# v0.3.0 Platform Hardening

> **Status:** Complete (2026-06-07)  
> **Risk tier:** T3 — cross-repo operational migration  
> **Thesis:** Port uflex production **operational maturity** (CI, harness, wire,
> devcontainer, docs contracts, Cursor rules) into Golid without marketplace
> domain code.

## Non-goals

- Stripe, BoldSign, marketplace modules, Labs multi-host routing
- Tailwind 4, domain-split frontend API client
- Wholesale uflex merge

## Phases (executed)

| Phase | Deliverable |
|-------|-------------|
| 0 | `git-commits.mdc`, prep triage |
| A₀ | `internal/wire/`, service subpackages |
| A | Per-package integration schemas, `init-test-db.sh` |
| B | Sharded CI, path filters, E2E overlay, Codecov v6 |
| C | Devcontainer Node 24, HMR pins, `dev-watch.mjs` |
| D | Vitest 4, recalibrated thresholds |
| A′ | Module spec stubs (auth, users, feature) |
| E | `check_spec_drift.sh` + CI job |
| F | 38 Cursor rules (37 at v0.3.0 tag + `plan-execution-loop` post-release) |
| G | Organism docs, CLI reference, ADRs 003–007 |
| H | Rename tool sweep |
| I | CHANGELOG `[0.3.0]`, README refresh |

## Success metrics (met)

- CI: 9 jobs, path-filtered, spec-drift on docs PRs
- Local: devcontainer golden path (backend 8080 → frontend 3000)
- Harness: `TEST_DATABASE_URL` + per-package schemas
- Governance: 38 rules, citation + drift + rule-health gates
- Codecov: `target: 80%` locked (post-v0.3.0 B3b; intentional vs uflex B2 `auto` plan)

## Lessons (for next plans)

1. **Dockerfile toolchain bumps** need a rebuild-without-cache runbook — stale
   Node layers look like app bugs.
2. **Docs cited by rules** must exist or `check_rule_health.sh` and onboarding
   drift — close reference doc gaps in the same release.
3. **Handler integration shard** — `auth_integration_test.go` landed; matrix leg is live.

## Follow-up (v0.3.1 closeout slice)

- ~~Handler HTTP integration tests~~ — done (`auth_integration_test.go`)
- ~~Node 24 in frontend Dockerfiles~~ — audit fix in v0.3.1
- ~~Rename `init-test-db.sh`~~ — audit fix in v0.3.1
- Cross-cutting docs (`permissions`, `golden-slices`, `routing-eval`, runbooks) — shipped in 0.3.0
- CSRF prod default documentation — shipped in 0.3.0 CHANGELOG
- README test count accuracy — updated post-coverage recovery (**995** headline tests: 353 Go unit + 622 Vitest + 20 E2E)
