test(16.1): UAT item 1 passed — hardened vhost installed on UAT

.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-UAT.md

@@ -8,22 +8,23 @@ updated: 2026-10-10T00:00:00Z
 
 ## Current Test
 
-number: 1
-name: Install the hardened staging vhost on UAT (root)
+number: 2
+name: Posts list search on UAT
 expected: |
-  As root on the UAT server: back up /etc/nginx/sites-available/uat.grzybyfunkcjonalne.pl,
-  install /srv/grzybyfunkcjonalne/deploy/grzybyfunkcjonalne-staging.conf over it (sha256 bce4d7f9…bd7c),
-  `nginx -t && systemctl reload nginx`. Afterwards public pages carry X-Content-Type-Options,
-  X-Frame-Options, Referrer-Policy, Permissions-Policy and Content-Security-Policy-Report-Only
-  exactly once; /gfadmin keeps its own enforced CSP and Referrer-Policy: same-origin and is not
-  behind basic auth; the public site still is.
+  Searching "cordyceps" in the Journal posts list returns rows.
 awaiting: user response
 
 ## Tests
 
 ### 1. Install the hardened staging vhost on UAT (root)
 expected: Security headers present exactly once on public pages, /gfadmin unchanged in access, `nginx -t` passes
-result: [pending]
+result: pass
+evidence: |
+  2026-10-09 23:05 UTC via debian@ sudo. Backup /etc/nginx/sites-available/uat.grzybyfunkcjonalne.pl.bak-20261009T230555Z;
+  installed sha256 bce4d7f9…bd7c; `nginx -t` ok; reloaded. curl: /, a post, /_journal, a /storage 404 and /gfadmin each carry
+  HSTS, nosniff, X-Frame-Options DENY, Referrer-Policy, Permissions-Policy and CSP-Report-Only exactly once; /gfadmin keeps its
+  enforced CSP and Referrer-Policy same-origin, answers 200 without basic auth, locale cookie Secure; public paths still 401
+  off-server. On-server smoke (loopback): smoke: ok (98 urls); 200 pages show all six headers. Winter vhost untouched.
 
 ### 2. Posts list search on UAT
 expected: Searching "cordyceps" at https://uat.grzybyfunkcjonalne.pl/gfadmin/golem15/journal/posts returns rows (no "The list could not be loaded")
@@ -44,9 +45,9 @@ result: [pending]
 ## Summary
 
 total: 5
-passed: 0
+passed: 1
 issues: 0
-pending: 5
+pending: 4
 skipped: 0
 blocked: 0