# Milestone 6: Production Hardening

**Duration:** 2 weeks  
**Goal:** Deploy with confidence through testing, security audit, and operational documentation

## Tasks

### Week 11: Testing & Security

- [ ] Unit tests
  - Go: >80% coverage for all packages
  - Browser behavior: integration testing for embedded scripts
  - Mock external dependencies (email, filesystem)
  
- [ ] Integration tests
  - API endpoint testing
  - Database operation testing
  - Auth flow testing
  - Sync protocol testing
  
- [ ] End-to-end tests
  - User registration and login
  - Document creation and editing
  - Comment and notification flow
  - Conflict resolution
  - Search functionality
  
- [ ] Security audit
  - Dependency vulnerability scan (govulncheck, npm audit)
  - OWASP ZAP scan
  - Manual penetration testing guide
  - Rate limiting verification
  - Session security testing
  - File upload security testing

### Week 12: Operations & Documentation

- [ ] Backup and restore
  - Automated backup script (database + files)
  - Point-in-time recovery procedure
  - Backup encryption (optional)
  - Restore testing
  
- [ ] Monitoring
  - Health check endpoint (`/health`)
  - Metrics endpoint (`/metrics`) with Prometheus format
  - Error tracking and alerting
  - Log aggregation (structured JSON)
  
- [ ] Documentation
  - Installation guide
  - Upgrade procedures
  - Backup/restore procedures
  - Security incident response guide
  - Troubleshooting guide
  - API reference
  
- [ ] Load testing
  - 1000 concurrent readers
  - 100 concurrent editors
  - File sync stress test
  - Search performance under load

## Acceptance Criteria

### Functional
- [ ] >80% test coverage (Go + TypeScript)
- [ ] All integration tests pass
- [ ] All e2e tests pass
- [ ] Backup script creates restorable archive
- [ ] Restore procedure tested and documented
- [ ] Health check verifies: database, filesystem, email connectivity

### Non-Functional
- [ ] No critical or high-severity vulnerabilities
- [ ] No medium-severity vulnerabilities without documented mitigations
- [ ] Rate limiting prevents brute force attacks
- [ ] File uploads cannot execute code
- [ ] SQL injection impossible (parameterized queries only)
- [ ] XSS prevented (auto-escaping, CSP)

### Performance
- [ ] 1000 concurrent readers: p99 latency <500ms
- [ ] 100 concurrent editors: no sync conflicts lost
- [ ] Search performance: p99 <100ms under load
- [ ] Memory usage stable over 24-hour test (no leaks)

## Security Checklist

### Authentication
- [ ] Passkey registration works securely
- [ ] Passkey login validates signature
- [ ] Password hashing uses Argon2id
- [ ] Session cookies are signed and HttpOnly
- [ ] Session expiry is enforced
- [ ] Rate limiting on auth endpoints

### Authorization
- [ ] Permission checks on all endpoints
- [ ] No horizontal privilege escalation
- [ ] No vertical privilege escalation
- [ ] Content only served to authorized users

### Input Validation
- [ ] Markdown sanitized (no raw HTML injection)
- [ ] File uploads validated (magic numbers, size)
- [ ] Path traversal prevented
- [ ] SQL injection impossible
- [ ] XSS prevented

### Transport
- [ ] TLS 1.3 enforced
- [ ] HSTS header present
- [ ] CSP header restricts scripts
- [ ] CORS restrictive

### Operational
- [ ] No secrets in logs
- [ ] No secrets in environment (config file or encrypted)
- [ ] Container runs as non-root
- [ ] Read-only filesystem except /data
- [ ] Resource limits configured

## Deliverables

1. Test suite (unit, integration, e2e)
2. Security audit report
3. Backup/restore scripts
4. Monitoring dashboard configuration
5. Operator documentation
6. Load test results

## Risk Mitigation

| Risk | Mitigation |
|------|-----------|
| Security vulnerability found | Patch immediately, assess impact, notify users |
| Data loss | Automated backups, point-in-time recovery tested |
| Performance degradation | Monitoring alerts, load testing, scaling plan |
| Dependency vulnerability | Automated scans, rapid patching process |

## Definition of Done

- [ ] All acceptance criteria pass
- [ ] Security audit signed off
- [ ] Load tests meet targets
- [ ] Documentation complete and reviewed
- [ ] CI/CD pipeline green
- [ ] Rollback procedure tested
- [ ] Team trained on operations procedures