cairnquire/.project/milestones/milestone-06-production.md

Milestone 6: Production Hardening

Duration: 2 weeks
Goal: Deploy with confidence through testing, security audit, and operational documentation

Tasks

Week 11: Testing & Security

• Unit tests

  • Go: >80% coverage for all packages
  • Browser behavior: integration testing for embedded scripts
  • Mock external dependencies (email, filesystem)

• Integration tests

  • API endpoint testing
  • Database operation testing
  • Auth flow testing
  • Sync protocol testing

• End-to-end tests

  • User registration and login
  • Document creation and editing
  • Comment and notification flow
  • Conflict resolution
  • Search functionality

• Security audit

  • Dependency vulnerability scan (govulncheck, npm audit)
  • OWASP ZAP scan
  • Manual penetration testing guide
  • Rate limiting verification
  • Session security testing
  • File upload security testing

Week 12: Operations & Documentation

• Backup and restore

  • Automated backup script (database + files)
  • Point-in-time recovery procedure
  • Backup encryption (optional)
  • Restore testing

• Monitoring

  • Health check endpoint (/health)
  • Metrics endpoint (/metrics) with Prometheus format
  • Error tracking and alerting
  • Log aggregation (structured JSON)

• Documentation

  • Installation guide
  • Upgrade procedures
  • Backup/restore procedures
  • Security incident response guide
  • Troubleshooting guide
  • API reference

• Load testing

  • 1000 concurrent readers
  • 100 concurrent editors
  • File sync stress test
  • Search performance under load

Acceptance Criteria

Functional

• >80% test coverage (Go + TypeScript)
• All integration tests pass
• All e2e tests pass
• Backup script creates restorable archive
• Restore procedure tested and documented
• Health check verifies: database, filesystem, email connectivity

Non-Functional

• No critical or high-severity vulnerabilities
• No medium-severity vulnerabilities without documented mitigations
• Rate limiting prevents brute force attacks
• File uploads cannot execute code
• SQL injection impossible (parameterized queries only)
• XSS prevented (auto-escaping, CSP)

Performance

• 1000 concurrent readers: p99 latency <500ms
• 100 concurrent editors: no sync conflicts lost
• Search performance: p99 <100ms under load
• Memory usage stable over 24-hour test (no leaks)

Security Checklist

Authentication

• Passkey registration works securely
• Passkey login validates signature
• Password hashing uses Argon2id
• Session cookies are signed and HttpOnly
• Session expiry is enforced
• Rate limiting on auth endpoints

Authorization

• Permission checks on all endpoints
• No horizontal privilege escalation
• No vertical privilege escalation
• Content only served to authorized users

Input Validation

• Markdown sanitized (no raw HTML injection)
• File uploads validated (magic numbers, size)
• Path traversal prevented
• SQL injection impossible
• XSS prevented

Transport

• TLS 1.3 enforced
• HSTS header present
• CSP header restricts scripts
• CORS restrictive

Operational

• No secrets in logs
• No secrets in environment (config file or encrypted)
• Container runs as non-root
• Read-only filesystem except /data
• Resource limits configured

Deliverables

1. Test suite (unit, integration, e2e)
2. Security audit report
3. Backup/restore scripts
4. Monitoring dashboard configuration
5. Operator documentation
6. Load test results

Risk Mitigation

Risk	Mitigation
Security vulnerability found	Patch immediately, assess impact, notify users
Data loss	Automated backups, point-in-time recovery tested
Performance degradation	Monitoring alerts, load testing, scaling plan
Dependency vulnerability	Automated scans, rapid patching process

Definition of Done

• All acceptance criteria pass
• Security audit signed off
• Load tests meet targets
• Documentation complete and reviewed
• CI/CD pipeline green
• Rollback procedure tested
• Team trained on operations procedures