docs: record C7 production hydrated-browser smoke

[LuanTrindade95]

Validation-only item C7. No product code, Compose, Dockerfile or nginx config was touched — the diff is brain-only.

What was validated

The production stack (docker-compose.prod.yml) ran twice with two disjoint sets of public values, both different from the localhost defaults, in throwaway Compose projects with their own volumes. The adversarial pass bound its ports to 127.0.0.55 only, so the default origin answered connection refused and any leak would fail loudly.

Proven:

• Canonical, og:url, og:image, twitter:image and JSON-LD use the configured public origin on the landing, plugin and command pages.
• /runtime-config.js serves the configured API origin, public origin and Reverb block, with Cache-Control: no-store.
• After hydration — proven by a typed search producing DOM results and a routerLink navigation with no new document request — all 53 captured requests landed on a configured origin. Zero requests to the default origin.
• The browser websocket reaches the configured public Reverb host and gets pusher:connection_established, even though the frontend service still pins COMMANDSPHERE_REVERB_HOST: localhost.
• A forged Host header never reaches canonical or metadata: publicUrlFor() in frontend/src/server.ts builds from COMMANDSPHERE_PUBLIC_ORIGIN alone.
• POST /api/v1/auth/dev-login answers 403 auth.dev_login_disabled in production, before request validation.

This closes the last open acceptance criterion of Priority 2, "Docker production smoke validates hydrated browser API calls".

Findings recorded, none caused by this item

• Seeding is broken in the production image: fakerphp/faker is in require-dev while docker/backend.prod.Dockerfile installs --no-dev, so factories calling fake() abort. Now Priority 13.
• No Content-Security-Policy header is served by SSR, /runtime-config.js or the API. A clean console proves absence of policy, not compliance.
• The API answers Access-Control-Allow-Origin: *, the Laravel default with config/cors.php unpublished.

Gates

• Production Docker runtime gate: VALIDATED in both passes, including migrations and Scout index sync.
• migrate:fresh --seed: FAILED for the reason above, not by regression.
• Backend and frontend unit, lint and build gates: PENDING — no code changed.

Evidence: brain/handoffs/2026-09-23-production-hydrated-smoke.md.

🤖 Generated with Claude Code