122 lines
4.1 KiB
Markdown
122 lines
4.1 KiB
Markdown
# Non-functional requirements
|
||
|
||
## Reliability and integrity
|
||
|
||
- Published content, revisions, audit and outbox changes are transactionally consistent.
|
||
- A failed request cannot leave a partially published page.
|
||
- Attachment references cannot point to missing committed blobs without a detectable
|
||
integrity violation.
|
||
- Imports are idempotent and reversible by import ID.
|
||
- Backups are considered successful only after manifest and hash validation.
|
||
- Restore is tested into a clean target.
|
||
- Database migrations are forward-tested from every supported released schema.
|
||
|
||
## Performance targets
|
||
|
||
Targets are measured on a modest x86-64 Unraid host with SSD-backed PostgreSQL after warm
|
||
startup, using the documented synthetic dataset.
|
||
|
||
| Operation | Dataset | Target |
|
||
|---|---:|---:|
|
||
| Application shell first authenticated response | normal | p95 < 1.0 s |
|
||
| Page API read | 100,000 pages | p95 < 300 ms |
|
||
| Search first page | 100,000 pages / 1,000,000 revisions | p95 < 750 ms |
|
||
| Lazy tree child load | 10,000-node collection | p95 < 300 ms |
|
||
| Page publish without attachment | normal | p95 < 500 ms |
|
||
| Project context bundle | 10,000 project-linked records total | p95 < 800 ms |
|
||
| API health liveness | normal | p95 < 100 ms |
|
||
|
||
The UI should remain responsive under a 4× CPU slowdown profile. Performance regressions
|
||
must be measured; arbitrary timeout increases are not fixes.
|
||
|
||
## Capacity targets
|
||
|
||
Initial validated design target:
|
||
|
||
- 100,000 current pages;
|
||
- 1,000,000 page revisions;
|
||
- 10,000 projects;
|
||
- 1,000,000 project updates/relations combined;
|
||
- 100,000 attachment references;
|
||
- 500 GiB attachment storage, constrained by host capacity;
|
||
- 20 concurrent interactive sessions;
|
||
- 10 service accounts.
|
||
|
||
These are validation ceilings, not expected normal usage.
|
||
|
||
## Availability
|
||
|
||
- Single-host design; no false high-availability claim.
|
||
- Graceful shutdown and database connection draining.
|
||
- Readiness becomes false when mandatory dependencies are unavailable.
|
||
- Liveness remains independent of transient PostgreSQL unavailability.
|
||
- Background jobs use leases/idempotency to recover after restart.
|
||
- No required outbound internet dependency for normal operation.
|
||
|
||
## Security
|
||
|
||
- Private by default.
|
||
- Least privilege.
|
||
- Secure session cookies and CSRF protection.
|
||
- Strong password policy and lockout.
|
||
- Scoped, revocable service tokens.
|
||
- Authorization at use-case/query boundaries.
|
||
- Safe Markdown and attachment handling.
|
||
- Security headers.
|
||
- Sensitive-data log redaction.
|
||
- Non-root production container.
|
||
- Dependency, secret and container scans in release gate.
|
||
- Threat model maintained in `docs/26-threat-model.md`.
|
||
|
||
## Accessibility
|
||
|
||
- WCAG 2.2 AA target for implemented flows.
|
||
- Keyboard-complete operation.
|
||
- Visible focus.
|
||
- Semantic landmarks and headings.
|
||
- Dialog focus trap/return.
|
||
- Sufficient contrast.
|
||
- 200% zoom and narrow viewport without loss of function.
|
||
- Reduced-motion support.
|
||
- Automated axe coverage plus manual keyboard/screen-reader spot checks.
|
||
|
||
## Compatibility
|
||
|
||
Supported clients for release validation:
|
||
|
||
- current stable Chromium-based desktop browser;
|
||
- current stable Firefox desktop;
|
||
- representative Android Chromium viewport;
|
||
- touch and keyboard interaction.
|
||
|
||
The server supports Linux containers on x86-64. ARM64 support is desirable when the
|
||
dependency chain and CI can verify it.
|
||
|
||
## Maintainability
|
||
|
||
- Modular-monolith dependency rules enforced by tests.
|
||
- Strict nullability and TypeScript.
|
||
- Warnings as errors.
|
||
- Versioned API.
|
||
- Documented migrations and ADRs.
|
||
- One high-level verification command.
|
||
- No hidden manual production build steps.
|
||
- Current-state and evidence documents updated per milestone.
|
||
|
||
## Observability
|
||
|
||
- Structured JSON logs in production.
|
||
- Correlation/request ID.
|
||
- Health status and bounded system metrics.
|
||
- Audit trail separate from diagnostic logs.
|
||
- No user page bodies or attachment contents in normal logs.
|
||
- Background-job state visible to administrators.
|
||
|
||
## Localization and timezone
|
||
|
||
- Primary UI locale: `nl-BE`.
|
||
- Store instants in UTC.
|
||
- Render dates/times in the configured installation timezone, default
|
||
`Europe/Brussels`.
|
||
- Store locale-independent status values and translate in the UI.
|