Phase 4 wave 1 + staging environment + security audit fixes #2

Merged

Stanektechcz merged 19 commits from phase-4/reviews-orders into main

2026-09-27 04:02:45 +02:00

Stanektechcz commented

2026-09-26 23:55:23 +02:00

(Migrated from github.com)

Summary

Phase 4 wave 1: config baseline (P4-00), platform foundations (P4-04), reviews/verification/orders schema (P4-02), pure engines with exact prototype parity (P4-03)
Staging environment (A-39), local stack without Docker, Linux deploy kit, staging release-candidate CI workflow, smoke test, runbook
Security audit fixes: host allowlist + forced root URL, security headers, auth throttling, reset enumeration, session logout on password change, demo AggregateRating removed
Readiness audit: docs/audit/2026-09-26-readiness-audit.md; backlog F-20..F-45

Test plan

Pest 2 174 tests (2 163 passed, 11 skipped) locally on SQLite; Larastan L7 0; Pint clean; parity --check clean
Local staging from a clean clone: smoke 26/26 PASS, merchant login
CI: tests (SQLite, PostgreSQL 16 + Meilisearch, frontend)
CI: staging release candidate (no-dev build, Redis + Horizon, smoke)

🤖 Generated with Claude Code

## Summary - Phase 4 wave 1: config baseline (P4-00), platform foundations (P4-04), reviews/verification/orders schema (P4-02), pure engines with exact prototype parity (P4-03) - Staging environment (A-39), local stack without Docker, Linux deploy kit, staging release-candidate CI workflow, smoke test, runbook - Security audit fixes: host allowlist + forced root URL, security headers, auth throttling, reset enumeration, session logout on password change, demo AggregateRating removed - Readiness audit: docs/audit/2026-09-26-readiness-audit.md; backlog F-20..F-45 ## Test plan - [x] Pest 2 174 tests (2 163 passed, 11 skipped) locally on SQLite; Larastan L7 0; Pint clean; parity --check clean - [x] Local staging from a clean clone: smoke 26/26 PASS, merchant login - [ ] CI: tests (SQLite, PostgreSQL 16 + Meilisearch, frontend) - [ ] CI: staging release candidate (no-dev build, Redis + Horizon, smoke) 🤖 Generated with [Claude Code](https://claude.com/claude-code)