[DeFiVC]

Closes #1362, Closes #1363, Closes #1364, Closes #1365

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Refactoring (no functional or behavioral changes)
• Performance improvement
• Documentation update
• Build / CI configuration change
• Dependency update
• Other:

---

Summary

Four small, independent improvements to CI monitoring, test reporting, and observability:

1. feat(security): Automated TLS cert auto-renewal monitoring check in CI #1362 — scripts/check-ssl-expiry.mjs + tls-cert-check.yml: fails CI and opens/updates a maintainer issue when any configured domain's TLS certificate expires within 30 days.
2. feat(testing): Automated visual diff test report artifacts in GitHub Actions #1363 — scripts/visual-diff-summary.mjs wired into visual-regression.yml: inventories screenshot diff/actual/expected artifacts and publishes a markdown report to the GitHub Actions run summary.
3. feat(testing): Add synthetic user transaction bot simulating 24/7 campaign activity on Testnet #1364 — scripts/synthetic-transaction-bot.mjs: continuous background bot simulating the register → credit → verify → cleanup journey on Testnet, emitting Prometheus metrics; supports --once / --iterations for CI.
4. feat(infra): Automated database query execution time logging for slow query detection #1365 — backend/src/db/slowQueryLog.js wired into createDal: instruments better-sqlite3 prepared statements and logs queries ≥ 200ms (configurable via DB_SLOW_QUERY_MS) as structured JSON for CloudWatch, plus optional Sentry events via SENTRY_DSN.

Motivation / Context

Closes #1362 — encrypted transport breaks silently when certificates lapse; maintainers need a 30-day early warning.

Closes #1363 — visual regression diffs were uploaded as artifacts but invisible in the run summary, so regressions were easy to miss.

Closes #1364 — Testnet flow integrity was only exercised on demand; a synthetic bot gives continuous background coverage.

Closes #1365 — slow database queries were invisible in production telemetry.

Changes

Area	Files	What
security	scripts/check-ssl-expiry.mjs, .github/workflows/tls-cert-check.yml	TLS expiry probe + scheduled CI check (30-day window)
testing	scripts/visual-diff-summary.mjs, .github/workflows/visual-regression.yml	Diff artifact inventory published to $GITHUB_STEP_SUMMARY
testing	scripts/synthetic-transaction-bot.mjs	24/7 synthetic transaction bot with Prometheus metrics
infra	backend/src/db/slowQueryLog.js, backend/src/db/slowQueryLog.test.js, backend/src/dal/index.js	Slow-query instrumentation (≥200ms) with CloudWatch/Sentry sinks

Testing

• feat(security): Automated TLS cert auto-renewal monitoring check in CI #1362: verified against example.com — ok path exits 0 (65 days left), expiring path exits 1 with SSL_EXPIRY_WARN_DAYS=365, unreachable host exits 1 with an error row, empty SSL_CHECK_DOMAINS exits 0 with a notice.
• feat(testing): Automated visual diff test report artifacts in GitHub Actions #1363: ran visual-diff-summary.mjs on an empty tree (reports 0 artifacts) and on a mock tree with 1 diff/actual/expected set (lists the diff file and points at the artifact). Missing root degrades gracefully.
• feat(testing): Add synthetic user transaction bot simulating 24/7 campaign activity on Testnet #1364: ran --once against a dead port (exit 1, failure metric emitted) and --iterations 3 against a stubbed backend (exit 0, 3 OK iterations, counters/gauges correct).
• feat(infra): Automated database query execution time logging for slow query detection #1365: node --test src/db/slowQueryLog.test.js — 8/8 pass, covering threshold filtering, multi-sink fan-out, configurable default (200ms), throwing sinks, sync timing, throw-path reporting, prepared-statement instrumentation, and result passthrough.
• Branch rebased onto upstream/main; git merge-tree against upstream reports no conflicts.

Tradeoffs

• feat(security): Automated TLS cert auto-renewal monitoring check in CI #1362 probes with rejectUnauthorized: false so we can read expiry even when the cert would fail validation (e.g. mis-chained). The report still surfaces the dates, and connectivity errors fail the run.
• feat(testing): Automated visual diff test report artifacts in GitHub Actions #1363 writes a summary of artifacts rather than embedding base64 images — keeps summaries small; pixel-level inspection stays in the downloaded artifacts.
• feat(testing): Add synthetic user transaction bot simulating 24/7 campaign activity on Testnet #1364 reuses the canary's journey shape and its Prometheus text format so existing dashboards/alerts can adopt it with a new job label instead of a new pipeline.
• feat(infra): Automated database query execution time logging for slow query detection #1365 instruments at the prepare() boundary in createDal, which covers every SQLite repository in one place. Telemetry failures are swallowed so instrumentation can never break query execution. Postgres pooling is not instrumented here.

Out of scope

• Actual certificate auto-renewal (e.g. certbot/ACME) — issue feat(security): Automated TLS cert auto-renewal monitoring check in CI #1362 asks for the monitoring/alerting check only.
• Percy/Chromatic cloud upload — the repo's Playwright local-snapshot flow is summarized instead; external SaaS integration would need secrets/credentials.
• Postgres (pg.Pool) slow-query instrumentation.
• Alertmanager rule wiring for the new Prometheus metrics — metrics are emitted in the existing canary format for a follow-up to consume.

[drips-wave]

@DeFiVC Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits