Day 74 — Stage VII gate

Updated

July 30, 2026

Day 74 — Stage VII gate

Stage VII · Gate day · ~3h
Goal: Prove your service/CLI is a release candidate for Stage VIII: lint-clean, vulnerability-scanned, profiled, containerized (if a service), cross-built where relevant, and documented so someone else could run it.

Important

If the gate fails, fix gaps today—do not drag ship-quality debt into hexagonal refactors and capstone design. Architecture days amplify mess.

Why this day exists

Gates prevent “I roughly did Stage VII.” Architecture and capstone work (Days 75–90) assume you can:

  • Build artifacts for real targets
  • Observe performance
  • Ship a container (or multi-OS binaries)
  • Trust dependency hygiene

Stage VIII will reorganize packages and design a capstone—not teach you pprof or govulncheck from scratch.

Theory 1 — What “ship quality” meant (Days 63–73)

Day Capability Evidence artifact
63 Cross-compile / tags Binaries + file notes
64 vet + staticcheck Clean run / lint script
65 pprof FINDINGS.md
66 Benchmarks BENCH.md / benchstat
67 GC awareness GC.md table
68 Containers Dockerfile + size note
69 Metrics /metrics snippet
70 Traces TRACE.md
71 CLI UX Multi-command demo
72 govulncheck SECURITY-SCAN.md
73 Elective ELECTIVE.md

You need coverage of the spine, not perfection of every stretch. Minimum bar below.

Theory 2 — Gate criteria (must pass)

1. Builds and analyzes cleanly

go version   # go1.26.x
go test ./...
go vet ./...
staticcheck ./...

2. Supply chain

govulncheck ./...

No unreviewed reachable vulns. Accepted risks must list ID, reason, owner, review date.

3. Performance evidence

At least one of:

  • CPU or heap profile with interpretation notes, or
  • Benchmark set with before/after or baseline interpretation

4. Runtime packaging

Path Requirement
Service Multi-stage image builds; container runs health check
CLI-only Multi-arch or multi-OS binaries + install instructions

5. Operability signals (service)

  • Health endpoint (/healthz or live/ready)
  • Metrics endpoint or documented deferral with risk note (prefer metrics present)

6. README runnable by a stranger

Someone new can answer: what it does, how to run, how to build, how to test, required env vars.

Theory 3 — Release candidate definition (RC0)

RC0 for this volume means:

  • Green automated checks above
  • Runnable README
  • Known risks listed (not zero risks)
  • Performance artifact exists (even if “nothing hot”)

You will still refactor packages in Days 75–81—prefer not changing product scope until Day 82 design. RC0 is “safe to restructure,” not “done forever.”

Theory 4 — Gate runbook document

Create GATE-VII.md and fill as you go:

# Stage VII Gate

Date:
Module:
Go version: go1.26.x
staticcheck:
govulncheck:

## Commands
- [ ] go test ./...
- [ ] go vet ./...
- [ ] staticcheck ./...
- [ ] govulncheck ./...
- [ ] docker build / release binaries

## Evidence links (relative paths)
- Profiles:
- Benchmarks:
- Container / binaries:
- Metrics:
- Elective:

## Known risks
1.
2.

## Self-review
1. Production artifact:
2. Unhealthy detection:
3. Top CPU hotspot:
4. Highest-risk dependency:
5. Debt into Stage VIII:

## Verdict
PASS / FAIL — notes:

Suggested gate script scripts/gate-vii.sh

#!/usr/bin/env bash
set -euo pipefail
go test ./...
go vet ./...
staticcheck ./...
govulncheck ./...
# optional packaging:
# docker build -t gate-vii:local .
# ./scripts/build-release.sh
echo "gate-vii checks OK"

Make it executable and run it cold once before declaring PASS.

Theory 5 — Performance evidence minimum

If you skipped deep Day 65 work, produce a minimum artifact today:

go test -bench=. -cpuprofile=cpu.out ./internal/...
go tool pprof -top cpu.out | head -20

Paste top 5 into GATE-VII.md. Gate needs some performance artifact—not a novel optimization.

Interpreting “nothing hot”

Top samples were runtime.mallocgc and encoding/json.
No unexpected user-function hotspot at this bench size.
Next load test (Day 80) will re-check under HTTP concurrency.

That is a valid finding. Silence is not.

Theory 6 — Packaging evidence

Service — multi-stage sketch (reminder)

FROM golang:1.26 AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -o /out/service ./cmd/service

FROM gcr.io/distroless/static:nonroot
COPY --from=build /out/service /service
USER nonroot:nonroot
EXPOSE 8080
ENTRYPOINT ["/service"]

Prove:

docker build -t gate-vii:local .
docker run --rm -p 8080:8080 gate-vii:local
# other terminal:
curl -sf http://127.0.0.1:8080/healthz

CLI — multi-target sketch

GOOS=linux  GOARCH=amd64 go build -o dist/tool_linux_amd64 ./cmd/tool
GOOS=darwin GOARCH=arm64 go build -o dist/tool_darwin_arm64 ./cmd/tool
file dist/*

Document install: copy binary, chmod +x, put on PATH.

Theory 7 — Rubric

Criterion Weight 0 1 2
test + vet + staticcheck 25% fails warnings ignored green
govulncheck 15% ignored dirty unreviewed clean/accepted
Perf artifact 15% none raw file only interpreted
Container or multi-target 20% none builds flaky documented run
Ops signals (svc) / UX (CLI) 10% none partial solid
README + GATE-VII.md 15% missing thin stranger-runnable

Pass: ≥ 80% with no zero on test/vet/staticcheck or packaging.

Lab 1 — Execute the gate spine

Suggested workspace: primary project from Stages VI–VII.

  1. Run scripts/gate-vii.sh (or manual command list).
  2. Fix failures in priority order (below).
  3. Complete GATE-VII.md with PASS/FAIL.
  4. Ensure .gitignore excludes profiles/binaries but includes notes (FINDINGS.md, SECURITY-SCAN.md, GATE-VII.md).
  5. List top 3 debts for Days 75–81.

If FAIL — priority order

  1. Tests / vet / staticcheck
  2. govulncheck
  3. Container or release binaries
  4. Any observability gap (metrics/health)
  5. README runnable

Architecture days will amplify mess—clean first.

Lab 2 — Evidence inventory

Artifact Path Present?
Lint script scripts/lint.sh or gate script
SECURITY-SCAN.md Day 72
FINDINGS.md / pprof notes Day 65
BENCH.md Day 66
Dockerfile or dist/ Day 63/68
Metrics note Day 69
ELECTIVE.md Day 73

If something is missing, regenerate a minimal version today rather than claiming “done last week” without files.

Lab 3 — Stranger README test

Hand README to yourself after a 10-minute break (or a friend). Attempt:

git clone ...   # or open clean dir
# follow README only

Note every missing env var, port, or migrate step in GATE-VII.md and fix the README.

Worked README section

## Architecture (Stage VII)

HTTP service exposing /v1/* JSON APIs, SQLite/Postgres store, Prometheus /metrics,
pprof on 127.0.0.1:6060 (dev only). Multi-stage distroless image.
Build: `docker build -t app:dev .` or `make release`.
Cross-compile: `./scripts/build-release.sh`.
Test: `go test ./...` · Lint: `./scripts/lint.sh`

Lab 4 — Self-review answers (required)

Answer in GATE-VII.md:

  1. What is the production artifact (image tag story or binary names)?
  2. How does an operator know the process is unhealthy?
  3. What is the top CPU hotspot you measured—even if “nothing hot”?
  4. Which dependency would hurt most if vulnerable?
  5. What debt are you explicitly carrying into Stage VIII?

Lab 5 — RC0 freeze note

Write three bullets:

## RC0 freeze
- Product scope frozen until Day 82 design (bugfixes OK)
- Stage VIII may move packages without new features
- Known risks: (1) ... (2) ...

This prevents “while I’m here” feature creep during hexagonal refactors.

Hour-by-hour suggestion

Time Focus
0:00–0:40 gate script: test/vet/staticcheck/govulncheck
0:40–1:20 Fix failures; rescan
1:20–2:00 Container or multi-target binaries
2:00–2:30 Perf artifact + metrics/health check
2:30–3:00 GATE-VII.md + README stranger pass

Common gotchas

Gotcha Fix
Evidence only on absolute laptop paths Relative paths in GATE-VII.md
Lint clean but tests flaky Fix flakes now
Container only builds with host network hacks Document offline/cache assumptions
Metrics without cardinality thought Quick label review
“I’ll profile after capstone” Minimum profile today
Silent staticcheck not installed Install or fail the script
govulncheck clean, app insecure Still do Day 81 checklist later
Docker as root + pprof public nonroot + localhost pprof

Checkpoint

  • go test / vet / staticcheck green
  • govulncheck green or accepted risks written
  • Profile or benchmark evidence present and interpreted
  • Container or multi-target binaries documented
  • GATE-VII.md verdict PASS
  • README runnable by a stranger
  • RC0 freeze note written
  • Top 3 Stage VIII debts listed

Commit

git add .
git commit -m "day74: stage vii gate pass"

Write three personal gotchas before continuing.

Tomorrow

Stage VIII begins — Day 75 package boundaries: accept interfaces, return structs, and draw lines that keep the capstone maintainable. Enter only with RC0 confidence—or finish gate fixes first.