# SIKON Cpanel v1.3.0 — P3 Release Hardening

P3 is the release-readiness hardening pass before the user performs the full manual P0→P3 test cycle.

## Security
- CSRF on POST/PUT/PATCH/DELETE except login.
- HttpOnly + SameSite session cookies; Secure cookie because panel endpoints are HTTPS.
- Security headers: nosniff, frame deny, strict referrer policy, permissions policy.
- Login throttling: five failed attempts per IP/username within a ten-minute window.

## Runtime
- Gunicorn replaces the Flask development server.
- `/api/health` checks DB, release marker, admin service and user service.

## Task durability
- Queued tasks resume after process restart.
- Running tasks are marked interrupted instead of being silently replayed.
- Interrupted tasks can be explicitly retried.
- Queued tasks can be cancelled safely.

## Release gate
- Installer checks both `/api/version` and `/api/health`.
- P0, account engine and P2 features are retained.
- Manual clean-OS, upgrade, failure/rollback, account-isolation and service-operation tests remain required before production declaration.