---
description: Run complete 6-phase hardening pipeline
argument-hint: "[project-path: defaults to .]"
allowed-tools: Read, Edit, Write, Bash, Grep, Glob
---

Execute the full hardening pipeline with verification at each phase.

## Pipeline Overview

```
Phase 1: Audit      → Baseline assessment
Phase 2: Fix Critical → Resolve all CRITICAL findings
Phase 3: Fix High   → Resolve HIGH findings (4 rounds)
Phase 4: Fix Medium → Resolve MEDIUM findings
Phase 5: Add Tests  → Generate security tests
Phase 6: Verify     → Before/after comparison
```

## Execution

### Phase 1: Audit
Run `/vaspera-audit` to establish baseline.
- Record initial Production Readiness Score
- Save finding counts by severity

### Phase 2: Fix Critical
Run `/vaspera-fix-critical`
- Must resolve ALL critical findings before proceeding
- Commit: `fix: resolve critical security issues`
- **Gate**: If any critical remains, STOP and report

### Phase 3: Fix High
Run `/vaspera-fix-high`
- 4 rounds: validation → types → UI → API
- Commit after each round: `fix: resolve high-severity issues (round X)`
- **Verification**: Re-scan after each round

### Phase 4: Fix Medium
Run `/vaspera-fix-medium`
- Single pass through medium findings
- Commit: `fix: resolve medium-severity issues`

### Phase 5: Add Tests
Run `/vaspera-add-tests`
- Priority: API routes → data layer → UI → utilities
- Commit: `test: add security tests for critical paths`
- **Gate**: `npm test` must pass

### Phase 6: Verify
Run `/vaspera-verify`
- Generate HARDENING-REPORT.md
- Compare before/after scores
- Flag any regressions

## Pre-commit Gate

Before each commit, verify:
- [ ] `npm run build` passes (TypeScript)
- [ ] `npm test` passes (all tests)
- [ ] No new console.logs introduced
- [ ] No commented code added
- [ ] No circular imports

## Failure Handling

**Build fails**: Pause, report error, suggest fix
**Tests fail**: Roll back phase changes, report
**Regressions detected**: Flag prominently, pause for review

## Final Report

```markdown
# Hardening Complete

## Score Improvement
Before: XX/100 (LEVEL)
After: YY/100 (LEVEL)
Delta: +ZZ points

## Findings Resolved
- Critical: X → 0
- High: Y → N
- Medium: Z → M

## Commits Made
1. fix: resolve critical security issues
2. fix: resolve high-severity issues (round A)
...

## Next Steps
- Review and merge PR
- Deploy to staging
- Run production certification
```

## Important

- This is a LONG-RUNNING operation — may take 30+ minutes
- Each phase commits independently for clean rollback
- The pipeline can be resumed from any phase if interrupted
- Do NOT push to remote unless user explicitly requests
