Skip to main content

max / pom

Update deps and todo Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Author: Max J. <87768334+MaxJMath@users.noreply.github.com> · 2026-04-15 18:54 UTC
Commit: 7594eed414d8df6b41eece9dc69d264d7d28d526
Parent: e8ed35e
4 files changed, +3 insertions, -315 deletions
M Cargo.lock +1 -1
@@ -1665,7 +1665,7 @@ checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
1665 1665
1666 1666 [[package]]
1667 1667 name = "pom"
1668 - version = "0.3.2"
1668 + version = "0.3.3"
1669 1669 dependencies = [
1670 1670 "axum",
1671 1671 "chrono",
M Cargo.toml +1 -1
@@ -1,6 +1,6 @@
1 1 [package]
2 2 name = "pom"
3 - version = "0.3.2"
3 + version = "0.3.3"
4 4 edition = "2024"
5 5 license-file = "LICENSE"
6 6
D docs/archive/pom_todo_done.md -308
@@ -1,308 +0,0 @@
1 - # PoM — Completed Work
2 -
3 - Archived completed phases from todo.md. All items here are done.
4 -
5 - ---
6 -
7 - ## Phase 1 — Core Infrastructure
8 - Health checks, test orchestration, CLI, MCP server, SQLite storage.
9 -
10 - ### Done
11 - - [x] HTTP health checks with configurable targets and timeouts
12 - - [x] SSH test orchestration with CI output parsing
13 - - [x] CLI commands: health, test, status, history, prune
14 - - [x] MCP server mode (stdio transport)
15 - - [x] SQLite storage with WAL mode
16 - - [x] Per-target interval overrides
17 -
18 - ## Phase 2 — Serve Mode
19 - Background daemon with periodic health checks.
20 -
21 - ### Done
22 - - [x] Serve mode with per-target health check intervals
23 - - [x] Daily prune task
24 - - [x] Graceful shutdown (SIGINT/SIGTERM)
25 - - [x] Systemd service on hetzner
26 -
27 - ## Phase 3 — HTTP API + MNW Integration
28 - Expose data to consumers, wire into MNW health page.
29 -
30 - ### Done
31 - - [x] Axum HTTP API (`/api/status`, `/api/status/{target}`)
32 - - [x] Uptime percentage queries (24h, 7d)
33 - - [x] MNW `/health` page shows External Monitor card
34 - - [x] MNW `/api/health` JSON includes `external_monitoring` field
35 - - [x] Graceful fallback when PoM unavailable
36 -
37 - ## Phase 4 — Peer Mesh
38 - Syncthing-style peer network. Each PoM instance has a UUID, discovers peers by address, and shares monitoring data across the mesh. Any instance can see the full network state.
39 -
40 - ### Done (4A — Instance Identity)
41 - - [x] Auto-generate UUID on first run, store in data dir (`~/.local/share/pom/instance_id`)
42 - - [x] Instance name in config (`[instance]` section, defaults to hostname)
43 - - [x] `GET /api/peer/info` endpoint (returns instance ID, name, version, target list, started_at)
44 -
45 - ### Done (4B — Peer Configuration)
46 - - [x] `[instance]` config section (name, optional ID override)
47 - - [x] `[peers.<name>]` config section (address, on_missing, grace_count)
48 - - [x] Peer connection on serve startup (exchange instance info via `/api/peer/info`)
49 - - [x] Validate peer identity: store UUID on first connect, warn if UUID changes unexpectedly
50 -
51 - ### Done (4C — Peer Health Monitoring)
52 - - [x] Periodic peer heartbeat (poll each peer's `/api/peer/info`, configurable interval, default 60s)
53 - - [x] Peer status tracking in SQLite (`peer_identities`, `peer_heartbeats` tables)
54 - - [x] `on_missing` behavior: fire action when peer heartbeat fails (after configurable grace period)
55 - - [x] State machine: Unknown -> Online/GracePeriod -> Missing, with recovery detection
56 - - [x] Prune task also cleans `peer_heartbeats`
57 -
58 - ### Done (4D — Status Sharing)
59 - - [x] `GET /api/peer/status` endpoint (returns this instance's full target + peer status)
60 - - [x] Each instance periodically fetches peer status to build combined view
61 - - [x] `GET /api/mesh` endpoint (aggregated view: all instances, all targets, all peer statuses)
62 - - [x] CLI: `pom mesh [--json]` command to show network state
63 - - [x] MCP tool: `get_mesh_status` surfaces mesh state
64 -
65 - ### Done (4E — Code + Config)
66 - - [x] Per-host config files (`deploy/pom-hetzner.toml`, `deploy/pom-astra.toml`)
67 - - [x] Updated `deploy/deploy.sh` to use per-host configs
68 - - [x] Listen on `0.0.0.0:9100` in deploy configs (Tailscale peer access)
69 -
70 - ### Done (4E — Deploy)
71 - - [x] Install Tailscale on hetzner (`100.120.174.96`)
72 - - [x] Update astra peer config to use hetzner's Tailscale IP
73 - - [x] Fix `blocking_read()` panic in `spawn_heartbeat_tasks` (must be async)
74 - - [x] Deploy v0.2.0 to hetzner + astra
75 - - [x] Verify: `/api/peer/info` returns correct identity on each
76 - - [x] Verify: `/api/mesh` shows both instances online (~65ms latency)
77 - - [x] Update deploy scripts to use Tailscale IPs
78 -
79 - ## Phase 5 — Alerting (pre-beta)
80 - Email alerts triggered by target status changes or peer disappearance. Peers with `on_missing = "alert"` use this system.
81 -
82 - ### Done
83 - - [x] Postmark API integration (`src/alerts.rs` — Alerter struct, `X-Postmark-Server-Token` header)
84 - - [x] Alert configuration in pom.toml (`[alerts]` section: postmark_token, to, from, cooldown_secs)
85 - - [x] Status change detection (query previous health check before insert, compare statuses, fire on transition)
86 - - [x] Cooldown logic (alerts table tracks sent_at, skip if within cooldown window)
87 - - [x] Recovery alerts (notify when target returns to operational)
88 - - [x] Peer-triggered alerts (peer goes missing/recovering with `on_missing = "alert"`)
89 - - [x] Dev mode (no postmark_token → alerts logged to stdout)
90 - - [x] DB migration v2 (alerts table + index)
91 - - [x] Deploy configs updated (`deploy/pom-hetzner.toml`, `deploy/pom-astra.toml`)
92 - - [x] 11 new tests (3 unit, 5 integration, 3 config)
93 - - [x] Set postmark_token in production deploy configs
94 - - [x] Create `pom-alerts@makenot.work` sender signature in Postmark dashboard
95 -
96 - ## Phase 6 — TLS Certificate Monitoring
97 - Probe TLS certs, track expiry, alert before outage.
98 -
99 - ### Done
100 - - [x] TLS certificate check: connect to target, TLS handshake, read leaf cert expiry (`src/checks/tls.rs`)
101 - - [x] Per-target TLS config: `[targets.mnw.tls]` with host, port (default 443), warn_days (default 14)
102 - - [x] Configurable check interval: `tls_check_interval_secs` on `[serve]` (default 3600)
103 - - [x] DB migration v3: `tls_checks` table with index
104 - - [x] Store cert check results per target (insert/query, `TlsCheckRow`)
105 - - [x] Prune old TLS checks in daily prune task (5-tuple return)
106 - - [x] TLS data in API response: `tls` field on `/api/status/{target}` (skip_serializing_if None)
107 - - [x] CLI display: TLS line in `pom status` (OK/WARN/ERR with days remaining + expiry date)
108 - - [x] Serve loop: TLS check task per target on its own interval
109 - - [x] Alerts: expiry warning, error, and recovery (with cooldown)
110 - - [x] Deploy configs updated (hetzner + astra: `[targets.mnw.tls] host = "makenot.work"`)
111 - - [x] 17 new tests (2 unit, 5 config, 10 integration)
112 - - [x] Dependencies: x509-parser 0.16, tokio-rustls 0.26, rustls-pki-types 1, webpki-roots 1
113 -
114 - ## Phase 7 — Response Validation
115 - Verify response bodies match expected patterns, not just HTTP status codes.
116 -
117 - ### Done
118 - - [x] `HealthExpectation` config struct: `status_code`, `json_fields` (dot-path), `body_contains`
119 - - [x] `[targets.mnw.health.expect]` TOML config section (all fields optional)
120 - - [x] `resolve_json_path()` — walk dot-separated paths through nested JSON
121 - - [x] `validate_expectations()` — check status code, body substring, JSON field values
122 - - [x] Refactored `check_health` to `response.text()` + `serde_json::from_str` (preserves raw body)
123 - - [x] Expectation failures override to Degraded with joined error descriptions
124 - - [x] Deploy configs updated (hetzner + astra: `status_code = 200`, `json_fields.status = "operational"`)
125 - - [x] 17 new unit tests (resolve_json_path, validate_expectations, config parsing)
126 -
127 - ## Phase 8 — Latency Trending + Anomaly Detection
128 - Track performance over time, detect drift before it becomes an outage.
129 -
130 - ### Done
131 - - [x] `LatencyStats` + `LatencyBucket` types with `from_times()` and `bucket_by_time()` (types.rs, 9 unit tests)
132 - - [x] DB queries: `get_response_times`, `get_recent_response_times` (db.rs — operational-only filtering)
133 - - [x] `TrendingConfig` (baseline_window_hours, spike_threshold) wired into `HealthConfig` (config.rs, 3 tests)
134 - - [x] `detect_latency_drift()` — 3 consecutive checks over baseline threshold (checks/http.rs, 6 unit tests)
135 - - [x] Drift + recovery alerts with cooldown (alerts.rs)
136 - - [x] Drift detection in serve loop with `in_drift` state tracking (cli.rs)
137 - - [x] `latency_24h` on `/api/status/{target}`, `GET /api/trends/{target}?hours=&bucket_minutes=` (api.rs)
138 - - [x] Latency line in CLI `pom status` output (display.rs, 2 tests)
139 - - [x] Latency stats in MCP `get_status` tool (tools/health.rs)
140 - - [x] Deploy configs: `[targets.mnw.health.trending]` (pom-hetzner.toml, pom-astra.toml)
141 - - [x] MNW health page: avg/p95 latency in PoM card (health.rs, public.rs, health.html)
142 - - [x] 8 new integration tests (response times, trends API, latency in status, config parsing)
143 -
144 - ## Phase 9 — Smart Test Prompting
145 - Detect when tests should be re-run based on staleness and version changes.
146 -
147 - ### Done
148 - - [x] `TestStaleness` struct: stale flag, reason, current/tested versions, last_test_at, days_since_test (types.rs)
149 - - [x] `get_version_at_time()` DB query: extract version from health check closest to a given timestamp (db.rs)
150 - - [x] `staleness_days` config field on `TestsConfig` (default 7) (config.rs, 2 config tests)
151 - - [x] `compute_test_staleness()` pure function: no-tests, age-based, version-change triggers (checks/http.rs, 5 unit tests)
152 - - [x] `test_staleness` field on API `TargetStatus` (skip_serializing_if None) (api.rs)
153 - - [x] `build_target_status` computes staleness for targets with test config (api.rs)
154 - - [x] CLI `pom status` shows "Tests: STALE" line with reason (display.rs, 4 display tests)
155 - - [x] CLI JSON output includes `test_staleness` object (cli.rs)
156 - - [x] MCP `get_status` shows staleness info when stale (tools/health.rs)
157 - - [x] Deploy configs: `staleness_days = 7` (pom-hetzner.toml, pom-astra.toml)
158 - - [x] 8 integration tests (version_at_time, staleness by version/age/fresh, config parsing, MCP tool, no-config omits field)
159 -
160 - ## Phase 10 — Downtime Log + Incident History
161 - Structured timeline of status transitions for post-incident review.
162 -
163 - ### Done
164 - - [x] DB migration v4: `incidents` table (id, target, started_at, ended_at, duration_secs, from_status, to_status)
165 - - [x] `IncidentRow` struct (sqlx::FromRow + Serialize)
166 - - [x] Incident queries: `insert_incident`, `close_open_incidents`, `get_open_incident`, `get_recent_incidents`
167 - - [x] Automatic incident open on transition away from operational (serve loop)
168 - - [x] Automatic incident close (with duration) on recovery to operational
169 - - [x] Status change between non-operational states: close old incident, open new
170 - - [x] `current_incident` + `incidents` (last 10) on API `/api/status/{target}` (skip_serializing_if)
171 - - [x] CLI `pom status` shows active incident line
172 - - [x] MCP `get_status` shows active + recent incidents
173 - - [x] Prune cleans closed incidents (6-tuple return from `prune_old_records`)
174 - - [x] 10 new tests (migration, lifecycle, target isolation, prune, API)
175 - - [x] Surface in MNW health page (incident timeline, recent incidents list, expandable check lists, formatted timestamps)
176 -
177 - ## Audit Remediation (Second Audit, 2026-03-11)
178 - 5 findings, 3 cold spots. All resolved.
179 -
180 - ### Done
181 - - [x] Extract CLI command handlers from main.rs into cli.rs (main.rs: 587 -> 130 LOC, cli.rs: 466 LOC)
182 - - [x] Add typed PomError enum with thiserror (8 variants, replaces Box<dyn Error> across 9 files)
183 - - [x] Add .DS_Store and IDE dirs (.idea/, .vscode/) to .gitignore
184 - - [x] Add module-level //! docs to main.rs (config.rs already had one)
185 - - [x] Add migration versioning (schema_version table, numbered migrations, pre-migration DB detection, 3 tests)
186 - - [x] Add CLI display tests (extract formatting into display.rs, 27 tests: health snapshots, test results, status, history, prune, mesh)
187 -
188 - ## Audit Remediation (First Audit, 2026-03-10)
189 - First audit. 11 findings, 8 cold spots. All resolved.
190 -
191 - ### Done
192 - - [x] Add DB indexes: `health_checks(target, id DESC)`, `health_checks(target, checked_at)`, `test_runs(target, id DESC)`, `peer_heartbeats(peer_name, id DESC)` (db.rs, init_schema)
193 - - [x] Fix 4 clippy `collapsible_if` warnings (api.rs, peer.rs, main.rs — used Rust 2024 let chains)
194 - - [x] Decouple mesh write lock from DB writes in heartbeat handlers (peer.rs — block-scoped lock, DB writes after drop)
195 - - [x] Decouple mesh read lock from DB queries in peer_status and mesh_view handlers (api.rs — same pattern)
196 - - [x] Log `/api/peer/status` fetch failures instead of silently ignoring (peer.rs, tracing::debug)
197 - - [x] Include peer heartbeat prune count in `prune_old_records` return value (db.rs — now returns 3-tuple)
198 - - [x] Add `//!` module docs to db.rs, config.rs, peer.rs, types.rs, lib.rs (api.rs already had one)
199 - - [x] Change `PeerConfig.on_missing` from `String` to `OnMissing` enum with `#[derive(Deserialize)]` + `#[default]`
200 - - [x] Add API endpoint integration tests (5 tests: /api/status, /api/status/{target} 404, /api/peer/info, peer disabled, /api/mesh)
201 - - [x] Add heartbeat state machine unit tests (5 tests: grace transitions, recovery, first-contact UUID, DB recording)
202 - - [x] Add config parsing tests (4 tests: full parse, defaults, on_missing default, hostname fallback)
203 - - [x] Add HTTP health check response classification tests (8 tests: operational, degraded, unknown status, error codes, missing fields, non-JSON)
204 - - [x] Extract `HealthStatus::icon()` method, eliminating 3 repeated match blocks in main.rs
205 - - [x] Add types.rs tests (4 tests: Display/FromStr roundtrip, icon mapping, serde roundtrip, invalid parse)
206 -
207 - ## Phase 11 — Route Specs (pre-beta)
208 -
209 - Define expected routes per target in config. PoM periodically checks each route and alerts if any return non-200. Catches missing pages, broken deploys, misconfigured paths.
210 -
211 - ### Done
212 - - [x] `expected_routes` config field on `[targets.<name>]` — list of paths to check (e.g. `["/", "/docs", "/docs/faq", "/pricing"]`)
213 - - [x] `route_check_interval_secs` on `[serve]` (default 300 = 5 min)
214 - - [x] Route check module (`src/checks/routes.rs`) — sequential GET per path, 2xx = OK
215 - - [x] Route check task in serve loop (separate interval from health checks)
216 - - [x] Route check results stored in DB (migration v5: `route_checks` table with indexes)
217 - - [x] `RouteCheckRow`, `insert_route_check`, `get_latest_route_checks` queries
218 - - [x] Prune includes route_checks (7-tuple return from `prune_old_records`)
219 - - [x] Alert on route failure (non-200 on any expected route, with cooldown key `route:{target}`)
220 - - [x] Recovery alert when previously-failing route returns 200 (no cooldown)
221 - - [x] `route_status` field on `/api/status/{target}` (list of paths with last status, skip_serializing_if empty)
222 - - [x] CLI `pom status` shows route check summary (e.g. "Routes: 9/9 OK" or "Routes: 7/9 (FAIL: /docs/faq, /pricing)")
223 - - [x] MNW health page: route status in PoM card
224 - - [x] Deploy configs updated (hetzner + astra: MNW 9 routes, MT 1 route)
225 - - [x] 18 new tests (4 config, 5 route check unit, 3 display, 1 alert, 5 integration)
226 -
227 - ## Phase 12 — External Target: htpy.app
228 -
229 - Monitor https://htpy.app (homotopy-rs, repo at `/Users/max/Math/sseq-work/homotopy-rs`). PoM already supports multiple targets — this adds htpy.app as a third monitored site alongside MNW and MT.
230 -
231 - ### Done
232 - - [x] Add `[targets.htpy]` to deploy configs (pom-hetzner.toml, pom-astra.toml) with health URL, route checks, TLS
233 - - [x] Health check via Tailscale (`http://100.99.153.68:8080/archive/S_2`) with `body_contains = "htpy"` expectation
234 - - [x] Route check: `/archive/S_2` (the default redirect target from `/`)
235 - - [x] TLS monitoring for htpy.app (`[targets.htpy.tls] host = "htpy.app"`)
236 - - [x] Fix `classify_non_json` — non-JSON 2xx responses now promoted to Operational when all expectations pass
237 - - [x] Verified on both hetzner (9ms) and astra (185ms): operational, TLS valid (87d), routes 1/1 OK
238 -
239 - ### Not applicable
240 - - MNW health page: htpy.app is a separate service, doesn't belong on MNW's health dashboard
241 -
242 - ## Audit Action Items (2026-03-13, third audit — pre-launch skeptical lens)
243 -
244 - ### Done
245 - - [x] **CRITICAL:** Remove Postmark API token from deployment configs (`deploy/pom-hetzner.toml`, `deploy/pom-astra.toml`) — moved to `POM_POSTMARK_TOKEN` env var, loaded in config.rs, systemd `EnvironmentFile=/etc/pom/env`
246 - - [x] Add API authentication (bearer token middleware on all /api/* routes, `POM_API_TOKEN` env var or `[serve] api_token` config, 5 tests)
247 - - [x] Add peer mesh authentication (`[peers.X] token` field, heartbeat client sends `Authorization: Bearer` header, MNW health.rs updated to send token)
248 - - [x] Add integration tests for core functions (check_health, check_tls — 9 new integration tests with mock servers)
249 - - [x] Add self-monitoring capability (`/api/health` endpoint returns `{"status":"operational","version":"..."}`, no auth required)
250 - - [x] Shell-escape SSH test filter parameter (`checks/ssh.rs` — alphanumeric + `_:-` allowlist, returns error TestRun on invalid chars)
251 - - [x] Reject peer responses on UUID mismatch instead of just logging a warning (`peer.rs` — upgraded to tracing::error, skips status update, increments consecutive_failures)
252 - - [x] Add rate limiting to API endpoints (fixed-window 60 req/min middleware on authenticated routes, 1 unit test)
253 -
254 - ## Audit (Run 4, 2026-03-14)
255 -
256 - Full code audit of Phases 11-12 additions. 1 HIGH, 4 MEDIUM, 5 LOW findings.
257 -
258 - ### Done
259 - - [x] Audit route checks module (`src/checks/routes.rs`) — base_url parsing, error handling, edge cases
260 - - [x] Audit `classify_non_json` Operational promotion — verified correct, no false positives
261 - - [x] Audit deploy configs for consistency (htpy Tailscale IP, route lists, expectation accuracy)
262 - - [x] Review test coverage gaps in Phase 11-12 code
263 -
264 - ### Done (from audit findings)
265 - - [x] **HIGH:** Disable redirect following in route check client (`redirect(Policy::none())`) — was silently following redirects
266 - - [x] **MEDIUM:** Fix startup thundering herd — consume first tick of health/TLS/route/prune intervals before entering loop
267 - - [x] **MEDIUM:** Fix recovery cooldown interaction — `get_latest_alert_for_target` now excludes `%recovery%` alert types
268 - - [x] **MEDIUM:** Set `MissedTickBehavior::Delay` on route check interval to prevent back-to-back storms
269 - - [x] **LOW:** Validate `expected_routes` paths start with `/` at config load time
270 - - [x] 3 new tests (recovery cooldown, empty routes, path validation)
271 -
272 - ### Done (remaining findings — resolved)
273 - - [x] **MEDIUM:** Graceful shutdown — CancellationToken + `tokio::select!` in all task loops, `with_graceful_shutdown` on API server, 5s grace period (`cli.rs`)
274 - - [x] **LOW:** Remove redundant htpy route check — removed `expected_routes` from htpy target (deploy configs)
275 - - [x] **LOW:** Monitor for silent task panics — 60s watchdog checks `JoinHandle::is_finished()` in shutdown loop (`cli.rs`)
276 -
277 - ## Phase 13 — Per-Test Tracking & Duration Trending (Mar 2026)
278 - `TestDetail` struct + `details` field on `TestSummary`. Parse individual test lines from cargo output. Migration v7: `test_details` table. `insert_test_details`, `get_test_regressions`, `get_test_durations` DB queries. Duration drift detection (baseline 10 runs, 1.5x threshold). Wired into CLI, MCP, API. 10 new tests. MT test target added to astra + hetzner configs.
279 -
280 - ## Phase 6 — TLS (additional, Mar 2026)
281 - Domain WHOIS/registration check (registrar, expiry, nameservers). DNS record verification (A/AAAA/CNAME resolve to expected IPs).
282 -
283 - ## Run 6 Audit Items (Mar 2026)
284 - Fixed 6 collapsible_if clippy warnings (cli.rs, config.rs, checks/http.rs).
285 -
286 - ## Run 8 Audit Items (Mar 2026)
287 - Hardened `escape_js` in dashboard.rs: added newline, carriage return, `<` (`\x3c`), null escaping + 4 tests.
288 -
289 - ---
290 -
291 - ## DNS/Route Stale Data Fix (2026-03-25)
292 -
293 - - [x] Switch Cloudflare-proxied DNS records to resolution-only checks
294 - - [x] Filter `route_status` and `dns_status` in API to only configured entries
295 - - [x] Add `prune_stale_routes()` and `prune_stale_dns()` DB functions
296 - - [x] Call prune functions at task startup
297 - - [x] Update integration tests for new filtering behavior
298 - - [x] Deploy to hetzner (pruned 890 stale route check rows on startup)
299 -
300 - ---
301 -
302 - ## Rust Patterns Audit (2026-03-21)
303 -
304 - - [x] Create `AlertCategory` enum (18 variants) replacing string literals
305 - - [x] Create `DnsRecordType` enum (A/Aaaa/Cname/Mx/Txt) replacing raw strings
306 - - [x] Add 30s timeout wrapper around email sends
307 - - [x] Eliminate HealthSnapshot clone under lock in API handlers
308 - - [x] Use `Cow<'_, str>` for JSON path response instead of String clone
M docs/todo.md +1 -5
@@ -2,12 +2,9 @@
2 2
3 3 Done: All phases (1-13). Active: None. Next: Post-beta items below.
4 4
5 - v0.3.2. Audit grade A. Dashboard UI, regression detection, duration drift. Monitors MNW + MT + htpy.app.
6 -
7 - Completed work archived in `docs/archive/pom_todo_done.md`.
5 + v0.3.2. Audit grade A. 359 tests.
8 6
9 7 ## Notification Integration
10 - When MNW unified notification service is built, PoM can push alerts there instead of / in addition to email.
11 8 - [ ] Push PoM alerts to MNW notifications API (health failures, TLS expiry, DNS changes)
12 9 - [ ] Deduplicate alert delivery (email via MNW notification preferences instead of direct Postmark)
13 10
@@ -37,4 +34,3 @@ When MNW unified notification service is built, PoM can push alerts there instea
37 34 - Integration tests: `tests/integration.rs`
38 35 - Deploy: `deploy/` (deploy.sh, pom-hetzner.toml, pom-astra.toml, pom.service)
39 36
40 - Run 6 + Run 8 audit items all resolved.