Capture reverse-proxy smoke evidence for private review deployment

[Joncallim]

Goal

Prove the private review deployment works through the documented reverse proxy while keeping the Rust daemon private and the browser API token-protected.

Plain-English Context

A reviewer should be able to open DockerMap through the public review URL, but they should not be able to reach the private Rust daemon directly or bypass API protection. This issue asks an agent to prove the proxy setup works as intended, including live event streaming and token behavior, before release.

Roadmap Source

• docs/planning/ROADMAP.md -> Now: Private Alpha Hardening -> Capture release-host evidence.
• docs/release/RELEASE_CHECKLIST.md -> Execute After Next Commit -> capture reverse-proxy smoke evidence including bearer-token injection, SSE streaming, public review URL access, and direct daemon-port inaccessibility.

Recommended Agent

Primary: release-ops

Handoff note: involve security-readonly if any proxy or daemon behavior appears to bypass token protection, CORS policy, loopback daemon binding, or error redaction.

Scope

Target areas:

• docs/release/RELEASE_CHECKLIST.md
• docs/deployment/DEPLOYMENT.md
• docs/deployment/REVERSE_PROXY.md
• scripts/smoke-deploy.sh only if the documented smoke command is stale or insufficient
• deployment config under deploy, Dockerfile, or docker-compose.yml only if the maintainer asks for a wiring fix

Direction

1. Use the intended private review host and documented reverse-proxy setup.
2. Confirm the Express API is reachable through the proxy and the Rust daemon is not directly reachable from another machine.
3. Confirm viewer authentication or bearer-token injection behaves as documented.
4. Confirm /api/events/stream still streams through the proxy without buffering or auth breakage.
5. Confirm /api/snapshot returns 401 without a bearer token when bypassing proxy token injection.
6. Run the local and public smoke checks, then record exact results in the release evidence location.
7. Do not paste real tokens, auth headers, private URLs, or sensitive host details into docs or issue comments.

Acceptance Criteria

• scripts/smoke-deploy.sh http://127.0.0.1:4000 result is recorded on the host.
• scripts/smoke-deploy.sh against the public review URL result is recorded.
• Evidence states whether bearer-token injection works for protected routes.
• Evidence states whether SSE streaming works through the reverse proxy.
• Evidence states that direct remote access to daemon port 4100 is impossible, or keeps the gate open if not proven.
• Evidence states that /api/health, /api/snapshot, /api/runtime/map, /api/compose/scan, and /api/events/stream work through the proxy.
• Any deployment or security failure is called out as a blocker instead of being marked complete.

Validation Commands

Run on the release/review host and record exact results:

• git rev-parse HEAD
• npm run build:deploy
• scripts/smoke-deploy.sh http://127.0.0.1:4000
• scripts/smoke-deploy.sh <public-review-url>
• targeted curl checks for unauthenticated 401, authenticated protected routes, and SSE streaming, with tokens redacted from output
• a remote connectivity check proving daemon port 4100 is inaccessible from another machine

State any skipped commands and why.

Closure Evidence

When resolved, post a comment using the repository evidence format:

## Resolution Evidence
- What changed:
- Why this resolves the issue:
- How I checked it:
- Remaining risk or follow-up:

Recommendation: This issue appears resolved and can be closed by a maintainer.

If proxy behavior cannot be verified on the release host, recommend keeping the issue open. Do not close the issue automatically.

[Joncallim]

Resolution Evidence

• What changed: No code or documentation changed. This was an evidence-readiness check for the reverse-proxy release gate.
• Why this resolves the issue: It does not fully resolve the issue yet. This workspace does not have the intended private review host, public review URL, viewer-auth context, or a second external network vantage point, so I cannot honestly prove public proxy access, bearer-token injection, SSE streaming, or remote daemon-port blocking from here.
• How I checked it: I reviewed the issue requirements, release checklist, deployment docs, reverse-proxy docs, Nginx proxy template, deploy smoke script, and API auth/SSE behavior. The current smoke script helps verify /api/health, /api/snapshot, /api/runtime/map, and /api/compose/scan, but it does not by itself prove SSE behavior, unauthenticated 401, viewer authentication, or remote daemon-port inaccessibility.
• Remaining risk or follow-up: Run the documented local and public smoke checks on the actual review host, record sanitized status-only results, verify /api/snapshot returns 401 without a token when bypassing proxy token injection, verify /api/events/stream works through the proxy, and verify daemon port 4100 is blocked from another machine.

Recommendation: Keep this issue open until the reverse-proxy smoke evidence is captured on the intended private review deployment.

[Joncallim]

Resolution Evidence

• What changed: Hardened scripts/smoke-deploy.sh so it now checks /api/health, verifies protected routes return 401 without a token when DOCKERMAP_API_TOKEN is set, verifies authenticated /api/snapshot, /api/runtime/map, and /api/compose/scan, and confirms /api/events/stream emits a snapshot SSE event. Updated deployment and testing docs so the stronger smoke path is documented.
• Why this resolves the issue: It resolves the local host-side smoke gap and gives a deterministic script for bearer-token and SSE checks, but it does not fully close the issue because the public review URL, proxy token injection, and second-machine daemon inaccessibility are not proven from this session.
• How I checked it: Ran git rev-parse HEAD -> 17c7dd1ef0e8bc53b33a7367eef4283e830053a8, then npm run build:deploy on July 3, 2026, then started the built loopback daemon and API locally with DOCKERMAP_FORCE_MOCK=true, DOCKERMAP_DAEMON_HOST=127.0.0.1, DOCKERMAP_DAEMON_PORT=4100, PORT=4000, DOCKERMAP_DAEMON_URL=http://127.0.0.1:4100, DOCKERMAP_API_TOKEN=test-token, and DOCKERMAP_ALLOWED_ORIGINS=http://127.0.0.1:3233. Finally ran DOCKERMAP_API_TOKEN=test-token DOCKERMAP_SMOKE_URL=http://127.0.0.1:4000 ./scripts/smoke-deploy.sh, which passed. During that smoke pass the script also confirmed unauthenticated /api/snapshot returned 401 before retrying with auth, and /api/events/stream emitted an SSE snapshot event.
• Remaining risk or follow-up: This issue still needs scripts/smoke-deploy.sh <public-review-url> on the actual review host, a remote connectivity check from another machine proving direct access to daemon port 4100 is impossible, and explicit evidence that the reverse proxy injects the bearer token without buffering SSE.

Recommendation: Keep this issue open until the public review URL and second-machine checks are recorded.