# P09-T01 local runtime validation follow-up Scope: the user requested all tests on this machine's IP, with no real server. Baseline `c51fa03f57b0c9f0a429e41c51bbd21ff2dcbb9c`; branch `codex/phase-09-production-validation`; publication scope LOCAL_ONLY. B-BR-001/002/004/005/008/011/014/016 and BUC-001…008 guide existing behavior; no new trust, payment or tenant rules are introduced. ## Demonstrated regressions and corrections - Public identity routes were specified but not mounted. The actual process now exposes bounded challenge, registration and two-key rotation endpoints. - Valid `GASOLINE_REGULAR` contributions were refused by applying the Portuguese ANP-label parser to the wire enum; exact wire products/units are now checked without rewriting money or silently accepting a mismatched unit. - Signed registration/rotation could consume challenges with substituted nonce, purpose or fingerprint metadata. Regression tests failed before the binding checks. Server metadata/time now govern proofs, both rotation proofs bind the same new-key intent, and concurrent old-key revocation has exactly one winner. - Trailing/duplicate JSON, oversized/truncated bodies, expired-equality and excessive-future signature windows are rejected. Production configuration requires an explicit canonical host and persistent cursor signing key. - Private reads and mutations no longer turn into 304 through If-None-Match; public weak ETags use HTTP syntax. Request IDs are bounded/sanitized and agree between response header and error envelope. - Storage redirects were followed; tests demonstrated three redirected requests. Transfers now refuse them and omit presigned URLs/remote bodies from errors. - API readiness previously checked only connectivity. It now verifies all embedded migration checksums; worker startup rejects incompatible schemas. - The pinned Caddy image rejected the original global trusted-proxy directive. Corrected syntax validates, and access/runtime filters remove request and response-header objects (precise queries, socket IPs and custom proofs). ## Local matrix Completed 2026-09-30, local-only. Tested backend/contracts/infra/scripts/Makefile fingerprint: `48dc47514dba28cb4862c63611d75dd1bf6367e154036ec9c2a182070cfd2e8c`. No immutable release candidate or remote CI is claimed. Logs remain in `/tmp/anpfuel-production-validation/`; full report is `final4/summary.json`. - `make test-local-backend`: PASS. All unit/race suites: 666 passing test events, 47 packages; all integration/race suites: 818 passing test events, 59 packages. Integration includes the unit cases, so counts must not be added as distinct tests. One intentional skip is `TestGenerateVectors` (fixture authoring helper), not a backend acceptance case. No failures or data races. - Actual API + worker + private S3 process flow: PASS. Actual API with storage deliberately absent: PASS (503, no false evidence acceptance). - `go vet`, `staticcheck`, `sqlc vet`: PASS. `govulncheck`: zero findings. - Infrastructure mutation harness: 7/7; deploy/rollback harness: 9/9; encrypted backup/corruption/password/retention checks: 10/10; restore with deletion-ledger replay and guarded disposal: 9/9. These use only the isolated Compose DB. Environment-cleaned subprocesses preserve its project identity. - Load: 30,860 origin requests in the bounded 20-second profile, p95 22.2 ms, zero 5xx; DB timeout/fail-closed/recovery, denied anonymous upload and capped disk-pressure harness: 7/7. This is a workstation smoke, not capacity acceptance. - Pinned Caddy with a temporary internal CA: PASS for TLS 1.2/1.3, ready/live, forbidden routes and query/cookie/custom-proof privacy on successful requests and a real upstream connection failure (502). No host trust-store changes. - Required local `quick-verify`: PASS, full selection, 9 seconds; gofmt/build/vet, selected behavior suites, staticcheck, sqlc generation/diff, OpenAPI lint (zero errors/warnings, nine informational notices), secret review and vuln scan. - G09 record harness: PASS (BLOCKED record; COMPLETE/missing-blocker refusal). `git diff --check`: PASS. No CI checks were bypassed or claimed as run remotely. The repeatable entry point is `make test-local-backend`, with an isolated dynamic- port Compose project, tmpfs PostGIS 18/PostGIS 3.6 and pinned private S3 emulator. `make test-local-edge` uses the pinned Caddy 2.10.2 image and ephemeral internal CA. The real HTTP scenario checks registration/duplicate identity, reads, exact price, idempotent/conflicting/replayed writes, owner isolation, private upload, valid JPEG, malformed JPEG rejection, worker validation, independent confirmation, self-vote refusal, dispute and key substitution/revocation. Missing storage explicitly returns 503 in a separate actual-process run. Moderation, export/erasure, consensus, leases, migration recovery and concurrency retain real-PostGIS suite coverage; this is not a claim that unmounted privacy HTTP routes were exercised. ## Limits and local runtime The API is bound to `172.19.2.11:18093`, with isolated validation DB/storage and ANP discovery disabled. Temporary configuration contains synthetic credentials only and is not committed. Images are test fixtures, not a production storage recommendation. The main local suite removes only its unique Compose project; the review API uses separate dedicated validation containers. Local HTTP/internal-CA TLS/S3, bounded workstation load, local restore/deletion replay and adapter-based operator tests do not prove real R2/CDN/public TLS, off-host disaster recovery, production capacity or legal acceptance. G09 stays BLOCKED; no Android implementation, release tag, production deployment or wiki sync occurred in this local-only follow-up. ## Later policy decision (2026-09-30) This record preserves the local test outcome and old release-order snapshot. ADR-014 now permits app development after G09-LOCAL protected integration and defers real-production G09 until functional G18. The source fingerprint and test limitations above remain unchanged. New accounts/social/media/location functionality is planned separately, not covered by these earlier runtime results.