[Rewrite P6] Hardening: fuzz, benchmark gate, 72h soak, security review #868

Parent: #860
Milestone: Phase 6: Hardening + benchmark
Host: both · Expected cost: $3.30

Prove the rewrite before cutover: security review, the benchmark gate, and the long-run soak.

• Six-lens factory review of the whole nostream-relay + nostream-storage surface (security, architecture, performance at minimum; code/UX on the admin+MCP surface)
• Fuzzing: cargo-fuzz targets on the message parser, filter parser, NIP-11 doc generator, settings loader — 24h fuzz run on tauceti, zero crashes (crashes found → issues → re-fuzz)
• Benchmark gate (chappie rig, from [Rewrite P3] Storage seam + LMDB backend (strfry-style) + PG→LMDB migration #864's baseline): LMDB backend within 1.5× of Postgres on REQ p95 latency, ≥ 1× on ingest throughput, at 1M and 10M event corpora; results published in docs/rewrite/benchmarks.md
• Soak: 72h run on tauceti under synthetic load (mixed subscribe/event/COUNT/negentropy traffic, restarts injected) — memory flat, no fd leaks, event-store checksums stable across restarts
• Security review of the new surface: the MCP auth model, the settings surface, the migration tool (it holds DB credentials), LMDB file permissions
• Docs: docs/rewrite/ completed — architecture map TS→Rust crate, deployment guide, operator migration runbook

Acceptance: fuzz clean, benchmark gate green, soak green with published evidence, review lenses PASS, docs complete.

• Prometheus /metrics endpoint (feat: add Prometheus metrics endpoint #595): the soak's acceptance is that the relay stays healthy under sustained load, and health is unmeasurable from outside the process until this exists — connections, throughput and queue depth have to be scraped live, or the soak produces a log rather than a measurement. One build pass, inside this issue's estimate rather than as a row of its own.

Estimate basis (2026-10-24): $3.30 - the 72-hour soak is wall-clock, not tokens; fuzzing, the benchmark gate and an independent security review cost about two large jobs' review rounds. Model and per-unit costs: .factory/estimates.md.