Day 119 — Capstone Preparation & Final Integration

Pre-Capstone Quality Gates

# 1. Build — must compile without errors
go build ./...

# 2. Vet — must pass all static analysis checks
go vet ./...

# 3. Race detector — zero data races
go test -race -timeout=2m ./...

# 4. Coverage — security packages must meet targets
go test -coverprofile=cover.out ./...
go tool cover -func=cover.out | awk '
    /internal\/waf/ { if ($3+0 < 85) print "FAIL: waf coverage " $3 }
    /internal\/auth/ { if ($3+0 < 90) print "FAIL: auth coverage " $3 }
    /internal\/ratelimit/ { if ($3+0 < 85) print "FAIL: ratelimit coverage " $3 }
'

# 5. Fuzz (quick run) — no panics on seed corpus
go test -run=FuzzNormalizationPipeline/seed -fuzztime=10s ./internal/waf/...
go test -run=FuzzJSONSchemaValidator/seed -fuzztime=10s ./internal/validation/...

# 6. Attack simulation — all attacks blocked at ≥80% rate
go test -v -run=TestFullAttackPlaybook ./integration/...

# 7. Performance baseline
# 500 concurrent clients, 10k requests, p99 overhead < 10ms
go test -run=TestPerfBaseline -v ./integration/...

# 8. Goroutine leak check
# After load test: goroutine count must return to baseline ± 5 within 10s
go test -run=TestGoroutineLeak -v ./integration/...

# 9. Memory baseline (no unbounded growth)
# Heap after 10k requests must be < heap + (n * 10KB)
go test -run=TestMemoryBaseline -v ./integration/...

Component Wiring Checklist

// main.go structure for Day 120 — all components wired here
package main

import (
    // Standard library only
    "context"
    "crypto/tls"
    "log/slog"
    "net"
    "net/http"
    "os"
    "os/signal"
    "syscall"
    "time"

    // Internal packages
    "github.com/you/proxy/internal/auth"
    "github.com/you/proxy/internal/bot"
    "github.com/you/proxy/internal/chaos"
    "github.com/you/proxy/internal/ddos"
    "github.com/you/proxy/internal/health"
    "github.com/you/proxy/internal/ops"
    "github.com/you/proxy/internal/ratelimit"
    "github.com/you/proxy/internal/threat"
    "github.com/you/proxy/internal/tracing"
    "github.com/you/proxy/internal/validation"
    "github.com/you/proxy/internal/waf"
)

// Component checklist:
// [x] TLS config with mTLS + SNI routing (Week 6)
// [x] CertReloader (Week 8)
// [x] ProtectedListener + SlowlorisDetector (Week 13/15)
// [x] CIDRRateLimiter (Week 13)
// [x] TrafficAnalyzer + TieredResponder (Week 13)
// [x] JA3Detector (Week 14)
// [x] BotScorer + TieredBotMiddleware (Week 14)
// [x] HoneypotTracker (Week 14)
// [x] AuthMiddleware (HMAC + ECDSA + mTLS) (Week 11)
// [x] L7RateLimiter (Week 11)
// [x] WAFMiddleware (Week 10)
// [x] SchemaValidator (Week 11)
// [x] PIIScrubber (Week 11)
// [x] ThreatIntel store (Week 12)
// [x] slog JSON logger (Week 12)
// [x] Tracer (W3C trace context) (Week 15)
// [x] HealthRegistry (Week 15)
// [x] ShutdownManager (Week 15)
// [x] SignalDispatcher (Week 15)
// [x] ChaosMiddleware (Week 15)
// [x] ReverseProxy with circuit breaker per backend (Week 9, 15)
// [x] expvar + pprof endpoints (Week 4, 8)
// [x] FD inheritance for zero-downtime restart (Week 15)