backend

Use Go 1.22+ pattern routing with http.NewServeMux, as the Survey-Forms backend does with three separate muxes for server, public API, and admin. Do not introduce a router dependency like chi or gin; the public/admin mux split is the intended structure.

Run goose migrations as a separate deploy step, never from a container entrypoint, using the migrate binary via docker compose run. Keep the zero-padded numbered SQL sequence in the migrations directory.

Database-backed tests skip silently when TEST_DATABASE_URL is unset, producing a green run that proves nothing. The CI pipeline greps for the skip message and fails the build, so always set TEST_DATABASE_URL to actually run them.

Parse forwarding headers right-to-left, trusting a hop only if the direct peer is in TRUSTED_PROXIES, and stop at unparseable entries. Taking the first X-Forwarded-For value unconditionally is spoofable and is a known live bug in this estate.

A missing embedding model cache makes the service fall back to a HashingEmbedder and keep serving 200 OK. Use the /health/providers endpoint with strict=true, which returns 503 when degraded, as a deploy smoke-test gate.

The can_* columns are enum('true','false') strings, and the string 'false' is truthy in PHP, so negating the flag never triggers. Real policy uses string comparisons on current_role; never convert these to truthiness checks.