# Hayva.ai Production Readiness Report **Assessment date:** 2026-08-26 **Branch assessed:** `codex/foundation-phase-1` **Verdict:** **APPLICATION HARDENING COMPLETE; PRODUCTION RELEASE BLOCKED** ## Executive outcome The repository now has a substantially production-hardened application baseline. Authentication, workspace authorization, typed AI/browser/VM boundaries, signed worker capabilities, uncertain-write reconciliation, automatic lease and retention maintenance, fail-closed production startup, TLS gateway configuration, least-privilege database-role definitions, security CI, and encrypted backup/restore tooling are present and locally tested where this workstation can execute them. This is not permission to expose Hayva publicly. Docker is not installed on the assessment host, so the container stack, PostgreSQL roles, TLS overlay, backup, and restore drill could not be exercised. Host firewall/SSH policy, enforced browser egress, encrypted browser-profile storage, monitoring and alert routing, load/failure drills, CI results, and independent Security/QA sign-off also require a real production-like environment. Those are release gates, not documentation tasks. ## Material controls implemented in this milestone - RFC 6238 TOTP MFA with AES-256-GCM encrypted secrets, replay rejection, and one-time recovery codes; MFA-aware login, password change, and operator-assisted password reset. - Absolute and idle session expiry, session-token rotation, per-device revocation, logout-all, and global invalidation after password/MFA changes. - A responsive Security Center for MFA enrollment, recovery-code replacement, password changes, session rotation, and device revocation. - Ed25519-signed, audience-bound Core-to-Computer capabilities with a 45-second lifetime and exact request, scope, workspace, session, and fencing-token claims. - Unknown outcome handling for interrupted browser writes: the action becomes `unknown`, its lease is released, the session is paused, and only an authorized human evidence-based reconciliation can finalize it. - Production maintenance loop for expired controller leases, approvals, artifacts, and idempotency records. Artifact expiry follows the owning profile and physical deletion is retried through a separately scoped worker capability. - Safe validation/unhandled-error envelopes, request IDs, security headers, and production HSTS. - Separate migration/runtime PostgreSQL identities with post-migration grants; runtime DDL and update/delete/truncate access to audit/login evidence are revoked. - TLS 1.2/1.3 production gateway overlay with HSTS, CSP, origin signal rejection, edge rate limits, safe forwarded headers, and internal-only detailed health. - Bounded container logs and CPU/memory/process limits; non-root/read-only/capability-dropped application services. - Weekly and change-triggered dependency, secret, IaC, CodeQL, and SBOM CI definitions. - Age-encrypted database/profile/artifact backup and checksum tooling plus an isolated, networkless PostgreSQL restore-drill script. - A first-class one-private-VM-per-agent control plane with Core-owned quotas, provider gateway isolation, lifecycle idempotency, audit-before-dispatch, verification, snapshots, and honest blocked/unknown states. No real hypervisor is claimed configured. - Production-only startup validation across Core, AI, and Computer services, aggregate readiness requiring authenticated worker health, and rejection of unexpected public Host headers. - A secret-safe release preflight for protected files, TLS expiry, data-service identities, clean remote-bound revision, Docker availability, effective Compose configuration, and exclusive JSON evidence output. - Exact Python runtime constraints plus clean local Python and locked-web dependency audits. The audit found `PYSEC-2026-3552`; the affected cryptography dependency was upgraded to 50.0.0 and re-audited cleanly. ## Local verification evidence | Check | Result on 2026-08-26 | | --- | --- | | Ruff | Passed | | Backend pytest | 88 passed | | Post-upgrade authentication/security/Computer focused suite | 29 passed | | Computer model/capability/real-Chromium suite | 5 passed | | Frontend Vitest | 8 passed | | Frontend TypeScript and production bundle | Passed; 1,812 modules transformed | | Python runtime dependency audit | No known vulnerabilities found | | Locked web dependency audit | No known vulnerabilities found at high threshold | | Static Compose/infrastructure policy tests | Passed | | Docker/Compose runtime | **Not run — Docker command is unavailable on this host** | | Live production PostgreSQL grant test | **Not run** | | Encrypted backup and isolated restore drill | **Not run** | | CI/security workflow | Defined, not remotely executed | No live OpenAI call or external-account write was made. Provider tests use injected fakes, and missing provider credentials remain `unconfigured`. ## Release blockers 1. Build and run both Compose files on a Docker-capable Ubuntu host; record image digests, health, effective users/capabilities, mounts, network reachability, and published ports. 2. Deploy the restricted KVM/libvirt, Proxmox, or cloud gateway plus patched and verified Linux and licensed Windows images. Exercise one real isolated VM per active agent, encrypted disks, host/guest network denial, persistence, deletion, snapshot/restore, and in-guest daemon controls. 3. Exercise clean PostgreSQL migration plus runtime grants. Prove the runtime role can perform normal application work but cannot run DDL or mutate audit/login evidence. 4. Install valid certificates, validate external TLS/headers/rate limits, and enforce host firewall, restricted SSH, patching, time sync, and container-daemon access policy. 5. Enforce browser and guest egress outside the application and adversarially test DNS rebinding, redirects, alternate IP encodings, metadata endpoints, and internal-service reachability. 6. Encrypt browser-profile, artifact, and VM volumes at rest with operational key rotation/revocation. 7. Execute an encrypted off-host backup and isolated restore drill; record RPO/RTO and audit-chain verification evidence. 8. Deploy metrics/log shipping and alerts for auth abuse, error rates, database/Redis, disk, maintenance failures, browser health, provider health, backups, and certificate expiry. 9. Run production-like multi-workspace E2E, race/failure, accessibility, load, disk-full, provider- outage, browser-crash, server-reboot, and key-rotation tests. 10. Run the security workflow, close all critical/high findings, enable protected reviews, and obtain independent Security and QA approval. ## Product-scope limitations Email, calendar, WhatsApp, invoice automation, contacts/CRM, general files/knowledge, scheduled automations, and voice are still unimplemented and honestly shown as planned/unconfigured. The AI runtime currently executes only its registered low-risk Core read tools. Browser downloads, uploads, clipboard, service workers, and WebSockets are disabled. These limitations do not become functional merely because the deployment layer is hardened. ## Operator decision Use this branch for local or controlled staging evaluation with disposable accounts. Do not publish it or connect valuable accounts until every blocker above has dated evidence or an explicit, time-bounded risk acceptance. The current product inventory is in [APPLICATION_SUMMARY.md](APPLICATION_SUMMARY.md), with operational gates in [PRODUCTION_CHECKLIST.md](PRODUCTION_CHECKLIST.md).