Wahoo is work in progress. Do not use it in production yet.

## Build And Test

Run these commands from the application root:

```bash
npm ci --prefix web
npm test --prefix web
npm run typecheck --prefix web
npm run build --prefix web
npm run test:ssr --prefix web
go test ./...
go test -race ./...
go vet ./...
go build -o bin/app .
```

The generated lockfile pins frontend dependencies. Do not use `npm install` in CI or Docker builds.

## Runtime

The Go server owns public HTTP. The Node SSR worker binds only to `127.0.0.1:4173`. In production, `NODE_ENV=production` makes SSR worker failures fail closed instead of serving a development fallback.

The generated Docker image runs `tini` and a Node supervisor. The supervisor stops the container if either Go or the SSR worker exits. Its health check requires both `GET /healthz` and private worker readiness.

```bash
docker build -f Dockerfile.example -t acme .
docker run --rm -p 8080:8080 acme
```

Use separate web and worker workloads when background work has independent scaling or retry requirements.

## Visible Security Policy

`internal/config` sets a basic response-header policy and 1 MiB JSON body limit. Review and extend it for the application. Wahoo does not infer TLS, HSTS, trusted proxies, CORS, cookie settings, CSRF policy, or distributed rate-limit storage.

Use `server.RateLimit` with an application-defined key and shared limiter in multi-instance production. `ratelimit.Memory` is bounded and process-local only.

## Health And Readiness

`GET /healthz` confirms that Go accepts requests. `GET /readyz` calls an application-owned readiness function with a 250 ms context deadline. Add bounded database and dependency checks before your deployment uses it.

## Realtime, Webhooks, And Integrations

Do not expose generated realtime, upload, mail, audit, webhook, entitlement, or billing stubs. Add authentication, tenant authorization, rate limits, payload limits, provider adapters, and idempotency first.

Webhook signature verification proves authenticity and bounded freshness only. Store delivery IDs atomically and process each provider event idempotently.

## CI

Wahoo CI runs Go tests, race tests, vet, generated-project tests, frontend tests/typechecking/build, Docker build, runtime health/readiness, OpenAPI, fail-closed routes, and SSR-worker-loss behavior. Require the `CI / verify` check before merging.

## Release Verification

The current release installer requires an explicit release tag and GPG. It verifies a signed `checksums.txt` before extraction.

```bash
curl --fail --location --silent --show-error https://raw.githubusercontent.com/bjarneo/wahoo/v0.3.0/install.sh --output /tmp/wahoo-install.sh
WAHOO_VERSION=v0.3.0 sh /tmp/wahoo-install.sh
```

Use a versioned installer URL. Do not pipe a mutable branch into a shell.