Phase 9 — Hardening, operations and launch readiness

[b5463]

Part of Milestone E — Intelligence and Launch. Ref: #27

Make V4 safe enough to run a real public portfolio and real paid products.

---

Alex tasks

Security hardening

• RBAC roles: owner / admin / operator / commerce / viewer
• TOTP enforced option
• Session revocation
• Secret write-only UI (write but never display raw value)
• Integration key hashing
• Licence signing key rotation tooling
• Stripe webhook signing enforcement
• Public API allowlist automated enforcement and audit (no container IDs, ports, repo URLs, logs, admin IDs, customer/billing data, secret names)
• Admin audit coverage audit (every dangerous action has an audit event)
• Rate limits per route class

Media quarantine pipeline

• SVG/script sanitization
• Malware detection and rejection
• Content-type verification by bytes (not just file extension)
• Responsive variant generation
• Focal point and alt-text recording
• Metadata stripping

Emergency controls

• Revoke all sessions
• Disable/rotate all credentials
• Freeze deployments and publishing
• Quarantine product routes
• Activate maintenance mode platform-wide

Structured observability

• JSON logging standard enforced across all services
• Request ID correlation across checkout / webhook / deployment flows
• Latency and error rate metrics
• Secret redaction rules (product keys, signing keys must never appear in logs)
• Traces across critical flows

Reliability drills

Verify backup/restore on a clean host for each:

• PostgreSQL full restore
• Caddy route recovery
• Media restore
• Portfolio snapshot restore
• Commerce tables restore
• Entitlement restore
• Licence restore
• Job recovery

Operational runbooks

• V4_DEPLOY_RUNBOOK.md
• V4_ROLLBACK_RUNBOOK.md
• V4_STRIPE_INCIDENT_RUNBOOK.md
• V4_ENTITLEMENT_RECOVERY_RUNBOOK.md
• V4_BACKUP_RESTORE_RUNBOOK.md
• V4_LICENSING_KEY_ROTATION_RUNBOOK.md
• V4_DEVICE_RESET_RUNBOOK.md
• V4_APP_INTEGRATION_RUNBOOK.md

---

Tomas tasks

Load and resource protection testing

• Large upload cap
• Build concurrency cap
• Disk admission control
• Container memory limits
• Container CPU limits
• Analytics event flood
• Webhook burst
• Public catalog cache behaviour
• Renderer last-known-good snapshot under API outage

Legal/compliance launch gates

Coordinate sign-off before live commerce:

• Terms approved
• Privacy policy approved
• Cookie policy approved
• Digital content withdrawal flow approved
• Subscription cancellation wording approved
• VAT/accounting flow approved (Slovak professional review)
• Refund/complaints flow approved
• GDPR export/delete flow reviewed
• Accessibility baseline checked

Runbooks

• V4_DOMAIN_RECOVERY_RUNBOOK.md
• V4_SECURITY_INCIDENT_RUNBOOK.md

Launch rehearsal (coordinate both devs)

• Deploy portfolio renderer
• Publish SK/EN snapshot
• Deploy test product
• Create offer
• Run Stripe test purchase
• Create entitlement
• Redeem licence
• Simulate failed payment
• Simulate recovery
• Simulate refund
• Restore backup on clean machine
• Roll back product release
• Roll back portfolio snapshot

---

Exit gate

V4 is launch-ready only when:

• All V4 tests pass
• All old tests pass
• Restore drill passes
• Test purchase passes
• Test subscription lifecycle passes (all 13 states)
• Public snapshot works while API is down
• No critical security findings open
• Legal/accounting review complete
• Operator can recover from failed deploy / domain / payment / key-rotation scenarios