feat: production readiness hardening

.dockerignore

@@ -0,0 +1,34 @@
+# Local dependencies and generated outputs
+**/node_modules
+dist
+**/dist
+**/android/.gradle
+**/android/app/build
+**/ios/build
+
+# Repository metadata and local development files
+.git
+.github
+.devcontainer
+.vscode
+.idea
+*.log
+*.tmp
+*.swp
+
+# Evidence and local environment material
+artifacts
+coverage
+bis-evidence
+.env
+.env.*
+!.env.example
+
+# Dependency-specific caches
+.pnpm-store
+.npm
+.yarn
+__pycache__
+*.pyc
+.target
+target

.github/branch-protection.json

@@ -4,20 +4,22 @@
     "required_status_checks": {
       "strict": true,
       "contexts": [
-        "Node.js CI / test",
-        "Go CI / test",
-        "Rust CI / test",
-        "Python CI / test",
-        "Security Scan / codeql-analyze",
-        "Docker Build / build"
+        "node-tests",
+        "gateway-race",
+        "archive-worker",
+        "mobile-security",
+        "CodeQL (JavaScript/TypeScript)",
+        "CodeQL (Go)",
+        "CodeQL (Python)",
+        "CodeQL (Rust)"
       ]
     },
-    "enforce_admins": false,
+    "enforce_admins": true,
     "required_pull_request_reviews": {
       "dismissal_restrictions": {},
       "dismiss_stale_reviews": true,
       "require_code_owner_reviews": true,
-      "required_approving_review_count": 1
+      "required_approving_review_count": 2
     },
     "restrictions": null,
     "required_linear_history": true,
@@ -29,11 +31,9 @@
     "allow_fork_syncing": false
   },
   "notes": [
-    "Apply via: gh api repos/{owner}/{repo}/branches/main/protection -X PUT --input .github/branch-protection.json",
-    "Requires admin access to the repository",
-    "All CI checks must pass before merge",
-    "At least 1 code owner review required",
-    "Stale reviews are dismissed on new commits",
-    "Linear history (no merge commits) required"
+    "Apply only after the named checks appear on a pull request with: gh api repos/{owner}/{repo}/branches/main/protection -X PUT --input .github/branch-protection.json",
+    "Requires repository administration and should be reviewed as a change-control operation.",
+    "The protected production environment in .github/workflows/production-promotion.yml adds a separate manual approval after staging device/KMS and OBS-001 gates pass.",
+    "No mutable image tag, host-side image build, unreviewed migration, or unapproved production environment deployment is accepted by the promotion workflow."
   ]
 }

.github/codeql/bis-rust-models/README.md

@@ -0,0 +1,45 @@
+# BIS Rust CodeQL transport-security model pack
+
+This model pack teaches CodeQL Rust analyses about two narrow, reviewed boundaries:
+a successful `TrustedEndpoint::parse` result is a validated endpoint, and a
+`BoundedGatewayPayload::into_bytes` result is a fixed-capacity HTTP body. The
+endpoint parser enforces an absolute HTTPS URL, an exact configured host allow-list,
+and rejects userinfo, query strings, and fragments.
+
+## Security scope
+
+The model contains exactly two narrow barriers:
+
+```text
+<bis_transport_policy::TrustedEndpoint>::parse
+  -> ReturnValue.Field[core::result::Result::Ok(0)]
+  -> request-forgery
+
+<fluvio_velocity::BoundedGatewayPayload>::into_bytes
+  -> ReturnValue
+  -> resource-exhaustion
+```
+
+It does **not** model `with_path_segments` or the gateway payload encoder as a
+barrier. Any future request-derived path segment or unbounded serialization path
+therefore remains visible to CodeQL. Do not add a broader barrier or neutral model
+without a security review and a negative test.
+
+## Publishing
+
+1. Review the model against the current canonical Rust path in the CodeQL
+   database and bump `version` in `qlpack.yml` for any semantic change.
+2. Run the manual-only **Publish BIS CodeQL Rust Model Pack** workflow.
+3. Confirm the immutable `munisp/bis-rust-models@<version>` package exists in
+   the organization GitHub Container Registry.
+4. Enable `.github/codeql/codeql-config.published-model-pack.yml` for the
+   Rust-specific CodeQL initialization, pinning the exact published version.
+5. Verify the next CodeQL comparison resolves only the intended trusted-endpoint
+   SSRF flows and fixed-capacity payload conversion, while still reporting a
+   deliberately unsafe path-segment or unbounded-serialization regression.
+
+## Rollback
+
+Revert the CodeQL configuration reference to the prior known-good model-pack
+version. Do not delete a published immutable package version or dismiss a
+security alert merely because analysis configuration changed.

.github/codeql/bis-rust-models/models/trusted-endpoint.yml

@@ -0,0 +1,14 @@
+extensions:
+  - addsTo:
+      pack: codeql/rust-all
+      extensible: barrierModel
+    data:
+      # TrustedEndpoint::parse rejects non-HTTPS schemes, non-allow-listed hosts,
+      # userinfo, query strings, and fragments before it returns Ok(endpoint).
+      # This barrier deliberately does not model with_path_segments so future
+      # user-controlled path segments remain visible to request-forgery analysis.
+      - ["<bis_transport_policy::TrustedEndpoint>::parse", "ReturnValue.Field[core::result::Result::Ok(0)]", "request-forgery", "manual"]
+      # BoundedGatewayPayload owns a fixed 16 KiB array and can only be built
+      # after every variable-width field and final serialized length are checked.
+      # Model only its conversion to an HTTP body; do not model the encoder itself.
+      - ["<fluvio_velocity::BoundedGatewayPayload>::into_bytes", "ReturnValue", "resource-exhaustion", "manual"]

.github/codeql/bis-rust-models/qlpack.yml

@@ -0,0 +1,7 @@
+name: munisp/bis-rust-models
+version: 0.1.0
+library: true
+extensionTargets:
+  codeql/rust-all: '>=0.0.0'
+dataExtensions:
+  - models/**/*.yml

.github/codeql/codeql-config.published-model-pack.yml

@@ -0,0 +1,7 @@
+# Activate this file only after munisp/bis-rust-models@0.1.0 is published
+# to the organization GitHub Container Registry and the repository workflow
+# is switched to a single Rust-language CodeQL initialization or equivalent
+# Rust-specific configuration.
+name: BIS CodeQL Configuration
+packs:
+  - munisp/bis-rust-models@0.1.0

.github/workflows/ci.yml

@@ -2,33 +2,34 @@ name: BIS Validation
 
 on:
   pull_request:
-    branches: [main]
+    branches: [main, hardening/production-readiness]
   push:
-    branches: [main]
+    branches: [main, hardening/production-readiness]
 
 permissions:
   contents: read
 
 jobs:
-  bff:
-    name: bff-validation
-    runs-on: ubuntu-latest
+  node-tests:
+    name: node-tests
+    runs-on: ubuntu-24.04
     services:
       postgres:
         image: postgres:16-alpine
         env:
-          POSTGRES_USER: bis_user
-          POSTGRES_PASSWORD: bis_secure_2026
-          POSTGRES_DB: bis_db
+          POSTGRES_USER: bis_ci
+          POSTGRES_PASSWORD: bis_ci_disposable_password
+          POSTGRES_DB: bis_ci
         ports:
           - 5432:5432
         options: >-
-          --health-cmd "pg_isready -U bis_user -d bis_db"
+          --health-cmd "pg_isready -U bis_ci -d bis_ci"
           --health-interval 10s
           --health-timeout 5s
-          --health-retries 5
+          --health-retries 10
     env:
-      DATABASE_URL: postgresql://bis_user:bis_secure_2026@localhost:5432/bis_db
+      DATABASE_URL: postgresql://bis_ci:bis_ci_disposable_password@localhost:5432/bis_ci
+      BIS_DATABASE_URL: postgresql://bis_ci:bis_ci_disposable_password@localhost:5432/bis_ci
       JWT_SECRET: ci-session-secret-not-for-production
       KEYCLOAK_URL: https://auth.bis.invalid
       KEYCLOAK_REALM: bis
@@ -42,11 +43,65 @@ jobs:
           cache: pnpm
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
-      - name: Initialize disposable PostgreSQL test schema
-        run: pnpm drizzle-kit push --force
+      - name: Apply canonical PostgreSQL migrations
+        run: pnpm db:migrate
       - name: Type-check
-        run: pnpm check --noEmit
+        run: pnpm check
       - name: Production build
-        run: pnpm run build
-      - name: Test
+        run: pnpm build
+      - name: Node integration suite
         run: pnpm test
+
+  gateway-race:
+    name: gateway-race
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: services/gateway/go.mod
+          cache-dependency-path: services/gateway/go.sum
+      - name: Gateway control-plane race suite
+        working-directory: services/gateway
+        run: go test -race ./...
+
+  archive-worker:
+    name: archive-worker
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: services/cold-archive-writer/go.mod
+          cache-dependency-path: services/cold-archive-writer/go.sum
+      - name: Archive worker static and race checks
+        working-directory: services/cold-archive-writer
+        run: |
+          go vet ./...
+          go test -race ./...
+
+  mobile-security:
+    name: mobile-security
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: |
+            pnpm-lock.yaml
+            bis-mobile/pnpm-lock.yaml
+      - name: Reject deprecated mobile client references
+        run: ./scripts/check-deprecated-mobile-references.sh
+      - name: Install typed AppRouter dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Install authoritative native client dependencies
+        working-directory: bis-mobile
+        run: pnpm install --frozen-lockfile --ignore-workspace
+      - name: Validate authoritative native client
+        working-directory: bis-mobile
+        run: |
+          pnpm typecheck
+          pnpm lint

.github/workflows/codeql.yml

@@ -2,9 +2,9 @@ name: CodeQL Security Analysis
 
 on:
   push:
-    branches: [main]
+    branches: [main, hardening/production-readiness]
   pull_request:
-    branches: [main]
+    branches: [main, hardening/production-readiness]
   schedule:
     - cron: "17 3 * * 1"