docs: add project planning documents

2026-04-28 23:59:45 -04:00
commit 8e6646499f
16 changed files with 2343 additions and 0 deletions
--- a/docs/milestones/milestone-06-production.md
+++ b/docs/milestones/milestone-06-production.md
@@ -0,0 +1,150 @@
+# Milestone 6: Production Hardening
+
+**Duration:** 2 weeks  
+**Goal:** Deploy with confidence through testing, security audit, and operational documentation
+
+## Tasks
+
+### Week 11: Testing & Security
+
+- [ ] Unit tests
+  - Go: >80% coverage for all packages
+  - Preact: Component testing with uvu
+  - Mock external dependencies (email, filesystem)
+  
+- [ ] Integration tests
+  - API endpoint testing
+  - Database operation testing
+  - Auth flow testing
+  - Sync protocol testing
+  
+- [ ] End-to-end tests
+  - User registration and login
+  - Document creation and editing
+  - Comment and notification flow
+  - Conflict resolution
+  - Search functionality
+  
+- [ ] Security audit
+  - Dependency vulnerability scan (govulncheck, npm audit)
+  - OWASP ZAP scan
+  - Manual penetration testing guide
+  - Rate limiting verification
+  - Session security testing
+  - File upload security testing
+
+### Week 12: Operations & Documentation
+
+- [ ] Backup and restore
+  - Automated backup script (database + files)
+  - Point-in-time recovery procedure
+  - Backup encryption (optional)
+  - Restore testing
+  
+- [ ] Monitoring
+  - Health check endpoint (`/health`)
+  - Metrics endpoint (`/metrics`) with Prometheus format
+  - Error tracking and alerting
+  - Log aggregation (structured JSON)
+  
+- [ ] Documentation
+  - Installation guide
+  - Upgrade procedures
+  - Backup/restore procedures
+  - Security incident response guide
+  - Troubleshooting guide
+  - API reference
+  
+- [ ] Load testing
+  - 1000 concurrent readers
+  - 100 concurrent editors
+  - File sync stress test
+  - Search performance under load
+
+## Acceptance Criteria
+
+### Functional
+- [ ] >80% test coverage (Go + TypeScript)
+- [ ] All integration tests pass
+- [ ] All e2e tests pass
+- [ ] Backup script creates restorable archive
+- [ ] Restore procedure tested and documented
+- [ ] Health check verifies: database, filesystem, email connectivity
+
+### Non-Functional
+- [ ] No critical or high-severity vulnerabilities
+- [ ] No medium-severity vulnerabilities without documented mitigations
+- [ ] Rate limiting prevents brute force attacks
+- [ ] File uploads cannot execute code
+- [ ] SQL injection impossible (parameterized queries only)
+- [ ] XSS prevented (auto-escaping, CSP)
+
+### Performance
+- [ ] 1000 concurrent readers: p99 latency <500ms
+- [ ] 100 concurrent editors: no sync conflicts lost
+- [ ] Search performance: p99 <100ms under load
+- [ ] Memory usage stable over 24-hour test (no leaks)
+
+## Security Checklist
+
+### Authentication
+- [ ] Passkey registration works securely
+- [ ] Passkey login validates signature
+- [ ] Password hashing uses Argon2id
+- [ ] Session cookies are signed and HttpOnly
+- [ ] Session expiry is enforced
+- [ ] Rate limiting on auth endpoints
+
+### Authorization
+- [ ] Permission checks on all endpoints
+- [ ] No horizontal privilege escalation
+- [ ] No vertical privilege escalation
+- [ ] Content only served to authorized users
+
+### Input Validation
+- [ ] Markdown sanitized (no raw HTML injection)
+- [ ] File uploads validated (magic numbers, size)
+- [ ] Path traversal prevented
+- [ ] SQL injection impossible
+- [ ] XSS prevented
+
+### Transport
+- [ ] TLS 1.3 enforced
+- [ ] HSTS header present
+- [ ] CSP header restricts scripts
+- [ ] CORS restrictive
+
+### Operational
+- [ ] No secrets in logs
+- [ ] No secrets in environment (config file or encrypted)
+- [ ] Container runs as non-root
+- [ ] Read-only filesystem except /data
+- [ ] Resource limits configured
+
+## Deliverables
+
+1. Test suite (unit, integration, e2e)
+2. Security audit report
+3. Backup/restore scripts
+4. Monitoring dashboard configuration
+5. Operator documentation
+6. Load test results
+
+## Risk Mitigation
+
+| Risk | Mitigation |
+|------|-----------|
+| Security vulnerability found | Patch immediately, assess impact, notify users |
+| Data loss | Automated backups, point-in-time recovery tested |
+| Performance degradation | Monitoring alerts, load testing, scaling plan |
+| Dependency vulnerability | Automated scans, rapid patching process |
+
+## Definition of Done
+
+- [ ] All acceptance criteria pass
+- [ ] Security audit signed off
+- [ ] Load tests meet targets
+- [ ] Documentation complete and reviewed
+- [ ] CI/CD pipeline green
+- [ ] Rollback procedure tested
+- [ ] Team trained on operations procedures