# System Hardening Implementation Plan

> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.

**Goal:** Fix all CRITICAL and HIGH issues from the 2026-02-09 system audit to bring Monetarie Core to production-grade quality.

**Architecture:** 8 independent workstreams targeting backend security, DB integrity, NATS resilience, TigerBeetle safety, API hardening, K8s manifests, monitoring, and operational tooling.

**Tech Stack:** Elixir/Phoenix, PostgreSQL, TigerBeetle, NATS JetStream, Kubernetes, Docker

---

## Workstream 1: Backend Security & Config Hardening

### Task 1.1: Remove hardcoded default credentials
**Files:** Modify `backend/config/runtime.exs:67-69`
- Change admin password to `raise` if not set in prod
- Keep default only for dev/test

### Task 1.2: Add request size limit
**Files:** Modify `backend/lib/monetarie_web/endpoint.ex:39-42`
- Add `length: 10_000_000` to Plug.Parsers

### Task 1.3: Add security headers plug
**Files:** Create `backend/lib/monetarie_web/plugs/security_headers.ex`, Modify `endpoint.ex`

### Task 1.4: Add rate limiting plug
**Files:** Modify `backend/mix.exs` (add hammer), Create `backend/lib/monetarie_web/plugs/rate_limit.ex`, Modify `router.ex`

### Task 1.5: Add EnsureAdmin plug for admin routes
**Files:** Create `backend/lib/monetarie_web/plugs/ensure_admin.ex`, Modify `router.ex:61`

### Task 1.6: Fix fallback controller error exposure
**Files:** Modify `backend/lib/monetarie_web/controllers/fallback_controller.ex:65-70`

### Task 1.7: Fix AuditPlug to use Oban instead of Task.start
**Files:** Create `backend/lib/monetarie/audit/audit_job.ex`, Modify `backend/lib/monetarie_web/plugs/audit_plug.ex:78`

### Task 1.8: Add DB connection timeout/queue config
**Files:** Modify `backend/config/runtime.exs:17-20`

---

## Workstream 2: Database Integrity & Indexes

### Task 2.1: Add foreign key constraints migration
**Files:** Create `backend/priv/repo/migrations/20260209400000_add_foreign_key_constraints.exs`

### Task 2.2: Add missing indexes migration
**Files:** Create `backend/priv/repo/migrations/20260209400001_add_missing_indexes.exs`

### Task 2.3: Add CHECK constraints migration
**Files:** Create `backend/priv/repo/migrations/20260209400002_add_check_constraints.exs`

### Task 2.4: Create nats_dead_letters table
**Files:** Create `backend/priv/repo/migrations/20260209400003_create_nats_dead_letters.exs`, Create `backend/lib/monetarie/nats/dead_letter.ex`

### Task 2.5: Fix partition maintenance to verify indexes
**Files:** Modify `backend/lib/monetarie/partition_maintenance.ex`

---

## Workstream 3: NATS Messaging Resilience

### Task 3.1: Fix NATS connection for cluster failover
**Files:** Modify `backend/lib/monetarie/nats/connection.ex`

### Task 3.2: Add JetStream stream initialization module
**Files:** Create `backend/lib/monetarie/nats/stream_setup.ex`, Modify `backend/lib/monetarie/nats/supervisor.ex`

### Task 3.3: Implement dead-letter persistence
**Files:** Modify all consumer files to persist dead letters to DB

### Task 3.4: Add exponential backoff to reconnection
**Files:** Modify `backend/lib/monetarie/nats/connection.ex`

### Task 3.5: Add Oban telemetry for discarded jobs alerting
**Files:** Create `backend/lib/monetarie/nats/oban_telemetry.ex`, Modify `application.ex`

---

## Workstream 4: TigerBeetle & Ledger Safety

### Task 4.1: Fix TX ID generation (128-bit)
**Files:** Modify `backend/lib/monetarie/nats/handlers/pix_handler.ex:236-247`

### Task 4.2: Fix ensure_cash_asset_account race condition
**Files:** Modify `backend/lib/monetarie/wallet.ex:180-184`

### Task 4.3: Fix COSIF reconciliation missing client_liability
**Files:** Modify `backend/lib/monetarie/cosif/reconciliation.ex:173-177`

---

## Workstream 5: Health Check & Observability

### Task 5.1: Complete health check (NATS + Oban)
**Files:** Modify `backend/lib/monetarie_web/controllers/health_controller.ex`

### Task 5.2: Add correlation ID propagation
**Files:** Modify `backend/lib/monetarie/nats/publisher.ex`, Modify `backend/lib/monetarie_web/plugs/audit_plug.ex`

### Task 5.3: Remove debug field from V2 responses
**Files:** Modify `backend/lib/monetarie_web/controllers/v2/account_controller.ex`

---

## Workstream 6: K8s Manifests Hardening

### Task 6.1: Add security contexts to all deployments
### Task 6.2: Add pod anti-affinity rules
### Task 6.3: Add PodDisruptionBudgets
### Task 6.4: Fix image tags (remove :latest)
### Task 6.5: Fix NATS multi-host config
### Task 6.6: Fix TigerBeetle network policy (allow DNS)
### Task 6.7: Create .dockerignore files
### Task 6.8: Move AlertManager passwords to secrets

---

## Workstream 7: Oban Webhooks Queue + Metrics Fix

### Task 7.1: Add webhooks queue to prod Oban config
### Task 7.2: Fix Metrics module silent error swallowing

---

## Workstream 8: Unbounded Query Fix

### Task 8.1: Add pagination to Transactions.list/0
### Task 8.2: Fix Metrics rescue to return errors