infra, docs) followed by targeted fixes. Every