This runbook executes the SOTA Phase 5 hardening gate:
- Pen test baseline
- Disaster recovery drill
Commands
pnpm pentest:baseline
pnpm dr:drill
Combined gate:
pnpm hardening:pen-dr
Pen test baseline
`pnpm pentest:baseline` runs `pnpm audit --json`, writes a summary artifact, and compares results against a committed baseline:
- Baseline: `config/security-audit-baseline.json`
- Artifact: `artifacts/security/pnpm-audit-summary.json`
Pass criteria:
- No severity bucket exceeds the baseline allowance.
- No net-new advisory IDs appear beyond baseline.
If dependency posture is intentionally updated, refresh baseline only after review:
pnpm pentest:baseline:record
DR drill
`pnpm dr:drill` performs a non-destructive restore rehearsal:
- File-backed rehearsal:
- Snapshot managed storage docs from `storage/*.json`; the managed-document list is centralized in `src/utils/storage.ts`
- Copy to timestamped backup and restore directories under `artifacts/dr-drill/<timestamp>/`
- Validate JSON parse and SHA-256 checksum equality after restore
- Postgres rehearsal (when storage mode is `postgres` or `double-write`):
- Snapshot managed `storage_documents` rows
- Rehydrate snapshot into a transaction-scoped temp table
- Verify row-level checksum parity
- Roll back transaction
Artifacts:
- `artifacts/dr-drill/latest.json`
- `artifacts/dr-drill/<timestamp>/summary.json`
Pass criteria:
- All recovered file checksums match original checksums.
- Postgres temp-table restore rehearsal verifies checksum parity, or is explicitly skipped in `file` mode.