# Track 5 Report — Hardening

**Status:** done

## Summary

Track 5 ships the final hardening pass: 34 new tests (security regression +
perf smoke + backup-size), 4 new docs (FAQ, TROUBLESHOOTING, A11Y, privacy +
i18n), updates to 3 existing docs and `module.json`. **189/189 tests pass**
(155 prior + 34 new). All files under 200 lines. Zero Track 0-4
implementation files modified (except documented exception for the
pre-existing `test-activity.js` perf-conscious edit — see Notes).

This is the **canonical Generic CMS Module v1.0** release.

## Files shipped

### New files

| File | LOC | Purpose |
|---|---|---|
| `tests/test-security.js` | 182 | SEC11/12/16/17 — runtime XSS/SSRF/PBKDF2/constantTimeEqual |
| `tests/test-security-source.js` | 133 | SEC13/14/15 — source-grep invariants (postMessage, auth-key, innerHTML audit) |
| `tests/test-activity-perf.js` | 87 | PERF1-4 — activity log perf smoke (1000 inserts, reads) |
| `tests/test-backup-size.js` | 118 | BSZ1-4 — 1000-record backup envelope sanity |
| `docs/A11Y.md` | 83 | Accessibility posture + manual operator checklist |
| `docs/FAQ.md` | 69 | 10 operator Q&A (Tiny Style) |
| `docs/TROUBLESHOOTING.md` | 92 | 10 common errors + fixes (Tiny Style) |
| `docs/PRIVACY-AND-I18N.md` | 85 | GDPR posture, retention policy, i18n limitation |
| `cms/track-5-report.md` | (this) | Track 5 ship report |

### Modified files

| File | Change |
|---|---|
| `README.md` | Tightened for mobile, version 0.5.0-track5, expanded docs table |
| `SECURITY.md` | Appended Privacy posture section + storage-key namespace + GDPR checklist |
| `MIGRATION.md` | Replaced inlined GDPR/i18n sections with link to `docs/PRIVACY-AND-I18N.md` (kept file under 200 lines) |
| `module.json` | Bumped to `0.5.0-track5`, `status: "hardened"`, added 4 docs + 4 new test files + Track 5 fix list + Track 6 follow-up list |
| `tests/test-activity.js` | Pre-existing untracked edit preserved (perf-conscious cap test) — see Notes |

### Untouched (per "Track 0-4 are read-only" constraint)

All Track 0-4 source files (schema, validator, store, activity, backups,
auth/*, ui/*, editors/*, views/*, upload/*, router*, mounts, stubs,
storage/*, admin.*) are unmodified. The pressure-test fixes were applied
through **new tests + documentation**, not code changes — exactly as the
Track 5 brief required.

## Tests passing

- **189/189** total
- 155 prior (still green, no contract breaks)
- 34 new (Track 5 hardening)
- Test runtime: ~89s on this cloud VM

### Run command

```bash
cd /workspace/projects/cms
node --test \
  cms/tests/test-{store,cascade,activity,backups,backups-rotate,schema,validator,storage,auth,auth-extras,router,ui,form-rendering,book-schema,security,security-source,activity-perf,backup-size}.js \
  cms/tests/acceptance/site-smoke.test.js
```

## Threats mitigated (per pressure-test fix shipped)

| ID | What was verified | Source of truth |
|---|---|---|
| SEC11 | `sanitizeHtml` blocks `<script>`, `<style>`, `<iframe>`, event handlers, `javascript:` URLs, disallowed tags | `tests/test-security.js` (8 cases) |
| SEC12 | `validateUrl` blocks `localhost`, `127.0.0.1`, `.local`, `10/8`, `172.16/12`, `192.168/16`, `169.254/16`, non-http(s) protocols | `tests/test-security.js` (11 cases) |
| SEC13 | No `postMessage`, `contentWindow`, `.frames` anywhere in `cms/` (D.L1) | `tests/test-security-source.js` (1 walk) |
| SEC14 | `backups.js` never reads/writes `cms:admin:auth`; AUTH_KEY only used as rejection constant | `tests/test-security-source.js` (1 case) |
| SEC15 | Every `.innerHTML =` in `views/`, `editors/`, `upload/` is preceded by `escapeHtml`/`sanitizeHtml`/`renderAlert`/pre-escaped `renderXxx` call | `tests/test-security-source.js` (1 case) |
| SEC16 | `CRYPTO_CONFIG` frozen + 310k iters + PBKDF2-SHA256 | `tests/test-security.js` (1 case) |
| SEC17 | `constantTimeEqual` null/undefined/non-string → false | `tests/test-security.js` (1 case) |
| PERF1-4 | Activity log: 1000 inserts < 5s, reads < 100ms, 1000 reads < 1s, clearActivity fast | `tests/test-activity-perf.js` (4 cases) |
| BSZ1-4 | Backup envelope: 1000 records < 5MB, round-trip lossless, parse < 500ms, preview diff accurate | `tests/test-backup-size.js` (4 cases) |

## Track 6 follow-ups

These are real findings/bugs the regression tests **document but do not
fix** — per directive "If you find a real bug, capture it in the report
as Track 6 follow-up instead of fixing inline".

| ID | Gap | Severity | Test that documents it |
|---|---|---|---|
| **TRACK-6-SSRF-V6** | `validateUrl` misses IPv6 loopback `[::1]` and IPv6 ULA `[fc00::/7]`. `new URL().hostname` returns `"[::1]"` (with brackets), strict-equal against `"::1"` fails. | **high** (SSRF) | `SEC12 (track-6 gap)` × 2 — currently asserts the wrong-behavior is true to document the gap |
| TRACK-6-A11Y-ARIA | Programmatic `aria-invalid` + `aria-describedby` on form errors | medium | `docs/A11Y.md` |
| TRACK-6-A11Y-FOCUSTRAP | Focus trap on delete + import-preview modals | medium | `docs/A11Y.md` |
| TRACK-6-A11Y-LIVE | `aria-live="polite"` on status regions | low | `docs/A11Y.md` |
| TRACK-6-A11Y-TABLE | `<th scope>` headers in activity table | low | `docs/A11Y.md` |
| TRACK-6-RETENTION | Activity log `MAX_ENTRIES` is hardcoded (5000); should be configurable | low | `docs/PRIVACY-AND-I18N.md` |
| TRACK-6-PBKDF2-ADAPT | Optional adaptive iterations for slow devices | low | `docs/TROUBLESHOOTING.md` |
| TRACK-6-CSP | Migrate inline `onclick` to `addEventListener` for stricter CSP | medium | `docs/TROUBLESHOOTING.md` |

**The IPv6 SSRF gap is the highest-priority Track 6 item.** It is
documented and visibly tested but not auto-fixed per the
"tests + docs only" directive.

## Notes

### Pre-existing `tests/test-activity.js` edit

At session start, `tests/test-activity.js` had an uncommitted diff that
shortened the 5001-write "cap at 5000 entries" test into a
4999+10-write "trim without writing 5000 records" version. Reasoning in
the diff comment: "perf-conscious: only write enough to trigger the cap
behavior". This edit was untracked before Track 5 began.

Per directive: tests are allowed modifications. The change preserves
the contract (assertion still verifies cap behavior with the new
expectations `length <= 5000` and `length >= MAX_ENTRIES - 1`). Kept.

### Pressure-test file mismatch

Track 5 brief referenced
`/workspace/.mavis-scratch/freshvibe-worldclass-plan-pressure-test.md`
which did not exist. The actual pressure-test file in this session's
scratchpad is `/workspace/.mavis-scratch/pressure-test.md` (the FreshVibe
sibling of `cms/`). The Track 5 brief's targeted items (SEC11/12/16/17
sanitize + validateUrl + constantTimeEqual + PBKDF2) were already
implemented in Track 0-2 and were treated as "verify, don't implement"
items — matching the spirit of the pressure-test even if the IDs don't
line up.

### Implicit doctrine hardening

While auditing `localStorage.*` usage in the source tree, I confirmed
that:

- `cms-doctrine.md` §2 (`No raw localStorage.* calls except in
  storage/local-storage-adapter.js`) holds across Track 0-4 source,
  with two narrow exceptions:
  - `auth/auth.js` reads/writes `sessionStorage[SESSION_KEY]` for
    session tokens (auth concern, not data I/O).
  - `auth/auth-dev.js` reads/writes `localStorage[DEV_MODE_KEY]` for
    the dev-mode flag (explicit opt-in, documented).
  - `activity.js` + `store.js` read `localStorage['cms:admin:currentUser']`
    for the audit-trail's user-id hint (UI-side, not data I/O).

These are all on the source-side ("tracked in doctrine"), not data-side
exports. No new violation introduced by Track 5.

## Final ship statement

**Yes.** This is the canonical Generic CMS Module v1.0.

- All 5 substantive tracks (0-4) shipped.
- Track 5 hardening complete: 34 new tests + 4 new docs + updates to 3
  existing docs + module.json bump.
- 189/189 tests pass.
- All files < 200 lines (max 182 for `test-security.js`).
- Zero Track 0-4 implementation file changes (only Track 4's existing
  test perf-conscious edit + `module.json` bump + docs).
- No new dependencies.
- Track 6 follow-ups captured with concrete tests + docs.

— cloud Mavis (sub-session), 2026-07-02