diff --git a/.golangci.yml b/.golangci.yml
index 08f38f3f..901cbbf5 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,11 +1,5 @@
-# HyperFleet Standard golangci-lint Configuration
-# Reference: https://golangci-lint.run/usage/configuration
-#
-# This is the baseline configuration for all HyperFleet Go repositories.
-# Copy this file to your repository root as .golangci.yml
-#
-# golangci-lint should be installed and versioned via bingo in each repository.
-# See linting.md for full documentation of this standard.
+# HyperFleet API - golangci-lint configuration
+# Aligned with: https://github.com/openshift-hyperfleet/architecture/blob/main/hyperfleet/standards/golangci.yml
 
 version: "2"
 
@@ -14,49 +8,6 @@ run:
   tests: true
   modules-download-mode: readonly
 
-linters-settings:
-  errcheck:
-    check-type-assertions: true
-    check-blank: true
-
-  govet:
-    enable-all: true
-
-  goconst:
-    min-len: 3
-    min-occurrences: 3
-
-  misspell:
-    locale: US
-
-  lll:
-    line-length: 120
-
-  gofmt:
-    simplify: true
-
-  revive:
-    rules:
-      - name: exported
-        severity: warning
-        disabled: true
-      - name: unexported-return
-        severity: warning
-        disabled: false
-      - name: var-naming
-        severity: warning
-        disabled: false
-
-  unused:
-    check-exported: false
-
-  unparam:
-    check-exported: false
-
-  exhaustive:
-    check-generated: false
-    default-signifies-exhaustive: true
-
 linters:
   enable:
     # Code Quality
@@ -73,36 +24,116 @@ linters:
     # Code Style
     - misspell
     - lll
-    # - revive
+    - revive
     - gocritic
 
     # Security
     - gosec
 
-issues:
-  # Add repository-specific generated code directories here
-  exclude-dirs:
-    - pkg/api/openapi  # Generated code
-    - data/generated/openapi # Generated file
-
-  exclude-rules:
-    # Relaxed rules for test files
-    - path: _test\.go
-      linters:
-        - gosec
-        - errcheck
-        - unparam
-
-    # Exclude generated code (backup pattern if exclude-dirs doesn't catch all)
-    - path: pkg/api/openapi/
-      linters:
-        - all
+  settings:
+    errcheck:
+      check-type-assertions: true
+      check-blank: true
+
+    govet:
+      enable-all: true
+
+    goconst:
+      min-len: 3
+      min-occurrences: 3
+
+    misspell:
+      locale: US
+
+    lll:
+      line-length: 120
+
+    revive:
+      rules:
+        - name: exported
+          severity: warning
+          disabled: true
+        - name: unexported-return
+          severity: warning
+          disabled: false
+        - name: var-naming
+          severity: warning
+          disabled: false
+
+    unparam:
+      check-exported: false
+
+    exhaustive:
+      default-signifies-exhaustive: true
+
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      # Relaxed rules for test files
+      - linters:
+          - gosec
+          - errcheck
+          - unparam
+        path: _test\.go
+
+      # Exclude generated code (backup pattern if exclusion paths don't catch all)
+      - linters:
+          - all
+        path: pkg/api/openapi/
+
+      # OVERRIDE: Package naming - underscore packages are structural and renaming is out of scope
+      - linters:
+          - revive
+        path: pkg/db/(db_context|db_metrics|db_session)/
+        text: "don't use an underscore in package name"
+
+      # OVERRIDE: Package naming - allow existing package names
+      - linters:
+          - revive
+        path: pkg/(util|errors)/
+        text: "avoid meaningless package names"
+      - linters:
+          - revive
+        path: pkg/errors/
+        text: "avoid package names that conflict with"
+      - linters:
+          - revive
+        path: pkg/api/
+        text: "avoid meaningless package names"
+
+    # Standard exclusion paths
+    paths:
+      - pkg/api/openapi      # OpenAPI generated code
+      - data/generated        # Other generated files
+      - third_party(/|$)
+      - builtin(/|$)
+      - examples(/|$)
 
+issues:
   max-issues-per-linter: 0
   max-same-issues: 0
   new: false
 
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    gofmt:
+      simplify: true
+  exclusions:
+    generated: lax
+    paths:
+      - third_party(/|$)
+      - builtin(/|$)
+      - examples(/|$)
+
 output:
-  format: colored-line-number
-  print-issued-lines: true
-  print-linter-name: true
+  formats:
+    text:
+      path: stdout
diff --git a/cmd/hyperfleet-api/environments/registry/registry.go b/cmd/hyperfleet-api/environments/registry/registry.go
index 9c64a1d6..46a9dd64 100755
--- a/cmd/hyperfleet-api/environments/registry/registry.go
+++ b/cmd/hyperfleet-api/environments/registry/registry.go
@@ -9,8 +9,8 @@ type ServiceLocatorFunc func(env interface{}) interface{}
 
 // ServiceRegistry holds registered services
 type ServiceRegistry struct {
-	mu       sync.RWMutex
 	services map[string]ServiceLocatorFunc
+	mu       sync.RWMutex
 }
 
 var globalRegistry = &ServiceRegistry{
diff --git a/cmd/hyperfleet-api/environments/types.go b/cmd/hyperfleet-api/environments/types.go
index 7f8fb125..aca3d4e0 100755
--- a/cmd/hyperfleet-api/environments/types.go
+++ b/cmd/hyperfleet-api/environments/types.go
@@ -23,13 +23,12 @@ const (
 )
 
 type Env struct {
-	Name     string
-	Services Services
 	Handlers Handlers
-	Clients  Clients
 	Database Database
-	// most code relies on env.Config
-	Config *config.ApplicationConfig
+	Clients  Clients
+	Config   *config.ApplicationConfig
+	Name     string
+	Services Services
 }
 
 type ApplicationConfig struct {
diff --git a/cmd/hyperfleet-api/servecmd/cmd.go b/cmd/hyperfleet-api/servecmd/cmd.go
index 27aec637..24364aea 100755
--- a/cmd/hyperfleet-api/servecmd/cmd.go
+++ b/cmd/hyperfleet-api/servecmd/cmd.go
@@ -169,7 +169,7 @@ func initLogger() {
 	// Use configured hostname with fallback to os.Hostname()
 	hostname := environments.Environment().Config.Server.Hostname
 	if hostname == "" {
-		hostname, _ = os.Hostname()
+		hostname, _ = os.Hostname() //nolint:errcheck // empty string is acceptable fallback
 	}
 
 	logConfig := &logger.LogConfig{
diff --git a/cmd/hyperfleet-api/server/health_server.go b/cmd/hyperfleet-api/server/health_server.go
index ac6dd0ff..e403c4dd 100644
--- a/cmd/hyperfleet-api/server/health_server.go
+++ b/cmd/hyperfleet-api/server/health_server.go
@@ -39,8 +39,8 @@ func NewHealthServer() Server {
 
 type healthServer struct {
 	httpServer      *http.Server
-	shutdownTimeout time.Duration
 	listening       chan struct{}
+	shutdownTimeout time.Duration
 }
 
 var _ Server = &healthServer{}
diff --git a/cmd/hyperfleet-api/server/metrics_middleware_test.go b/cmd/hyperfleet-api/server/metrics_middleware_test.go
index ab208e0e..18fe8e4c 100644
--- a/cmd/hyperfleet-api/server/metrics_middleware_test.go
+++ b/cmd/hyperfleet-api/server/metrics_middleware_test.go
@@ -31,14 +31,14 @@ import (
 )
 
 const (
-	testRequestsTotalMetric  = "hyperfleet_api_requests_total"
-	testDurationMetric       = "hyperfleet_api_request_duration_seconds"
-	testBuildInfoMetric      = "hyperfleet_api_build_info"
-	testClustersPath         = "/api/hyperfleet/v1/clusters"
-	testClustersPathWithID   = "/api/hyperfleet/v1/clusters/{id}"
-	testClustersPathWithSub  = "/api/hyperfleet/v1/clusters/-"
-	testClustersURLWithID    = "/api/hyperfleet/v1/clusters/abc123"
-	testMethodGet            = "GET"
+	testRequestsTotalMetric = "hyperfleet_api_requests_total"
+	testDurationMetric      = "hyperfleet_api_request_duration_seconds"
+	testBuildInfoMetric     = "hyperfleet_api_build_info"
+	testClustersPath        = "/api/hyperfleet/v1/clusters"
+	testClustersPathWithID  = "/api/hyperfleet/v1/clusters/{id}"
+	testClustersPathWithSub = "/api/hyperfleet/v1/clusters/-"
+	testClustersURLWithID   = "/api/hyperfleet/v1/clusters/abc123"
+	testMethodGet           = "GET"
 )
 
 func TestMetricsSubsystem(t *testing.T) {
@@ -89,7 +89,7 @@ func TestBuildInfoMetricIsRegistered(t *testing.T) {
 			break
 		}
 	}
-	Expect(found).To(BeTrue(), testBuildInfoMetric + " metric should be registered")
+	Expect(found).To(BeTrue(), testBuildInfoMetric+" metric should be registered")
 }
 
 func TestMetricsMiddleware_IncrementsRequestCount(t *testing.T) {
@@ -130,7 +130,7 @@ func TestMetricsMiddleware_IncrementsRequestCount(t *testing.T) {
 			break
 		}
 	}
-	Expect(found).To(BeTrue(), testRequestsTotalMetric + " metric should exist")
+	Expect(found).To(BeTrue(), testRequestsTotalMetric+" metric should exist")
 }
 
 func TestMetricsMiddleware_RecordsDuration(t *testing.T) {
@@ -169,7 +169,7 @@ func TestMetricsMiddleware_RecordsDuration(t *testing.T) {
 			break
 		}
 	}
-	Expect(found).To(BeTrue(), testDurationMetric + " metric should exist")
+	Expect(found).To(BeTrue(), testDurationMetric+" metric should exist")
 }
 
 func TestMetricsMiddleware_PathVariableSubstitution(t *testing.T) {
diff --git a/cmd/hyperfleet-api/server/routes.go b/cmd/hyperfleet-api/server/routes.go
index a3814b9b..bd3e907e 100755
--- a/cmd/hyperfleet-api/server/routes.go
+++ b/cmd/hyperfleet-api/server/routes.go
@@ -102,7 +102,7 @@ func (s *apiServer) routes() *mux.Router {
 	apiV1Router.HandleFunc("/openapi.html", openapiHandler.GetOpenAPIUI).Methods(http.MethodGet)
 	apiV1Router.HandleFunc("/openapi", openapiHandler.GetOpenAPI).Methods(http.MethodGet)
 
-	registerApiMiddleware(apiV1Router)
+	registerAPIMiddleware(apiV1Router)
 
 	// Auto-discovered routes (no manual editing needed)
 	LoadDiscoveredRoutes(apiV1Router, services, authMiddleware, authzMiddleware)
@@ -110,7 +110,7 @@ func (s *apiServer) routes() *mux.Router {
 	return mainRouter
 }
 
-func registerApiMiddleware(router *mux.Router) {
+func registerAPIMiddleware(router *mux.Router) {
 	router.Use(MetricsMiddleware)
 
 	// Schema validation middleware (validates cluster/nodepool spec fields)
diff --git a/pkg/api/adapter_status_types.go b/pkg/api/adapter_status_types.go
index 20e43e25..4ed2e101 100644
--- a/pkg/api/adapter_status_types.go
+++ b/pkg/api/adapter_status_types.go
@@ -9,24 +9,16 @@ import (
 
 // AdapterStatus database model
 type AdapterStatus struct {
-	Meta // Contains ID, CreatedTime, UpdatedTime, DeletedAt
-
-	// Polymorphic association
-	ResourceType string `json:"resource_type" gorm:"size:20;index:idx_resource;not null"`
-	ResourceID   string `json:"resource_id" gorm:"size:255;index:idx_resource;not null"`
-
-	// Adapter information
-	Adapter            string `json:"adapter" gorm:"size:255;not null;uniqueIndex:idx_resource_adapter"`
-	ObservedGeneration int32  `json:"observed_generation" gorm:"not null"`
-
-	// API-managed timestamps
-	LastReportTime *time.Time `json:"last_report_time" gorm:"not null"` // Updated on every POST
-	CreatedTime    *time.Time `json:"created_time" gorm:"not null"`     // Set on first creation
-
-	// Stored as JSON
-	Conditions datatypes.JSON `json:"conditions" gorm:"type:jsonb;not null"`
-	Data       datatypes.JSON `json:"data,omitempty" gorm:"type:jsonb"`
-	Metadata   datatypes.JSON `json:"metadata,omitempty" gorm:"type:jsonb"`
+	LastReportTime *time.Time `json:"last_report_time" gorm:"not null"`
+	CreatedTime    *time.Time `json:"created_time" gorm:"not null"`
+	Meta
+	ResourceType       string         `json:"resource_type" gorm:"size:20;index:idx_resource;not null"`
+	ResourceID         string         `json:"resource_id" gorm:"size:255;index:idx_resource;not null"`
+	Adapter            string         `json:"adapter" gorm:"size:255;not null;uniqueIndex:idx_resource_adapter"`
+	Conditions         datatypes.JSON `json:"conditions" gorm:"type:jsonb;not null"`
+	Data               datatypes.JSON `json:"data,omitempty" gorm:"type:jsonb"`
+	Metadata           datatypes.JSON `json:"metadata,omitempty" gorm:"type:jsonb"`
+	ObservedGeneration int32          `json:"observed_generation" gorm:"not null"`
 }
 
 type AdapterStatusMetadata struct {
diff --git a/pkg/api/cluster_types.go b/pkg/api/cluster_types.go
index f4b94f47..bed22eb8 100644
--- a/pkg/api/cluster_types.go
+++ b/pkg/api/cluster_types.go
@@ -9,24 +9,16 @@ import (
 
 // Cluster database model
 type Cluster struct {
-	Meta // Contains ID, CreatedTime, UpdatedTime, DeletedTime
-
-	// Core fields
-	Kind   string         `json:"kind" gorm:"default:'Cluster'"`
-	Name   string         `json:"name" gorm:"uniqueIndex;size:53;not null"`
-	Spec   datatypes.JSON `json:"spec" gorm:"type:jsonb;not null"`
-	Labels datatypes.JSON `json:"labels,omitempty" gorm:"type:jsonb"`
-	Href   string         `json:"href,omitempty" gorm:"size:500"`
-
-	// Version control
-	Generation int32 `json:"generation" gorm:"default:1;not null"`
-
-	// Status (conditions-only model with synthetic Available/Ready conditions)
+	Meta
+	Kind             string         `json:"kind" gorm:"default:'Cluster'"`
+	Name             string         `json:"name" gorm:"uniqueIndex;size:53;not null"`
+	Href             string         `json:"href,omitempty" gorm:"size:500"`
+	CreatedBy        string         `json:"created_by" gorm:"size:255;not null"`
+	UpdatedBy        string         `json:"updated_by" gorm:"size:255;not null"`
+	Spec             datatypes.JSON `json:"spec" gorm:"type:jsonb;not null"`
+	Labels           datatypes.JSON `json:"labels,omitempty" gorm:"type:jsonb"`
 	StatusConditions datatypes.JSON `json:"status_conditions" gorm:"type:jsonb"`
-
-	// Audit fields
-	CreatedBy string `json:"created_by" gorm:"size:255;not null"`
-	UpdatedBy string `json:"updated_by" gorm:"size:255;not null"`
+	Generation       int32          `json:"generation" gorm:"default:1;not null"`
 }
 
 type ClusterList []*Cluster
diff --git a/pkg/api/node_pool_types.go b/pkg/api/node_pool_types.go
index f2aaa772..ca158705 100644
--- a/pkg/api/node_pool_types.go
+++ b/pkg/api/node_pool_types.go
@@ -10,32 +10,20 @@ import (
 
 // NodePool database model
 type NodePool struct {
-	Meta // Contains ID, CreatedTime, UpdatedTime, DeletedAt
-
-	// Core fields
-	Kind   string         `json:"kind" gorm:"default:'NodePool'"`
-	Name   string         `json:"name" gorm:"size:15;not null"`
-	Spec   datatypes.JSON `json:"spec" gorm:"type:jsonb;not null"`
-	Labels datatypes.JSON `json:"labels,omitempty" gorm:"type:jsonb"`
-	Href   string         `json:"href,omitempty" gorm:"size:500"`
-
-	// Version control
-	Generation int32 `json:"generation" gorm:"default:1;not null"`
-
-	// Owner references (expanded)
-	OwnerID   string `json:"owner_id" gorm:"size:255;not null;index"`
-	OwnerKind string `json:"owner_kind" gorm:"size:50;not null"`
-	OwnerHref string `json:"owner_href,omitempty" gorm:"size:500"`
-
-	// Foreign key relationship
 	Cluster *Cluster `gorm:"foreignKey:OwnerID;references:ID"`
-
-	// Status (conditions-only model with synthetic Available/Ready conditions)
+	Meta
+	Kind             string         `json:"kind" gorm:"default:'NodePool'"`
+	Name             string         `json:"name" gorm:"size:15;not null"`
+	UpdatedBy        string         `json:"updated_by" gorm:"size:255;not null"`
+	Href             string         `json:"href,omitempty" gorm:"size:500"`
+	CreatedBy        string         `json:"created_by" gorm:"size:255;not null"`
+	OwnerID          string         `json:"owner_id" gorm:"size:255;not null;index"`
+	OwnerKind        string         `json:"owner_kind" gorm:"size:50;not null"`
+	OwnerHref        string         `json:"owner_href,omitempty" gorm:"size:500"`
+	Spec             datatypes.JSON `json:"spec" gorm:"type:jsonb;not null"`
 	StatusConditions datatypes.JSON `json:"status_conditions" gorm:"type:jsonb"`
-
-	// Audit fields
-	CreatedBy string `json:"created_by" gorm:"size:255;not null"`
-	UpdatedBy string `json:"updated_by" gorm:"size:255;not null"`
+	Labels           datatypes.JSON `json:"labels,omitempty" gorm:"type:jsonb"`
+	Generation       int32          `json:"generation" gorm:"default:1;not null"`
 }
 
 type NodePoolList []*NodePool
diff --git a/pkg/api/presenters/cluster.go b/pkg/api/presenters/cluster.go
index 3aa23937..c4a3178a 100644
--- a/pkg/api/presenters/cluster.go
+++ b/pkg/api/presenters/cluster.go
@@ -35,13 +35,13 @@ func ConvertCluster(req *openapi.ClusterCreateRequest, createdBy string) (*api.C
 	}
 
 	return &api.Cluster{
-		Kind:             kind,
-		Name:             req.Name,
-		Spec:             specJSON,
-		Labels:           labelsJSON,
-		Generation:       1,
-		CreatedBy:        createdBy,
-		UpdatedBy:        createdBy,
+		Kind:       kind,
+		Name:       req.Name,
+		Spec:       specJSON,
+		Labels:     labelsJSON,
+		Generation: 1,
+		CreatedBy:  createdBy,
+		UpdatedBy:  createdBy,
 	}, nil
 }
 
diff --git a/pkg/api/presenters/object_reference.go b/pkg/api/presenters/object_reference.go
index b195a68d..b312405b 100755
--- a/pkg/api/presenters/object_reference.go
+++ b/pkg/api/presenters/object_reference.go
@@ -6,31 +6,31 @@ import (
 )
 
 func PresentReference(id, obj interface{}) openapi.ObjectReference {
-	refId, ok := makeReferenceId(id)
+	refID, ok := makeReferenceID(id)
 
 	if !ok {
 		return openapi.ObjectReference{}
 	}
 
 	return openapi.ObjectReference{
-		Id:   util.PtrString(refId),
+		Id:   util.PtrString(refID),
 		Kind: ObjectKind(obj),
-		Href: ObjectPath(refId, obj),
+		Href: ObjectPath(refID, obj),
 	}
 }
 
-func makeReferenceId(id interface{}) (string, bool) {
-	var refId string
+func makeReferenceID(id interface{}) (string, bool) {
+	var refID string
 
 	if i, ok := id.(string); ok {
-		refId = i
+		refID = i
 	}
 
 	if i, ok := id.(*string); ok {
 		if i != nil {
-			refId = *i
+			refID = *i
 		}
 	}
 
-	return refId, refId != ""
+	return refID, refID != ""
 }
diff --git a/pkg/api/presenters/presenter_test.go b/pkg/api/presenters/presenter_test.go
index 4597dbce..2ebd8d98 100644
--- a/pkg/api/presenters/presenter_test.go
+++ b/pkg/api/presenters/presenter_test.go
@@ -93,10 +93,10 @@ func createTestClusterList() openapi.ClusterList {
 
 func TestSliceFilter(t *testing.T) {
 	tests := []struct {
-		name     string
-		fields   []string
 		model    interface{}
 		validate func(result *ProjectionList, err *errors.ServiceError)
+		name     string
+		fields   []string
 	}{
 		{
 			name:   "include and exclude fields with different types",
diff --git a/pkg/api/presenters/slice_filter.go b/pkg/api/presenters/slice_filter.go
index 6fc83edb..0f160c60 100755
--- a/pkg/api/presenters/slice_filter.go
+++ b/pkg/api/presenters/slice_filter.go
@@ -11,10 +11,10 @@ import (
 
 type ProjectionList struct {
 	Kind  string                   `json:"kind"`
+	Items []map[string]interface{} `json:"items"`
 	Page  int32                    `json:"page"`
 	Size  int32                    `json:"size"`
 	Total int32                    `json:"total"`
-	Items []map[string]interface{} `json:"items"`
 }
 
 // SliceFilter returns a projected list containing requested fields from each item
diff --git a/pkg/api/status_types.go b/pkg/api/status_types.go
index b1c87e55..3cd6bf0c 100644
--- a/pkg/api/status_types.go
+++ b/pkg/api/status_types.go
@@ -33,23 +33,23 @@ const (
 // Domain equivalent of openapi.ResourceCondition
 // JSON tags match database JSONB structure
 type ResourceCondition struct {
-	ObservedGeneration int32                   `json:"observed_generation"`
 	CreatedTime        time.Time               `json:"created_time"`
 	LastUpdatedTime    time.Time               `json:"last_updated_time"`
-	Type               string                  `json:"type"`
-	Status             ResourceConditionStatus `json:"status"`
+	LastTransitionTime time.Time               `json:"last_transition_time"`
 	Reason             *string                 `json:"reason,omitempty"`
 	Message            *string                 `json:"message,omitempty"`
-	LastTransitionTime time.Time               `json:"last_transition_time"`
+	Type               string                  `json:"type"`
+	Status             ResourceConditionStatus `json:"status"`
+	ObservedGeneration int32                   `json:"observed_generation"`
 }
 
 // AdapterCondition represents a condition of an adapter
 // Domain equivalent of openapi.AdapterCondition
 // JSON tags match database JSONB structure
 type AdapterCondition struct {
-	Type               string                 `json:"type"`
-	Status             AdapterConditionStatus `json:"status"`
+	LastTransitionTime time.Time              `json:"last_transition_time"`
 	Reason             *string                `json:"reason,omitempty"`
 	Message            *string                `json:"message,omitempty"`
-	LastTransitionTime time.Time              `json:"last_transition_time"`
+	Type               string                 `json:"type"`
+	Status             AdapterConditionStatus `json:"status"`
 }
diff --git a/pkg/auth/authz_middleware.go b/pkg/auth/authz_middleware.go
index e4a8412f..83fcf399 100755
--- a/pkg/auth/authz_middleware.go
+++ b/pkg/auth/authz_middleware.go
@@ -10,21 +10,20 @@ package auth
 */
 
 import (
-	"fmt"
 	"net/http"
 
 	"github.com/openshift-hyperfleet/hyperfleet-api/pkg/client/ocm"
+	"github.com/openshift-hyperfleet/hyperfleet-api/pkg/logger"
 )
 
 type AuthorizationMiddleware interface {
-	AuthorizeApi(next http.Handler) http.Handler
+	AuthorizeAPI(next http.Handler) http.Handler
 }
 
 type authzMiddleware struct {
+	ocmClient    *ocm.Client
 	action       string
 	resourceType string
-
-	ocmClient *ocm.Client
 }
 
 var _ AuthorizationMiddleware = &authzMiddleware{}
@@ -37,14 +36,14 @@ func NewAuthzMiddleware(ocmClient *ocm.Client, action, resourceType string) Auth
 	}
 }
 
-func (a authzMiddleware) AuthorizeApi(next http.Handler) http.Handler {
+func (a authzMiddleware) AuthorizeAPI(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
 
 		// Get username from context
 		username := GetUsernameFromContext(ctx)
 		if username == "" {
-			_ = fmt.Errorf("authenticated username not present in request context")
+			logger.Error(ctx, "authenticated username not present in request context")
 			// TODO
 			// body := api.E500.Format(r, "Authentication details not present in context")
 			// api.SendError(w, r, &body)
@@ -54,7 +53,7 @@ func (a authzMiddleware) AuthorizeApi(next http.Handler) http.Handler {
 		allowed, err := a.ocmClient.Authorization.AccessReview(
 			ctx, username, a.action, a.resourceType, "", "", "")
 		if err != nil {
-			_ = fmt.Errorf("unable to make authorization request: %s", err)
+			logger.WithError(ctx, err).Error("unable to make authorization request")
 			// TODO
 			// body := api.E500.Format(r, "Unable to make authorization request")
 			// api.SendError(w, r, &body)
diff --git a/pkg/auth/authz_middleware_mock.go b/pkg/auth/authz_middleware_mock.go
index 914b9c85..0f368da7 100755
--- a/pkg/auth/authz_middleware_mock.go
+++ b/pkg/auth/authz_middleware_mock.go
@@ -14,7 +14,7 @@ func NewAuthzMiddlewareMock() AuthorizationMiddleware {
 	return &authzMiddlewareMock{}
 }
 
-func (a authzMiddlewareMock) AuthorizeApi(next http.Handler) http.Handler {
+func (a authzMiddlewareMock) AuthorizeAPI(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		logger.With(r.Context(), logger.HTTPMethod(r.Method), logger.HTTPPath(r.URL.Path)).
 			Info("Mock authz allows <any>/<any> for method/path")
diff --git a/pkg/auth/helpers.go b/pkg/auth/helpers.go
index 1ee6a4f7..580b03ab 100755
--- a/pkg/auth/helpers.go
+++ b/pkg/auth/helpers.go
@@ -19,11 +19,11 @@ func handleError(ctx context.Context, w http.ResponseWriter, r *http.Request, co
 	if r != nil {
 		instance = r.URL.Path
 	}
-	if err.HttpCode >= 400 && err.HttpCode <= 499 {
+	if err.HTTPCode >= 400 && err.HTTPCode <= 499 {
 		logger.WithError(ctx, err).Warn("Client error occurred")
 	} else {
 		logger.WithError(ctx, err).Error("Server error occurred")
 	}
 
-	response.WriteProblemDetailsResponse(w, r, err.HttpCode, err.AsProblemDetails(instance, traceID))
+	response.WriteProblemDetailsResponse(w, r, err.HTTPCode, err.AsProblemDetails(instance, traceID))
 }
diff --git a/pkg/config/db.go b/pkg/config/db.go
index 5ae563e4..fae6b0b3 100755
--- a/pkg/config/db.go
+++ b/pkg/config/db.go
@@ -23,15 +23,15 @@ var simpleDSNValuePattern = regexp.MustCompile(`^[a-zA-Z0-9.-]+$`)
 // DatabaseConfig holds database connection configuration
 // Follows HyperFleet Configuration Standard
 type DatabaseConfig struct {
+	SSL      SSLConfig  `mapstructure:"ssl" json:"ssl" validate:"required"`
 	Dialect  string     `mapstructure:"dialect" json:"dialect" validate:"required,oneof=postgres"`
 	Host     string     `mapstructure:"host" json:"host" validate:"required,hostname|ip"`
-	Port     int        `mapstructure:"port" json:"port" validate:"required,min=1,max=65535"`
 	Name     string     `mapstructure:"name" json:"name" validate:"required"`
-	Username string     `mapstructure:"username" json:"-"` // Excluded from JSON marshaling (sensitive)
-	Password string     `mapstructure:"password" json:"-"` // Excluded from JSON marshaling (sensitive)
-	Debug    bool       `mapstructure:"debug" json:"debug"`
-	SSL      SSLConfig  `mapstructure:"ssl" json:"ssl" validate:"required"`
+	Username string     `mapstructure:"username" json:"-"`
+	Password string     `mapstructure:"password" json:"-"`
 	Pool     PoolConfig `mapstructure:"pool" json:"pool" validate:"required"`
+	Port     int        `mapstructure:"port" json:"port" validate:"required,min=1,max=65535"`
+	Debug    bool       `mapstructure:"debug" json:"debug"`
 }
 
 // SSLConfig holds SSL/TLS configuration
@@ -43,13 +43,13 @@ type SSLConfig struct {
 // PoolConfig holds connection pool configuration
 // Includes fields from HYPERFLEET-694 for connection lifecycle management
 type PoolConfig struct {
-	MaxConnections int `mapstructure:"max_connections" json:"max_connections" validate:"required,min=1,max=200"`
-	MaxIdleConnections  int           `mapstructure:"max_idle_connections" json:"max_idle_connections" validate:"min=0"`
-	ConnMaxLifetime     time.Duration `mapstructure:"conn_max_lifetime" json:"conn_max_lifetime"`
-	ConnMaxIdleTime     time.Duration `mapstructure:"conn_max_idle_time" json:"conn_max_idle_time"`
-	RequestTimeout      time.Duration `mapstructure:"request_timeout" json:"request_timeout"`
-	ConnRetryAttempts   int           `mapstructure:"conn_retry_attempts" json:"conn_retry_attempts" validate:"min=1"`
-	ConnRetryInterval   time.Duration `mapstructure:"conn_retry_interval" json:"conn_retry_interval"`
+	MaxConnections     int           `mapstructure:"max_connections" json:"max_connections" validate:"required,min=1,max=200"` //nolint:lll // gofmt alignment
+	MaxIdleConnections int           `mapstructure:"max_idle_connections" json:"max_idle_connections" validate:"min=0"`
+	ConnMaxLifetime    time.Duration `mapstructure:"conn_max_lifetime" json:"conn_max_lifetime"`
+	ConnMaxIdleTime    time.Duration `mapstructure:"conn_max_idle_time" json:"conn_max_idle_time"`
+	RequestTimeout     time.Duration `mapstructure:"request_timeout" json:"request_timeout"`
+	ConnRetryAttempts  int           `mapstructure:"conn_retry_attempts" json:"conn_retry_attempts" validate:"min=1"`
+	ConnRetryInterval  time.Duration `mapstructure:"conn_retry_interval" json:"conn_retry_interval"`
 	// HYPERFLEET-618: prevents indefinite blocking during migrations
 	AdvisoryLockTimeout time.Duration `mapstructure:"advisory_lock_timeout" json:"advisory_lock_timeout"`
 }
@@ -58,9 +58,9 @@ type PoolConfig struct {
 func (c DatabaseConfig) MarshalJSON() ([]byte, error) {
 	type Alias DatabaseConfig
 	return json.Marshal(&struct {
+		*Alias
 		Username string `json:"username"`
 		Password string `json:"password"`
-		*Alias
 	}{
 		Username: redactIfSet(c.Username),
 		Password: redactIfSet(c.Password),
diff --git a/pkg/config/db_test.go b/pkg/config/db_test.go
index a11a453a..954612c5 100644
--- a/pkg/config/db_test.go
+++ b/pkg/config/db_test.go
@@ -120,10 +120,10 @@ func TestEscapeDSNValue(t *testing.T) {
 // - Integration validation with one representative special character test case
 func TestConnectionString(t *testing.T) {
 	tests := []struct {
-		name     string
 		config   *DatabaseConfig
-		ssl      bool
+		name     string
 		expected string
+		ssl      bool
 	}{
 		{
 			name: "basic connection without SSL",
@@ -244,10 +244,10 @@ func TestConnectionString(t *testing.T) {
 
 func TestLogSafeConnectionString(t *testing.T) {
 	tests := []struct {
-		name     string
 		config   *DatabaseConfig
-		ssl      bool
+		name     string
 		expected string
+		ssl      bool
 	}{
 		{
 			name: "credentials are redacted",
@@ -420,9 +420,9 @@ func TestDatabaseConfigMarshalJSON_EmptyCredentials(t *testing.T) {
 func TestSetLogLevel(t *testing.T) {
 	tests := []struct {
 		name           string
-		debug          bool
 		globalLogLevel string
 		expected       logger.LogLevel
+		debug          bool
 	}{
 		{
 			name:           "database.debug=true takes precedence over global log level (info)",
diff --git a/pkg/config/health.go b/pkg/config/health.go
index c30fb006..4fd104c8 100644
--- a/pkg/config/health.go
+++ b/pkg/config/health.go
@@ -11,10 +11,10 @@ import (
 // Follows HyperFleet Configuration Standard
 type HealthConfig struct {
 	Host            string        `mapstructure:"host" json:"host" validate:"required"`
-	Port            int           `mapstructure:"port" json:"port" validate:"required,min=1,max=65535"`
 	TLS             TLSConfig     `mapstructure:"tls" json:"tls" validate:"required"`
+	Port            int           `mapstructure:"port" json:"port" validate:"required,min=1,max=65535"`
 	ShutdownTimeout time.Duration `mapstructure:"shutdown_timeout" json:"shutdown_timeout" validate:"required"`
-	DBPingTimeout   time.Duration `mapstructure:"db_ping_timeout" json:"db_ping_timeout"` // From HYPERFLEET-694
+	DBPingTimeout   time.Duration `mapstructure:"db_ping_timeout" json:"db_ping_timeout"`
 }
 
 // Validate validates health config durations
diff --git a/pkg/config/helpers_test.go b/pkg/config/helpers_test.go
index 476554ee..42fbe330 100644
--- a/pkg/config/helpers_test.go
+++ b/pkg/config/helpers_test.go
@@ -11,7 +11,7 @@ import (
 // This allows tests to focus on specific configuration aspects without
 // needing to provide all required fields
 //
-// Uses t.Setenv which automatically restores prior values when test completes
+// # Uses t.Setenv which automatically restores prior values when test completes
 //
 // IMPORTANT: Uses new configuration structure (host+port separated, not bind_address)
 func SetMinimalTestEnv(t *testing.T) {
diff --git a/pkg/config/loader.go b/pkg/config/loader.go
index d0da8807..dc6c324f 100644
--- a/pkg/config/loader.go
+++ b/pkg/config/loader.go
@@ -95,7 +95,11 @@ func (l *ConfigLoader) resolveAndReadConfigFile(ctx context.Context, cmd *cobra.
 
 	// Priority 1: --config flag
 	if cmd.Flags().Changed("config") {
-		configPath, _ = cmd.Flags().GetString("config")
+		var err error
+		configPath, err = cmd.Flags().GetString("config")
+		if err != nil {
+			return err
+		}
 		explicitPath = true
 		logger.With(ctx, "config_path", configPath, "source", "flag").Info("Config file specified via --config flag")
 	}
@@ -166,20 +170,20 @@ func (l *ConfigLoader) validateConfig(config *ApplicationConfig) error {
 		// Struct tag validation passed, now run custom validations
 		// Note: validator treats time.Duration as int64, so min/max tags don't work correctly
 		// Also, omitempty doesn't enforce required_if logic for conditional fields
-		if err := config.Server.Timeouts.Validate(); err != nil {
-			return fmt.Errorf("server timeouts validation failed: %w", err)
+		if valErr := config.Server.Timeouts.Validate(); valErr != nil {
+			return fmt.Errorf("server timeouts validation failed: %w", valErr)
 		}
-		if err := config.Server.TLS.Validate(); err != nil {
-			return fmt.Errorf("server TLS validation failed: %w", err)
+		if valErr := config.Server.TLS.Validate(); valErr != nil {
+			return fmt.Errorf("server TLS validation failed: %w", valErr)
 		}
-		if err := config.Health.Validate(); err != nil {
-			return fmt.Errorf("health config validation failed: %w", err)
+		if valErr := config.Health.Validate(); valErr != nil {
+			return fmt.Errorf("health config validation failed: %w", valErr)
 		}
-		if err := config.Health.TLS.Validate(); err != nil {
-			return fmt.Errorf("health TLS validation failed: %w", err)
+		if valErr := config.Health.TLS.Validate(); valErr != nil {
+			return fmt.Errorf("health TLS validation failed: %w", valErr)
 		}
-		if err := config.Metrics.TLS.Validate(); err != nil {
-			return fmt.Errorf("metrics TLS validation failed: %w", err)
+		if valErr := config.Metrics.TLS.Validate(); valErr != nil {
+			return fmt.Errorf("metrics TLS validation failed: %w", valErr)
 		}
 		return nil
 	}
diff --git a/pkg/config/loader_test.go b/pkg/config/loader_test.go
index 27bedd35..d0973004 100644
--- a/pkg/config/loader_test.go
+++ b/pkg/config/loader_test.go
@@ -295,7 +295,7 @@ adapters:
 	Expect(err).NotTo(HaveOccurred())
 
 	t.Setenv("HYPERFLEET_CONFIG", configPath)
-	t.Setenv("HYPERFLEET_SERVER_PORT", "8000")      // Env overrides file for port
+	t.Setenv("HYPERFLEET_SERVER_PORT", "8000")     // Env overrides file for port
 	t.Setenv("HYPERFLEET_DATABASE_NAME", "env-db") // Env overrides file for db name
 	t.Setenv("HYPERFLEET_LOGGING_FORMAT", "text")  // Env overrides file for log format (must be "json" or "text")
 
@@ -395,11 +395,11 @@ func TestConfigLoader_FlagParsing(t *testing.T) {
 	AddAllConfigFlags(cmd)
 
 	// Test different types
-	cmd.Flags().Set("server-port", "9999")                    //nolint:errcheck,gosec // int
-	cmd.Flags().Set("server-read-timeout", "10s")             //nolint:errcheck,gosec // duration
-	cmd.Flags().Set("server-jwt-enabled", "false")            //nolint:errcheck,gosec // bool
-	cmd.Flags().Set("db-max-open-connections", "50")          //nolint:errcheck,gosec // int
-	cmd.Flags().Set("log-otel-sampling-rate", "0.5")          //nolint:errcheck,gosec // float64
+	cmd.Flags().Set("server-port", "9999")           //nolint:errcheck,gosec // int
+	cmd.Flags().Set("server-read-timeout", "10s")    //nolint:errcheck,gosec // duration
+	cmd.Flags().Set("server-jwt-enabled", "false")   //nolint:errcheck,gosec // bool
+	cmd.Flags().Set("db-max-open-connections", "50") //nolint:errcheck,gosec // int
+	cmd.Flags().Set("log-otel-sampling-rate", "0.5") //nolint:errcheck,gosec // float64
 
 	ctx := context.Background()
 	cfg, err := loader.Load(ctx, cmd)
diff --git a/pkg/config/logging.go b/pkg/config/logging.go
index 2a65457c..09638f7a 100644
--- a/pkg/config/logging.go
+++ b/pkg/config/logging.go
@@ -10,8 +10,8 @@ type LoggingConfig struct {
 	Level   string        `mapstructure:"level" json:"level" validate:"required,oneof=debug info warn error"`
 	Format  string        `mapstructure:"format" json:"format" validate:"required,oneof=json text"`
 	Output  string        `mapstructure:"output" json:"output" validate:"required,oneof=stdout stderr"`
-	OTel    OTelConfig    `mapstructure:"otel" json:"otel" validate:"required"`
 	Masking MaskingConfig `mapstructure:"masking" json:"masking" validate:"required"`
+	OTel    OTelConfig    `mapstructure:"otel" json:"otel" validate:"required"`
 }
 
 // OTelConfig holds OpenTelemetry configuration
@@ -22,9 +22,9 @@ type OTelConfig struct {
 
 // MaskingConfig holds log masking configuration
 type MaskingConfig struct {
-	Enabled bool     `mapstructure:"enabled" json:"enabled"`
 	Headers []string `mapstructure:"headers" json:"headers"`
 	Fields  []string `mapstructure:"fields" json:"fields"`
+	Enabled bool     `mapstructure:"enabled" json:"enabled"`
 }
 
 // NewLoggingConfig returns default LoggingConfig values
diff --git a/pkg/config/logging_test.go b/pkg/config/logging_test.go
index fc22b3b0..1f9619bd 100644
--- a/pkg/config/logging_test.go
+++ b/pkg/config/logging_test.go
@@ -337,4 +337,3 @@ func TestValidationFailures(t *testing.T) {
 		})
 	}
 }
-
diff --git a/pkg/config/metrics.go b/pkg/config/metrics.go
index 0808c2b8..79114fb2 100755
--- a/pkg/config/metrics.go
+++ b/pkg/config/metrics.go
@@ -9,10 +9,10 @@ import (
 // MetricsConfig holds Prometheus metrics server configuration
 // Follows HyperFleet Configuration Standard
 type MetricsConfig struct {
-	Host                             string        `mapstructure:"host" json:"host" validate:"required"`
-	Port                             int           `mapstructure:"port" json:"port" validate:"required,min=1,max=65535"`
-	TLS                              TLSConfig     `mapstructure:"tls" json:"tls" validate:"required"`
-	LabelMetricsInclusionDuration    time.Duration `mapstructure:"label_metrics_inclusion_duration" json:"label_metrics_inclusion_duration" validate:"required"` //nolint:lll
+	Host                          string        `mapstructure:"host" json:"host" validate:"required"`
+	TLS                           TLSConfig     `mapstructure:"tls" json:"tls" validate:"required"`
+	Port                          int           `mapstructure:"port" json:"port" validate:"required,min=1,max=65535"`
+	LabelMetricsInclusionDuration time.Duration `mapstructure:"label_metrics_inclusion_duration" json:"label_metrics_inclusion_duration" validate:"required"` //nolint:lll
 }
 
 // NewMetricsConfig returns default MetricsConfig values
diff --git a/pkg/config/ocm.go b/pkg/config/ocm.go
index 46fadb32..30b40a90 100755
--- a/pkg/config/ocm.go
+++ b/pkg/config/ocm.go
@@ -8,9 +8,9 @@ import (
 // Follows HyperFleet Configuration Standard
 type OCMConfig struct {
 	BaseURL      string     `mapstructure:"base_url" json:"base_url" validate:"required,url"`
-	ClientID     string     `mapstructure:"client_id" json:"-"` // Excluded from JSON marshaling (sensitive)
+	ClientID     string     `mapstructure:"client_id" json:"-"`     // Excluded from JSON marshaling (sensitive)
 	ClientSecret string     `mapstructure:"client_secret" json:"-"` // Excluded from JSON marshaling (sensitive)
-	SelfToken    string     `mapstructure:"self_token" json:"-"` // Excluded from JSON marshaling (sensitive)
+	SelfToken    string     `mapstructure:"self_token" json:"-"`    // Excluded from JSON marshaling (sensitive)
 	TokenURL     string     `mapstructure:"token_url" json:"token_url" validate:"required,url"`
 	Debug        bool       `mapstructure:"debug" json:"debug"`
 	Mock         MockConfig `mapstructure:"mock" json:"mock" validate:"required"`
@@ -25,10 +25,10 @@ type MockConfig struct {
 func (c OCMConfig) MarshalJSON() ([]byte, error) {
 	type Alias OCMConfig
 	return json.Marshal(&struct {
+		*Alias
 		ClientID     string `json:"client_id"`
 		ClientSecret string `json:"client_secret"`
 		SelfToken    string `json:"self_token"`
-		*Alias
 	}{
 		ClientID:     redactIfSet(c.ClientID),
 		ClientSecret: redactIfSet(c.ClientSecret),
@@ -52,4 +52,3 @@ func NewOCMConfig() *OCMConfig {
 		},
 	}
 }
-
diff --git a/pkg/config/server.go b/pkg/config/server.go
index ba24fa15..6a70b5ad 100755
--- a/pkg/config/server.go
+++ b/pkg/config/server.go
@@ -10,16 +10,16 @@ import (
 // ServerConfig holds HTTP/HTTPS server configuration
 // Follows HyperFleet Configuration Standard
 type ServerConfig struct {
+	JWK               JWKConfig      `mapstructure:"jwk" json:"jwk" validate:"required"`
 	Hostname          string         `mapstructure:"hostname" json:"hostname" validate:"omitempty,hostname|ip"`
 	Host              string         `mapstructure:"host" json:"host" validate:"required,hostname|ip"`
-	Port              int            `mapstructure:"port" json:"port" validate:"required,min=1,max=65535"`
 	OpenAPISchemaPath string         `mapstructure:"openapi_schema_path" json:"openapi_schema_path"`
-	Timeouts          TimeoutsConfig `mapstructure:"timeouts" json:"timeouts" validate:"required"`
+	ACL               ACLConfig      `mapstructure:"acl" json:"acl" validate:"required"`
 	TLS               TLSConfig      `mapstructure:"tls" json:"tls" validate:"required"`
+	Timeouts          TimeoutsConfig `mapstructure:"timeouts" json:"timeouts" validate:"required"`
+	Port              int            `mapstructure:"port" json:"port" validate:"required,min=1,max=65535"`
 	JWT               JWTConfig      `mapstructure:"jwt" json:"jwt" validate:"required"`
-	JWK               JWKConfig      `mapstructure:"jwk" json:"jwk" validate:"required"`
 	Authz             AuthzConfig    `mapstructure:"authz" json:"authz" validate:"required"`
-	ACL               ACLConfig      `mapstructure:"acl" json:"acl" validate:"required"`
 }
 
 // TimeoutsConfig holds HTTP timeout configuration
@@ -41,9 +41,9 @@ func (c *TimeoutsConfig) Validate() error {
 
 // TLSConfig holds TLS configuration
 type TLSConfig struct {
-	Enabled  bool   `mapstructure:"enabled" json:"enabled"`
 	CertFile string `mapstructure:"cert_file" json:"cert_file" validate:"omitempty,filepath"`
 	KeyFile  string `mapstructure:"key_file" json:"key_file" validate:"omitempty,filepath"`
+	Enabled  bool   `mapstructure:"enabled" json:"enabled"`
 }
 
 // Validate validates TLS configuration
diff --git a/pkg/dao/mocks/cluster.go b/pkg/dao/mocks/cluster.go
index 28360080..6321c19f 100644
--- a/pkg/dao/mocks/cluster.go
+++ b/pkg/dao/mocks/cluster.go
@@ -16,10 +16,6 @@ type clusterDaoMock struct {
 	clusters api.ClusterList
 }
 
-func NewClusterDao() *clusterDaoMock {
-	return &clusterDaoMock{}
-}
-
 func (d *clusterDaoMock) Get(ctx context.Context, id string) (*api.Cluster, error) {
 	for _, cluster := range d.clusters {
 		if cluster.ID == id {
diff --git a/pkg/dao/mocks/generic.go b/pkg/dao/mocks/generic.go
index c1a9d84b..1cef4cfa 100755
--- a/pkg/dao/mocks/generic.go
+++ b/pkg/dao/mocks/generic.go
@@ -9,18 +9,12 @@ import (
 var _ dao.GenericDao = &genericDaoMock{}
 
 type genericDaoMock struct {
+	model   interface{}
 	preload string
 	orderBy string
 	joins   string
 	group   string
 	wheres  []dao.Where
-	model   interface{}
-}
-
-func NewGenericDao() *genericDaoMock {
-	return &genericDaoMock{
-		wheres: []dao.Where{},
-	}
 }
 
 func (g *genericDaoMock) Fetch(offset int, limit int, resourceList interface{}) error {
diff --git a/pkg/dao/mocks/node_pool.go b/pkg/dao/mocks/node_pool.go
index d243d527..47cf31cb 100644
--- a/pkg/dao/mocks/node_pool.go
+++ b/pkg/dao/mocks/node_pool.go
@@ -16,10 +16,6 @@ type nodePoolDaoMock struct {
 	nodePools api.NodePoolList
 }
 
-func NewNodePoolDao() *nodePoolDaoMock {
-	return &nodePoolDaoMock{}
-}
-
 func (d *nodePoolDaoMock) Get(ctx context.Context, id string) (*api.NodePool, error) {
 	for _, nodePool := range d.nodePools {
 		if nodePool.ID == id {
diff --git a/pkg/db/advisory_locks.go b/pkg/db/advisory_locks.go
index 1b40d7e1..12997d59 100644
--- a/pkg/db/advisory_locks.go
+++ b/pkg/db/advisory_locks.go
@@ -32,12 +32,12 @@ const (
 // service call that owns the lock will have the correct ownerUUID. This is necessary
 // to allow functions to call other service functions as part of the same lock (id, lockType).
 type AdvisoryLock struct {
+	startTime      time.Time
 	g2             *gorm.DB
 	ownerUUID      *string
 	id             *string
 	lockType       *LockType
 	timeoutSeconds int
-	startTime      time.Time
 }
 
 // newAdvisoryLock constructs a new AdvisoryLock object.
diff --git a/pkg/db/context.go b/pkg/db/context.go
index c5278dc6..83681854 100755
--- a/pkg/db/context.go
+++ b/pkg/db/context.go
@@ -146,7 +146,7 @@ func Unlock(ctx context.Context, callerUUID string) {
 
 			if err := lock.unlock(ctx); err != nil {
 				logger.With(ctx, logger.FieldLockID, lockID, logger.FieldLockType, lockType).
-				WithError(err).Error("Could not unlock lock")
+					WithError(err).Error("Could not unlock lock")
 				continue
 			}
 			logger.With(ctx, logger.FieldLockID, lockID, logger.FieldLockType, lockType).Info("Unlocked lock")
diff --git a/pkg/db/sql_helpers.go b/pkg/db/sql_helpers.go
index 37389e4d..9fad5ab6 100755
--- a/pkg/db/sql_helpers.go
+++ b/pkg/db/sql_helpers.go
@@ -484,7 +484,11 @@ func extractConditionsWalk(n tsl.Node, conditions *[]sq.Sqlizer) (tsl.Node, *err
 		if err != nil {
 			return n, err
 		}
-		*conditions = append(*conditions, expr.(sq.Sqlizer))
+		sqlizer, ok := expr.(sq.Sqlizer)
+		if !ok {
+			return n, errors.GeneralError("unexpected type %T in condition expression", expr)
+		}
+		*conditions = append(*conditions, sqlizer)
 
 		// Replace with a placeholder that always evaluates to true
 		// This allows the rest of the tree to be processed normally
@@ -497,7 +501,6 @@ func extractConditionsWalk(n tsl.Node, conditions *[]sq.Sqlizer) (tsl.Node, *err
 
 	// For non-condition nodes, recursively process children
 	var newLeft, newRight interface{}
-	var serviceErr *errors.ServiceError
 
 	if n.Left != nil {
 		switch v := n.Left.(type) {
@@ -535,10 +538,6 @@ func extractConditionsWalk(n tsl.Node, conditions *[]sq.Sqlizer) (tsl.Node, *err
 		}
 	}
 
-	if serviceErr != nil {
-		return n, serviceErr
-	}
-
 	return tsl.Node{
 		Func:  n.Func,
 		Left:  newLeft,
diff --git a/pkg/db/sql_helpers_test.go b/pkg/db/sql_helpers_test.go
index 273bac31..9f96970e 100644
--- a/pkg/db/sql_helpers_test.go
+++ b/pkg/db/sql_helpers_test.go
@@ -13,9 +13,9 @@ func TestConditionsNodeConverterStatus(t *testing.T) {
 		field         string
 		value         string
 		expectedSQL   string
+		errorContains string
 		expectedArgs  []interface{}
 		expectError   bool
-		errorContains string
 	}{
 		{
 			name:         "Ready condition True",
@@ -119,14 +119,14 @@ func TestConditionsNodeConverterStatus(t *testing.T) {
 
 func TestConditionsNodeConverterSubfields(t *testing.T) {
 	tests := []struct {
+		value         interface{}
 		name          string
 		field         string
 		op            string
-		value         interface{} // string for time fields, float64 for integer fields
 		expectedSQL   string
+		errorContains string
 		expectedArgs  []interface{}
 		expectError   bool
-		errorContains string
 	}{
 		// Time subfield: last_updated_time (encoded with __ after preprocessing)
 		{
@@ -451,8 +451,8 @@ func TestExtractConditionQueriesWithSubfields(t *testing.T) {
 	tests := []struct {
 		name                 string
 		searchQuery          string
-		expectedConditions   int
 		expectedConditionSQL string
+		expectedConditions   int
 		expectError          bool
 	}{
 		{
@@ -521,8 +521,8 @@ func TestExtractConditionQueries(t *testing.T) {
 	tests := []struct {
 		name                 string
 		searchQuery          string
-		expectedConditions   int
 		expectedConditionSQL string
+		expectedConditions   int
 		expectError          bool
 	}{
 		{
diff --git a/pkg/db/transaction/transaction.go b/pkg/db/transaction/transaction.go
index 246fda08..ee163af4 100755
--- a/pkg/db/transaction/transaction.go
+++ b/pkg/db/transaction/transaction.go
@@ -11,9 +11,9 @@ const defaultRollbackPolicy = false
 
 // Transaction represents an sql transaction
 type Transaction struct {
-	rollbackFlag bool
 	tx           *sql.Tx
 	txid         int64
+	rollbackFlag bool
 }
 
 // Build Creates a new transaction object
diff --git a/pkg/db/transaction_middleware.go b/pkg/db/transaction_middleware.go
index f597f404..78411adc 100755
--- a/pkg/db/transaction_middleware.go
+++ b/pkg/db/transaction_middleware.go
@@ -28,7 +28,7 @@ func TransactionMiddleware(next http.Handler, connection SessionFactory, request
 			// use default error to avoid exposing internals to users
 			serviceErr := errors.GeneralError("")
 			traceID, _ := logger.GetRequestID(r.Context())
-			response.WriteProblemDetailsResponse(w, r, serviceErr.HttpCode, serviceErr.AsProblemDetails(r.URL.Path, traceID))
+			response.WriteProblemDetailsResponse(w, r, serviceErr.HTTPCode, serviceErr.AsProblemDetails(r.URL.Path, traceID))
 			return
 		}
 
diff --git a/pkg/errors/CLAUDE.md b/pkg/errors/CLAUDE.md
index 44e4bb48..e3107783 100644
--- a/pkg/errors/CLAUDE.md
+++ b/pkg/errors/CLAUDE.md
@@ -10,7 +10,7 @@ type ServiceError struct {
     Type        string           // RFC 9457 type URI
     Title       string           // Short human-readable summary
     Reason      string           // Context-specific detail (supports fmt.Sprintf)
-    HttpCode    int              // HTTP status code
+    HTTPCode    int              // HTTP status code
     Details     []ValidationDetail  // Field-level validation errors
 }
 ```
diff --git a/pkg/errors/errors.go b/pkg/errors/errors.go
index 5f997c4d..6fad91b4 100755
--- a/pkg/errors/errors.go
+++ b/pkg/errors/errors.go
@@ -12,18 +12,18 @@ import (
 
 // Error type URIs for RFC 9457
 const (
-	ErrorTypeBase        = "https://api.hyperfleet.io/errors/"
-	ErrorTypeValidation  = ErrorTypeBase + "validation-error"
-	ErrorTypeAuth        = ErrorTypeBase + "authentication-error"
-	ErrorTypeAuthz       = ErrorTypeBase + "authorization-error"
-	ErrorTypeNotFound    = ErrorTypeBase + "not-found"
-	ErrorTypeConflict    = ErrorTypeBase + "conflict"
-	ErrorTypeRateLimit   = ErrorTypeBase + "rate-limit"
-	ErrorTypeInternal    = ErrorTypeBase + "internal-error"
-	ErrorTypeService     = ErrorTypeBase + "service-unavailable"
-	ErrorTypeBadRequest  = ErrorTypeBase + "bad-request"
-	ErrorTypeMalformed   = ErrorTypeBase + "malformed-request"
-	ErrorTypeNotImpl     = ErrorTypeBase + "not-implemented"
+	ErrorTypeBase       = "https://api.hyperfleet.io/errors/"
+	ErrorTypeValidation = ErrorTypeBase + "validation-error"
+	ErrorTypeAuth       = ErrorTypeBase + "authentication-error"
+	ErrorTypeAuthz      = ErrorTypeBase + "authorization-error"
+	ErrorTypeNotFound   = ErrorTypeBase + "not-found"
+	ErrorTypeConflict   = ErrorTypeBase + "conflict"
+	ErrorTypeRateLimit  = ErrorTypeBase + "rate-limit"
+	ErrorTypeInternal   = ErrorTypeBase + "internal-error"
+	ErrorTypeService    = ErrorTypeBase + "service-unavailable"
+	ErrorTypeBadRequest = ErrorTypeBase + "bad-request"
+	ErrorTypeMalformed  = ErrorTypeBase + "malformed-request"
+	ErrorTypeNotImpl    = ErrorTypeBase + "not-implemented"
 )
 
 // Error codes in HYPERFLEET-CAT-NUM format
@@ -83,18 +83,12 @@ type ValidationDetail struct {
 
 // ServiceError represents an API error with RFC 9457 Problem Details support
 type ServiceError struct {
-	// RFC9457Code is the HYPERFLEET-CAT-NUM format code
 	RFC9457Code string
-	// Type is the RFC 9457 type URI
-	Type string
-	// Title is a short human-readable summary
-	Title string
-	// Reason is the context-specific reason (maps to detail in RFC 9457)
-	Reason string
-	// HttpCode is the HTTP status code
-	HttpCode int
-	// Details contains field-level validation errors
-	Details []ValidationDetail
+	Type        string
+	Title       string
+	Reason      string
+	Details     []ValidationDetail
+	HTTPCode    int
 }
 
 // errorDefinition holds the default values for each error type
@@ -102,7 +96,7 @@ type errorDefinition struct {
 	Type     string
 	Title    string
 	Reason   string
-	HttpCode int
+	HTTPCode int
 }
 
 var errorDefinitions = map[string]errorDefinition{
@@ -211,7 +205,7 @@ func Find(code string) (bool, *ServiceError) {
 		Type:        def.Type,
 		Title:       def.Title,
 		Reason:      def.Reason,
-		HttpCode:    def.HttpCode,
+		HTTPCode:    def.HTTPCode,
 	}
 }
 
@@ -224,7 +218,7 @@ func Errors() ServiceErrors {
 			Type:        def.Type,
 			Title:       def.Title,
 			Reason:      def.Reason,
-			HttpCode:    def.HttpCode,
+			HTTPCode:    def.HTTPCode,
 		})
 	}
 	return errors
@@ -241,7 +235,7 @@ func New(code string, reason string, values ...interface{}) *ServiceError {
 			Type:        ErrorTypeInternal,
 			Title:       "Internal Server Error",
 			Reason:      "Unspecified error",
-			HttpCode:    http.StatusInternalServerError,
+			HTTPCode:    http.StatusInternalServerError,
 		}
 	}
 
@@ -304,7 +298,7 @@ func (e *ServiceError) AsProblemDetails(instance string, traceID string) openapi
 	problemDetails := openapi.Error{
 		Type:      e.Type,
 		Title:     e.Title,
-		Status:    e.HttpCode,
+		Status:    e.HTTPCode,
 		Detail:    &e.Reason,
 		Code:      &e.RFC9457Code,
 		Timestamp: &now,
diff --git a/pkg/handlers/cluster.go b/pkg/handlers/cluster.go
index 8340b459..1d81f4bd 100644
--- a/pkg/handlers/cluster.go
+++ b/pkg/handlers/cluster.go
@@ -13,31 +13,31 @@ import (
 	"github.com/openshift-hyperfleet/hyperfleet-api/pkg/services"
 )
 
-var _ RestHandler = clusterHandler{}
+var _ RestHandler = ClusterHandler{}
 
-type clusterHandler struct {
+type ClusterHandler struct {
 	cluster services.ClusterService
 	generic services.GenericService
 }
 
-func NewClusterHandler(cluster services.ClusterService, generic services.GenericService) *clusterHandler {
-	return &clusterHandler{
+func NewClusterHandler(cluster services.ClusterService, generic services.GenericService) *ClusterHandler {
+	return &ClusterHandler{
 		cluster: cluster,
 		generic: generic,
 	}
 }
 
-func (h clusterHandler) Create(w http.ResponseWriter, r *http.Request) {
+func (h ClusterHandler) Create(w http.ResponseWriter, r *http.Request) {
 	var req openapi.ClusterCreateRequest
 	cfg := &handlerConfig{
-		&req,
-		[]validate{
+		MarshalInto: &req,
+		Validate: []validate{
 			validateEmpty(&req, "Id", "id"),
 			validateName(&req, "Name", "name", 3, 53),
 			validateKind(&req, "Kind", "kind", "Cluster"),
 			validateSpec(&req, "Spec", "spec"),
 		},
-		func() (interface{}, *errors.ServiceError) {
+		Action: func() (interface{}, *errors.ServiceError) {
 			ctx := r.Context()
 			// Use the presenters.ConvertCluster helper to convert the request
 			clusterModel, err := presenters.ConvertCluster(&req, "system@hyperfleet.local")
@@ -54,19 +54,19 @@ func (h clusterHandler) Create(w http.ResponseWriter, r *http.Request) {
 			}
 			return presented, nil
 		},
-		handleError,
+		ErrorHandler: handleError,
 	}
 
 	handle(w, r, cfg, http.StatusCreated)
 }
 
-func (h clusterHandler) Patch(w http.ResponseWriter, r *http.Request) {
+func (h ClusterHandler) Patch(w http.ResponseWriter, r *http.Request) {
 	var patch api.ClusterPatchRequest
 
 	cfg := &handlerConfig{
-		&patch,
-		[]validate{},
-		func() (interface{}, *errors.ServiceError) {
+		MarshalInto: &patch,
+		Validate:    []validate{},
+		Action: func() (interface{}, *errors.ServiceError) {
 			ctx := r.Context()
 			id := mux.Vars(r)["id"]
 			found, err := h.cluster.Get(ctx, id)
@@ -92,13 +92,13 @@ func (h clusterHandler) Patch(w http.ResponseWriter, r *http.Request) {
 			}
 			return presented, nil
 		},
-		handleError,
+		ErrorHandler: handleError,
 	}
 
 	handle(w, r, cfg, http.StatusOK)
 }
 
-func (h clusterHandler) List(w http.ResponseWriter, r *http.Request) {
+func (h ClusterHandler) List(w http.ResponseWriter, r *http.Request) {
 	cfg := &handlerConfig{
 		Action: func() (interface{}, *errors.ServiceError) {
 			ctx := r.Context()
@@ -138,7 +138,7 @@ func (h clusterHandler) List(w http.ResponseWriter, r *http.Request) {
 	handleList(w, r, cfg)
 }
 
-func (h clusterHandler) Get(w http.ResponseWriter, r *http.Request) {
+func (h ClusterHandler) Get(w http.ResponseWriter, r *http.Request) {
 	cfg := &handlerConfig{
 		Action: func() (interface{}, *errors.ServiceError) {
 			id := mux.Vars(r)["id"]
@@ -159,7 +159,7 @@ func (h clusterHandler) Get(w http.ResponseWriter, r *http.Request) {
 	handleGet(w, r, cfg)
 }
 
-func (h clusterHandler) Delete(w http.ResponseWriter, r *http.Request) {
+func (h ClusterHandler) Delete(w http.ResponseWriter, r *http.Request) {
 	cfg := &handlerConfig{
 		Action: func() (interface{}, *errors.ServiceError) {
 			return nil, errors.NotImplemented("delete")
diff --git a/pkg/handlers/cluster_nodepools.go b/pkg/handlers/cluster_nodepools.go
index b530f626..4760455f 100644
--- a/pkg/handlers/cluster_nodepools.go
+++ b/pkg/handlers/cluster_nodepools.go
@@ -12,7 +12,7 @@ import (
 	"github.com/openshift-hyperfleet/hyperfleet-api/pkg/services"
 )
 
-type clusterNodePoolsHandler struct {
+type ClusterNodePoolsHandler struct {
 	clusterService  services.ClusterService
 	nodePoolService services.NodePoolService
 	generic         services.GenericService
@@ -22,8 +22,8 @@ func NewClusterNodePoolsHandler(
 	clusterService services.ClusterService,
 	nodePoolService services.NodePoolService,
 	generic services.GenericService,
-) *clusterNodePoolsHandler {
-	return &clusterNodePoolsHandler{
+) *ClusterNodePoolsHandler {
+	return &ClusterNodePoolsHandler{
 		clusterService:  clusterService,
 		nodePoolService: nodePoolService,
 		generic:         generic,
@@ -31,7 +31,7 @@ func NewClusterNodePoolsHandler(
 }
 
 // List returns all nodepools for a cluster
-func (h clusterNodePoolsHandler) List(w http.ResponseWriter, r *http.Request) {
+func (h ClusterNodePoolsHandler) List(w http.ResponseWriter, r *http.Request) {
 	cfg := &handlerConfig{
 		Action: func() (interface{}, *errors.ServiceError) {
 			ctx := r.Context()
@@ -70,10 +70,10 @@ func (h clusterNodePoolsHandler) List(w http.ResponseWriter, r *http.Request) {
 
 			nodePoolList := struct {
 				Kind  string             `json:"kind"`
+				Items []openapi.NodePool `json:"items"`
 				Page  int32              `json:"page"`
 				Size  int32              `json:"size"`
 				Total int32              `json:"total"`
-				Items []openapi.NodePool `json:"items"`
 			}{
 				Kind:  "NodePoolList",
 				Page:  int32(paging.Page),
@@ -97,7 +97,7 @@ func (h clusterNodePoolsHandler) List(w http.ResponseWriter, r *http.Request) {
 }
 
 // Get returns a specific nodepool for a cluster
-func (h clusterNodePoolsHandler) Get(w http.ResponseWriter, r *http.Request) {
+func (h ClusterNodePoolsHandler) Get(w http.ResponseWriter, r *http.Request) {
 	cfg := &handlerConfig{
 		Action: func() (interface{}, *errors.ServiceError) {
 			ctx := r.Context()
@@ -133,17 +133,17 @@ func (h clusterNodePoolsHandler) Get(w http.ResponseWriter, r *http.Request) {
 }
 
 // Create creates a new nodepool for a cluster
-func (h clusterNodePoolsHandler) Create(w http.ResponseWriter, r *http.Request) {
+func (h ClusterNodePoolsHandler) Create(w http.ResponseWriter, r *http.Request) {
 	var req openapi.NodePoolCreateRequest
 	cfg := &handlerConfig{
-		&req,
-		[]validate{
+		MarshalInto: &req,
+		Validate: []validate{
 			validateEmpty(&req, "Id", "id"),
 			validateName(&req, "Name", "name", 3, 15),
 			validateKind(&req, "Kind", "kind", "NodePool"),
 			validateSpec(&req, "Spec", "spec"),
 		},
-		func() (interface{}, *errors.ServiceError) {
+		Action: func() (interface{}, *errors.ServiceError) {
 			ctx := r.Context()
 			clusterID := mux.Vars(r)["id"]
 
@@ -171,7 +171,7 @@ func (h clusterNodePoolsHandler) Create(w http.ResponseWriter, r *http.Request)
 			}
 			return presented, nil
 		},
-		handleError,
+		ErrorHandler: handleError,
 	}
 
 	handle(w, r, cfg, http.StatusCreated)
diff --git a/pkg/handlers/cluster_nodepools_test.go b/pkg/handlers/cluster_nodepools_test.go
index 90b4f2fe..da413300 100644
--- a/pkg/handlers/cluster_nodepools_test.go
+++ b/pkg/handlers/cluster_nodepools_test.go
@@ -25,12 +25,12 @@ func TestClusterNodePoolsHandler_Get(t *testing.T) {
 	nodePoolID := "test-nodepool-456"
 
 	tests := []struct {
+		setupMocks func(ctrl *gomock.Controller) ( //nolint:lll
+			*services.MockClusterService, *services.MockNodePoolService, *services.MockGenericService,
+		)
 		name               string
 		clusterID          string
 		nodePoolID         string
-		setupMocks func(ctrl *gomock.Controller) (
-			*services.MockClusterService, *services.MockNodePoolService, *services.MockGenericService,
-		)
 		expectedStatusCode int
 		expectedError      bool
 	}{
diff --git a/pkg/handlers/cluster_status.go b/pkg/handlers/cluster_status.go
index e9b16bd2..3dc003ba 100644
--- a/pkg/handlers/cluster_status.go
+++ b/pkg/handlers/cluster_status.go
@@ -11,7 +11,7 @@ import (
 	"github.com/openshift-hyperfleet/hyperfleet-api/pkg/services"
 )
 
-type clusterStatusHandler struct {
+type ClusterStatusHandler struct {
 	adapterStatusService services.AdapterStatusService
 	clusterService       services.ClusterService
 }
@@ -19,15 +19,15 @@ type clusterStatusHandler struct {
 func NewClusterStatusHandler(
 	adapterStatusService services.AdapterStatusService,
 	clusterService services.ClusterService,
-) *clusterStatusHandler {
-	return &clusterStatusHandler{
+) *ClusterStatusHandler {
+	return &ClusterStatusHandler{
 		adapterStatusService: adapterStatusService,
 		clusterService:       clusterService,
 	}
 }
 
 // List returns all adapter statuses for a cluster with pagination
-func (h clusterStatusHandler) List(w http.ResponseWriter, r *http.Request) {
+func (h ClusterStatusHandler) List(w http.ResponseWriter, r *http.Request) {
 	cfg := &handlerConfig{
 		Action: func() (interface{}, *errors.ServiceError) {
 			ctx := r.Context()
@@ -73,15 +73,15 @@ func (h clusterStatusHandler) List(w http.ResponseWriter, r *http.Request) {
 }
 
 // Create creates or updates an adapter status for a cluster
-func (h clusterStatusHandler) Create(w http.ResponseWriter, r *http.Request) {
+func (h ClusterStatusHandler) Create(w http.ResponseWriter, r *http.Request) {
 	var req openapi.AdapterStatusCreateRequest
 
 	cfg := &handlerConfig{
-		&req,
-		[]validate{
+		MarshalInto: &req,
+		Validate: []validate{
 			validateNotEmpty(&req, "Adapter", "adapter"),
 		},
-		func() (interface{}, *errors.ServiceError) {
+		Action: func() (interface{}, *errors.ServiceError) {
 			ctx := r.Context()
 			clusterID := mux.Vars(r)["id"]
 
@@ -114,7 +114,7 @@ func (h clusterStatusHandler) Create(w http.ResponseWriter, r *http.Request) {
 			}
 			return &status, nil
 		},
-		handleError,
+		ErrorHandler: handleError,
 	}
 
 	handleCreateWithNoContent(w, r, cfg)
diff --git a/pkg/handlers/framework.go b/pkg/handlers/framework.go
index 62a6767f..e60a08b1 100755
--- a/pkg/handlers/framework.go
+++ b/pkg/handlers/framework.go
@@ -20,9 +20,9 @@ import (
 //	ErrorHandler is the way errors are returned to the client
 type handlerConfig struct {
 	MarshalInto  interface{}
-	Validate     []validate
 	Action       httpAction
 	ErrorHandler errorHandlerFunc
+	Validate     []validate
 }
 
 type validate func() *errors.ServiceError
@@ -34,19 +34,19 @@ func handleError(r *http.Request, w http.ResponseWriter, err *errors.ServiceErro
 	instance := r.URL.Path
 
 	// Log with RFC 9457 code format
-	if err.HttpCode >= 400 && err.HttpCode <= 499 {
+	if err.HTTPCode >= 400 && err.HTTPCode <= 499 {
 		logger.With(r.Context(),
 			"code", err.RFC9457Code,
-			"http_code", err.HttpCode,
+			"http_code", err.HTTPCode,
 			"reason", err.Reason).Info("Client error response")
 	} else {
 		logger.With(r.Context(),
 			"code", err.RFC9457Code,
-			"http_code", err.HttpCode,
+			"http_code", err.HTTPCode,
 			"reason", err.Reason).Error("Server error response")
 	}
 
-	response.WriteProblemDetailsResponse(w, r, err.HttpCode, err.AsProblemDetails(instance, traceID))
+	response.WriteProblemDetailsResponse(w, r, err.HTTPCode, err.AsProblemDetails(instance, traceID))
 }
 
 func handle(w http.ResponseWriter, r *http.Request, cfg *handlerConfig, httpStatus int) {
diff --git a/pkg/handlers/metadata.go b/pkg/handlers/metadata.go
index bd3a0255..e41b0bb2 100755
--- a/pkg/handlers/metadata.go
+++ b/pkg/handlers/metadata.go
@@ -24,14 +24,14 @@ import (
 	"github.com/openshift-hyperfleet/hyperfleet-api/pkg/logger"
 )
 
-type metadataHandler struct{}
+type MetadataHandler struct{}
 
-func NewMetadataHandler() *metadataHandler {
-	return &metadataHandler{}
+func NewMetadataHandler() *MetadataHandler {
+	return &MetadataHandler{}
 }
 
 // Get sends API documentation response.
-func (h metadataHandler) Get(w http.ResponseWriter, r *http.Request) {
+func (h MetadataHandler) Get(w http.ResponseWriter, r *http.Request) {
 	// Set the content type:
 	w.Header().Set("Content-Type", "application/json")
 
diff --git a/pkg/handlers/node_pool.go b/pkg/handlers/node_pool.go
index 38ddc1c8..d06e6c6a 100644
--- a/pkg/handlers/node_pool.go
+++ b/pkg/handlers/node_pool.go
@@ -13,30 +13,30 @@ import (
 	"github.com/openshift-hyperfleet/hyperfleet-api/pkg/services"
 )
 
-var _ RestHandler = nodePoolHandler{}
+var _ RestHandler = NodePoolHandler{}
 
-type nodePoolHandler struct {
+type NodePoolHandler struct {
 	nodePool services.NodePoolService
 	generic  services.GenericService
 }
 
-func NewNodePoolHandler(nodePool services.NodePoolService, generic services.GenericService) *nodePoolHandler {
-	return &nodePoolHandler{
+func NewNodePoolHandler(nodePool services.NodePoolService, generic services.GenericService) *NodePoolHandler {
+	return &NodePoolHandler{
 		nodePool: nodePool,
 		generic:  generic,
 	}
 }
 
-func (h nodePoolHandler) Create(w http.ResponseWriter, r *http.Request) {
+func (h NodePoolHandler) Create(w http.ResponseWriter, r *http.Request) {
 	var req openapi.NodePoolCreateRequest
 	cfg := &handlerConfig{
-		&req,
-		[]validate{
+		MarshalInto: &req,
+		Validate: []validate{
 			validateEmpty(&req, "Id", "id"),
 			validateName(&req, "Name", "name", 3, 15),
 			validateKind(&req, "Kind", "kind", "NodePool"),
 		},
-		func() (interface{}, *errors.ServiceError) {
+		Action: func() (interface{}, *errors.ServiceError) {
 			ctx := r.Context()
 			// For standalone nodepools, owner_id would need to come from somewhere
 			// This is likely not a supported use case, but using empty string for now
@@ -54,19 +54,19 @@ func (h nodePoolHandler) Create(w http.ResponseWriter, r *http.Request) {
 			}
 			return presented, nil
 		},
-		handleError,
+		ErrorHandler: handleError,
 	}
 
 	handle(w, r, cfg, http.StatusCreated)
 }
 
-func (h nodePoolHandler) Patch(w http.ResponseWriter, r *http.Request) {
+func (h NodePoolHandler) Patch(w http.ResponseWriter, r *http.Request) {
 	var patch api.NodePoolPatchRequest
 
 	cfg := &handlerConfig{
-		&patch,
-		[]validate{},
-		func() (interface{}, *errors.ServiceError) {
+		MarshalInto: &patch,
+		Validate:    []validate{},
+		Action: func() (interface{}, *errors.ServiceError) {
 			ctx := r.Context()
 			id := mux.Vars(r)["id"]
 			found, err := h.nodePool.Get(ctx, id)
@@ -96,13 +96,13 @@ func (h nodePoolHandler) Patch(w http.ResponseWriter, r *http.Request) {
 			}
 			return presented, nil
 		},
-		handleError,
+		ErrorHandler: handleError,
 	}
 
 	handle(w, r, cfg, http.StatusOK)
 }
 
-func (h nodePoolHandler) List(w http.ResponseWriter, r *http.Request) {
+func (h NodePoolHandler) List(w http.ResponseWriter, r *http.Request) {
 	cfg := &handlerConfig{
 		Action: func() (interface{}, *errors.ServiceError) {
 			ctx := r.Context()
@@ -126,10 +126,10 @@ func (h nodePoolHandler) List(w http.ResponseWriter, r *http.Request) {
 
 			nodePoolList := struct {
 				Kind  string             `json:"kind"`
+				Items []openapi.NodePool `json:"items"`
 				Page  int32              `json:"page"`
 				Size  int32              `json:"size"`
 				Total int32              `json:"total"`
-				Items []openapi.NodePool `json:"items"`
 			}{
 				Kind:  "NodePoolList",
 				Page:  int32(paging.Page),
@@ -151,7 +151,7 @@ func (h nodePoolHandler) List(w http.ResponseWriter, r *http.Request) {
 	handleList(w, r, cfg)
 }
 
-func (h nodePoolHandler) Get(w http.ResponseWriter, r *http.Request) {
+func (h NodePoolHandler) Get(w http.ResponseWriter, r *http.Request) {
 	cfg := &handlerConfig{
 		Action: func() (interface{}, *errors.ServiceError) {
 			id := mux.Vars(r)["id"]
@@ -172,7 +172,7 @@ func (h nodePoolHandler) Get(w http.ResponseWriter, r *http.Request) {
 	handleGet(w, r, cfg)
 }
 
-func (h nodePoolHandler) Delete(w http.ResponseWriter, r *http.Request) {
+func (h NodePoolHandler) Delete(w http.ResponseWriter, r *http.Request) {
 	cfg := &handlerConfig{
 		Action: func() (interface{}, *errors.ServiceError) {
 			return nil, errors.NotImplemented("delete")
diff --git a/pkg/handlers/nodepool_status.go b/pkg/handlers/nodepool_status.go
index e6ded0cd..682376a1 100644
--- a/pkg/handlers/nodepool_status.go
+++ b/pkg/handlers/nodepool_status.go
@@ -12,7 +12,7 @@ import (
 	"github.com/openshift-hyperfleet/hyperfleet-api/pkg/services"
 )
 
-type nodePoolStatusHandler struct {
+type NodePoolStatusHandler struct {
 	adapterStatusService services.AdapterStatusService
 	nodePoolService      services.NodePoolService
 }
@@ -20,15 +20,15 @@ type nodePoolStatusHandler struct {
 func NewNodePoolStatusHandler(
 	adapterStatusService services.AdapterStatusService,
 	nodePoolService services.NodePoolService,
-) *nodePoolStatusHandler {
-	return &nodePoolStatusHandler{
+) *NodePoolStatusHandler {
+	return &NodePoolStatusHandler{
 		adapterStatusService: adapterStatusService,
 		nodePoolService:      nodePoolService,
 	}
 }
 
 // List returns all adapter statuses for a nodepool with pagination
-func (h nodePoolStatusHandler) List(w http.ResponseWriter, r *http.Request) {
+func (h NodePoolStatusHandler) List(w http.ResponseWriter, r *http.Request) {
 	cfg := &handlerConfig{
 		Action: func() (interface{}, *errors.ServiceError) {
 			ctx := r.Context()
@@ -68,15 +68,15 @@ func (h nodePoolStatusHandler) List(w http.ResponseWriter, r *http.Request) {
 }
 
 // Create creates or updates an adapter status for a nodepool
-func (h nodePoolStatusHandler) Create(w http.ResponseWriter, r *http.Request) {
+func (h NodePoolStatusHandler) Create(w http.ResponseWriter, r *http.Request) {
 	var req openapi.AdapterStatusCreateRequest
 
 	cfg := &handlerConfig{
-		&req,
-		[]validate{
+		MarshalInto: &req,
+		Validate: []validate{
 			validateNotEmpty(&req, "Adapter", "adapter"),
 		},
-		func() (interface{}, *errors.ServiceError) {
+		Action: func() (interface{}, *errors.ServiceError) {
 			ctx := r.Context()
 			nodePoolID := mux.Vars(r)[logger.FieldNodePoolID]
 
@@ -109,7 +109,7 @@ func (h nodePoolStatusHandler) Create(w http.ResponseWriter, r *http.Request) {
 			}
 			return &status, nil
 		},
-		handleError,
+		ErrorHandler: handleError,
 	}
 
 	handleCreateWithNoContent(w, r, cfg)
diff --git a/pkg/handlers/openapi.go b/pkg/handlers/openapi.go
index 26f4e49d..6ca8f0fa 100755
--- a/pkg/handlers/openapi.go
+++ b/pkg/handlers/openapi.go
@@ -14,12 +14,12 @@ import (
 //go:embed openapi-ui.html
 var openapiui embed.FS
 
-type openAPIHandler struct {
+type OpenAPIHandler struct {
 	openAPIDefinitions []byte
 	uiContent          []byte
 }
 
-func NewOpenAPIHandler() (*openAPIHandler, error) {
+func NewOpenAPIHandler() (*OpenAPIHandler, error) {
 	ctx := context.Background()
 	// Load the OpenAPI spec from the generated code's embedded swagger
 	swagger, err := openapi.GetSwagger()
@@ -50,13 +50,13 @@ func NewOpenAPIHandler() (*openAPIHandler, error) {
 	}
 	logger.Info(ctx, "Loaded OpenAPI UI HTML from embedded file")
 
-	return &openAPIHandler{
+	return &OpenAPIHandler{
 		openAPIDefinitions: data,
 		uiContent:          uiContent,
 	}, nil
 }
 
-func (h *openAPIHandler) GetOpenAPI(w http.ResponseWriter, r *http.Request) {
+func (h *OpenAPIHandler) GetOpenAPI(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(http.StatusOK)
 	if _, err := w.Write(h.openAPIDefinitions); err != nil {
@@ -70,7 +70,7 @@ func (h *openAPIHandler) GetOpenAPI(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-func (h *openAPIHandler) GetOpenAPIUI(w http.ResponseWriter, r *http.Request) {
+func (h *OpenAPIHandler) GetOpenAPIUI(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "text/html")
 	w.WriteHeader(http.StatusOK)
 	if _, err := w.Write(h.uiContent); err != nil {
diff --git a/pkg/handlers/prometheus_metrics.go b/pkg/handlers/prometheus_metrics.go
index 496a3cd1..d03b5b75 100755
--- a/pkg/handlers/prometheus_metrics.go
+++ b/pkg/handlers/prometheus_metrics.go
@@ -6,15 +6,14 @@ import (
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 )
 
-type prometheusMetricsHandler struct {
+type PrometheusMetricsHandler struct {
 }
 
-// NewPrometheusMetricsHandler adds custom metrics and proxy to prometheus handler
-func NewPrometheusMetricsHandler() *prometheusMetricsHandler {
-	return &prometheusMetricsHandler{}
+func NewPrometheusMetricsHandler() *PrometheusMetricsHandler {
+	return &PrometheusMetricsHandler{}
 }
 
-func (h *prometheusMetricsHandler) Handler() http.Handler {
+func (h *PrometheusMetricsHandler) Handler() http.Handler {
 	handler := promhttp.Handler()
 
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
diff --git a/pkg/handlers/validation.go b/pkg/handlers/validation.go
index 933a050f..c21a47d9 100755
--- a/pkg/handlers/validation.go
+++ b/pkg/handlers/validation.go
@@ -115,7 +115,7 @@ func validateKind(i interface{}, fieldName string, field string, expectedKind st
 }
 
 // validateSpec validates that the spec field is not nil
-func validateSpec(i interface{}, fieldName string, field string) validate {
+func validateSpec(i interface{}, fieldName string, field string) validate { //nolint:unparam
 	return func() *errors.ServiceError {
 		value := reflect.ValueOf(i).Elem().FieldByName(fieldName)
 
diff --git a/pkg/health/handler.go b/pkg/health/handler.go
index b3e75557..87d13a65 100644
--- a/pkg/health/handler.go
+++ b/pkg/health/handler.go
@@ -30,7 +30,7 @@ func NewHandler(sessionFactory db.SessionFactory, dbPingTimeout time.Duration) *
 func (h *Handler) LivenessHandler(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(http.StatusOK)
-	_ = json.NewEncoder(w).Encode(map[string]string{"status": "ok"})
+	json.NewEncoder(w).Encode(map[string]string{"status": "ok"}) //nolint:errcheck // best-effort response
 }
 
 // ReadinessHandler handles the /readyz endpoint
@@ -43,7 +43,7 @@ func (h *Handler) ReadinessHandler(w http.ResponseWriter, r *http.Request) {
 
 	if state.IsShuttingDown() {
 		w.WriteHeader(http.StatusServiceUnavailable)
-		_ = json.NewEncoder(w).Encode(map[string]string{
+		json.NewEncoder(w).Encode(map[string]string{ //nolint:errcheck // best-effort response after header is written
 			"status": "shutting_down",
 			"reason": "Application is shutting down",
 		})
@@ -52,7 +52,7 @@ func (h *Handler) ReadinessHandler(w http.ResponseWriter, r *http.Request) {
 
 	if !state.IsReady() {
 		w.WriteHeader(http.StatusServiceUnavailable)
-		_ = json.NewEncoder(w).Encode(map[string]string{
+		json.NewEncoder(w).Encode(map[string]string{ //nolint:errcheck // best-effort response after header is written
 			"status": "not_ready",
 			"reason": "Application is not ready",
 		})
@@ -64,7 +64,7 @@ func (h *Handler) ReadinessHandler(w http.ResponseWriter, r *http.Request) {
 		sqlDB := h.sessionFactory.DirectDB()
 		if sqlDB == nil {
 			w.WriteHeader(http.StatusServiceUnavailable)
-			_ = json.NewEncoder(w).Encode(map[string]string{
+			json.NewEncoder(w).Encode(map[string]string{ //nolint:errcheck // best-effort response after header is written
 				"status": "not_ready",
 				"reason": "Database connection not available",
 			})
@@ -81,7 +81,7 @@ func (h *Handler) ReadinessHandler(w http.ResponseWriter, r *http.Request) {
 			}
 			logger.WithError(r.Context(), err).Warn("Readiness check: database ping failed")
 			w.WriteHeader(http.StatusServiceUnavailable)
-			_ = json.NewEncoder(w).Encode(map[string]string{
+			json.NewEncoder(w).Encode(map[string]string{ //nolint:errcheck // best-effort response after header is written
 				"status": "not_ready",
 				"reason": reason,
 			})
@@ -90,5 +90,5 @@ func (h *Handler) ReadinessHandler(w http.ResponseWriter, r *http.Request) {
 	}
 
 	w.WriteHeader(http.StatusOK)
-	_ = json.NewEncoder(w).Encode(map[string]string{"status": "ok"})
+	json.NewEncoder(w).Encode(map[string]string{"status": "ok"}) //nolint:errcheck // best-effort response
 }
diff --git a/pkg/logger/context.go b/pkg/logger/context.go
index 1c70a834..f248fe75 100644
--- a/pkg/logger/context.go
+++ b/pkg/logger/context.go
@@ -100,9 +100,9 @@ func GetResourceID(ctx context.Context) (string, bool) {
 
 // ContextField defines metadata for a string-type context log field
 type ContextField struct {
+	Getter func(context.Context) (string, bool)
 	Key    contextKey
 	Name   string
-	Getter func(context.Context) (string, bool)
 }
 
 // ContextFieldsRegistry defines all string-type context fields for logging
@@ -110,12 +110,12 @@ type ContextField struct {
 // Fields are ordered as per HyperFleet Logging Specification (docs/logging.md:384)
 // Note: transaction_id (int64) is handled separately in logger.go
 var ContextFieldsRegistry = []ContextField{
-	{ReqIDKey, "request_id", GetRequestID},
-	{TraceIDCtxKey, "trace_id", GetTraceID},
-	{SpanIDCtxKey, "span_id", GetSpanID},
-	{ClusterIDCtxKey, "cluster_id", GetClusterID},
-	{ResourceTypeCtxKey, "resource_type", GetResourceType},
-	{ResourceIDCtxKey, "resource_id", GetResourceID},
+	{GetRequestID, ReqIDKey, "request_id"},
+	{GetTraceID, TraceIDCtxKey, "trace_id"},
+	{GetSpanID, SpanIDCtxKey, "span_id"},
+	{GetClusterID, ClusterIDCtxKey, "cluster_id"},
+	{GetResourceType, ResourceTypeCtxKey, "resource_type"},
+	{GetResourceID, ResourceIDCtxKey, "resource_id"},
 }
 
 // WithTransactionID adds transaction ID to context
diff --git a/pkg/logger/logger.go b/pkg/logger/logger.go
index bafee016..94cf1e08 100755
--- a/pkg/logger/logger.go
+++ b/pkg/logger/logger.go
@@ -23,12 +23,12 @@ const (
 
 // LogConfig holds the configuration for the logger
 type LogConfig struct {
-	Level     slog.Level
-	Format    LogFormat
 	Output    io.Writer
 	Component string
 	Version   string
 	Hostname  string
+	Level     slog.Level
+	Format    LogFormat
 }
 
 // HyperFleetHandler implements slog.Handler interface
diff --git a/pkg/logger/logger_test.go b/pkg/logger/logger_test.go
index 6b157cbc..a44b9465 100644
--- a/pkg/logger/logger_test.go
+++ b/pkg/logger/logger_test.go
@@ -93,15 +93,15 @@ func TestParseLogFormat(t *testing.T) {
 // TestParseLogOutput tests log output parsing with various inputs
 func TestParseLogOutput(t *testing.T) {
 	tests := []struct {
+		expected  *os.File
 		name      string
 		input     string
-		expected  *os.File
 		expectErr bool
 	}{
-		{"stdout", "stdout", os.Stdout, false},
-		{"stderr", "stderr", os.Stderr, false},
-		{"empty defaults to stdout", "", os.Stdout, false},
-		{"invalid", "invalid", nil, true},
+		{name: "stdout", input: "stdout", expected: os.Stdout, expectErr: false},
+		{name: "stderr", input: "stderr", expected: os.Stderr, expectErr: false},
+		{name: "empty defaults to stdout", input: "", expected: os.Stdout, expectErr: false},
+		{name: "invalid", input: "invalid", expected: nil, expectErr: true},
 	}
 
 	for _, tt := range tests {
@@ -160,7 +160,7 @@ func TestBasicLogFormat(t *testing.T) {
 
 			if tt.format == FormatJSON {
 				// Parse the last JSON line (handles multi-line output like stack traces)
-				output := strings.TrimSpace(buf.String())
+				output = strings.TrimSpace(buf.String())
 				lines := strings.Split(output, "\n")
 				lastLine := lines[len(lines)-1]
 
@@ -329,13 +329,13 @@ func TestContextFields_Multiple(t *testing.T) {
 // TestStackTrace tests stack trace capture for different log levels
 func TestStackTrace(t *testing.T) {
 	tests := []struct {
+		logFunc          func(context.Context, string)
 		name             string
 		level            slog.Level
-		logFunc          func(context.Context, string)
 		expectStackTrace bool
 	}{
-		{"error level has stack trace", slog.LevelError, Error, true},
-		{"info level no stack trace", slog.LevelInfo, Info, false},
+		{name: "error level has stack trace", level: slog.LevelError, logFunc: Error, expectStackTrace: true},
+		{name: "info level no stack trace", level: slog.LevelInfo, logFunc: Info, expectStackTrace: false},
 	}
 
 	for _, tt := range tests {
@@ -387,13 +387,13 @@ func TestStackTrace(t *testing.T) {
 // TestLogLevelFiltering tests log level filtering
 func TestLogLevelFiltering(t *testing.T) {
 	tests := []struct {
+		logFunc     func(context.Context, string)
 		name        string
 		configLevel slog.Level
-		logFunc     func(context.Context, string)
 		shouldLog   bool
 	}{
-		{"debug filtered at info level", slog.LevelInfo, Debug, false},
-		{"info enabled at info level", slog.LevelInfo, Info, true},
+		{name: "debug filtered at info level", configLevel: slog.LevelInfo, logFunc: Debug, shouldLog: false},
+		{name: "info enabled at info level", configLevel: slog.LevelInfo, logFunc: Info, shouldLog: true},
 	}
 
 	for _, tt := range tests {
@@ -445,15 +445,15 @@ func TestGetLogger_Uninitialized(t *testing.T) {
 // TestConvenienceFunctions tests all convenience functions (Debug, Info, Warn, Error)
 func TestConvenienceFunctions(t *testing.T) {
 	tests := []struct {
-		name        string
-		level       slog.Level
 		logFunc     func(context.Context, string)
+		name        string
 		expectedLvl string
+		level       slog.Level
 	}{
-		{"Debug", slog.LevelDebug, Debug, "debug"},
-		{"Info", slog.LevelInfo, Info, "info"},
-		{"Warn", slog.LevelWarn, Warn, "warn"},
-		{"Error", slog.LevelError, Error, "error"},
+		{name: "Debug", level: slog.LevelDebug, logFunc: Debug, expectedLvl: "debug"},
+		{name: "Info", level: slog.LevelInfo, logFunc: Info, expectedLvl: "info"},
+		{name: "Warn", level: slog.LevelWarn, logFunc: Warn, expectedLvl: "warn"},
+		{name: "Error", level: slog.LevelError, logFunc: Error, expectedLvl: "error"},
 	}
 
 	for _, tt := range tests {
@@ -496,10 +496,10 @@ func TestConvenienceFunctions(t *testing.T) {
 // TestWithError tests the WithError convenience function
 func TestWithError(t *testing.T) {
 	tests := []struct {
-		name          string
 		err           error
-		expectError   bool
+		name          string
 		expectedValue string
+		expectError   bool
 	}{
 		{
 			name:          "non-nil error",
diff --git a/pkg/logger/text_handler.go b/pkg/logger/text_handler.go
index d0afd464..575d0973 100644
--- a/pkg/logger/text_handler.go
+++ b/pkg/logger/text_handler.go
@@ -21,8 +21,8 @@ type HyperFleetTextHandler struct {
 	component string
 	version   string
 	hostname  string
-	level     slog.Level
 	attrs     []slog.Attr
+	level     slog.Level
 	mu        sync.Mutex
 }
 
diff --git a/pkg/logger/text_handler_test.go b/pkg/logger/text_handler_test.go
index becb04cb..ef4a0adf 100644
--- a/pkg/logger/text_handler_test.go
+++ b/pkg/logger/text_handler_test.go
@@ -105,31 +105,31 @@ func TestHyperFleetTextHandler_SpecialCharacters(t *testing.T) {
 // TestHyperFleetTextHandler_LogLevels tests different log levels
 func TestHyperFleetTextHandler_LogLevels(t *testing.T) {
 	tests := []struct {
-		name          string
-		level         slog.Level
 		logFunc       func(*slog.Logger, context.Context, string)
+		name          string
 		expectedLevel string
+		level         slog.Level
 		shouldLog     bool
 	}{
 		{
-			"DEBUG enabled", slog.LevelDebug,
-			func(l *slog.Logger, ctx context.Context, msg string) { l.DebugContext(ctx, msg) },
-			"DEBUG", true,
+			name: "DEBUG enabled", level: slog.LevelDebug,
+			logFunc:       func(l *slog.Logger, ctx context.Context, msg string) { l.DebugContext(ctx, msg) },
+			expectedLevel: "DEBUG", shouldLog: true,
 		},
 		{
-			"INFO enabled", slog.LevelInfo,
-			func(l *slog.Logger, ctx context.Context, msg string) { l.InfoContext(ctx, msg) },
-			"INFO", true,
+			name: "INFO enabled", level: slog.LevelInfo,
+			logFunc:       func(l *slog.Logger, ctx context.Context, msg string) { l.InfoContext(ctx, msg) },
+			expectedLevel: "INFO", shouldLog: true,
 		},
 		{
-			"WARN enabled", slog.LevelWarn,
-			func(l *slog.Logger, ctx context.Context, msg string) { l.WarnContext(ctx, msg) },
-			"WARN", true,
+			name: "WARN enabled", level: slog.LevelWarn,
+			logFunc:       func(l *slog.Logger, ctx context.Context, msg string) { l.WarnContext(ctx, msg) },
+			expectedLevel: "WARN", shouldLog: true,
 		},
 		{
-			"ERROR enabled", slog.LevelError,
-			func(l *slog.Logger, ctx context.Context, msg string) { l.ErrorContext(ctx, msg) },
-			"ERROR", true,
+			name: "ERROR enabled", level: slog.LevelError,
+			logFunc:       func(l *slog.Logger, ctx context.Context, msg string) { l.ErrorContext(ctx, msg) },
+			expectedLevel: "ERROR", shouldLog: true,
 		},
 	}
 
diff --git a/pkg/middleware/masking.go b/pkg/middleware/masking.go
index d8ec724c..2b688725 100644
--- a/pkg/middleware/masking.go
+++ b/pkg/middleware/masking.go
@@ -20,9 +20,9 @@ const (
 // MaskingMiddleware handles sensitive data masking for logging
 // Masks sensitive HTTP headers and JSON body fields to prevent PII/secrets leakage
 type MaskingMiddleware struct {
-	enabled          bool
 	sensitiveHeaders []string
 	sensitiveFields  []string
+	enabled          bool
 }
 
 var (
diff --git a/pkg/middleware/masking_test.go b/pkg/middleware/masking_test.go
index 6d94f924..afd264da 100644
--- a/pkg/middleware/masking_test.go
+++ b/pkg/middleware/masking_test.go
@@ -10,10 +10,10 @@ import (
 
 func TestMaskHeaders(t *testing.T) {
 	tests := []struct {
-		name     string
-		enabled  bool
 		headers  http.Header
 		expected http.Header
+		name     string
+		enabled  bool
 	}{
 		{
 			name:    "mask authorization header",
@@ -69,14 +69,14 @@ func TestMaskHeaders(t *testing.T) {
 			name:    "mask multi-value headers",
 			enabled: true,
 			headers: http.Header{
-				"Cookie":      []string{"session=abc123", "tracking=xyz789", "preferences=dark"},
-				"X-Api-Key":   []string{"key1", "key2"},
-				"User-Agent":  []string{"browser/1.0"},
+				"Cookie":     []string{"session=abc123", "tracking=xyz789", "preferences=dark"},
+				"X-Api-Key":  []string{"key1", "key2"},
+				"User-Agent": []string{"browser/1.0"},
 			},
 			expected: http.Header{
-				"Cookie":      []string{RedactedValue, RedactedValue, RedactedValue},
-				"X-Api-Key":   []string{RedactedValue, RedactedValue},
-				"User-Agent":  []string{"browser/1.0"},
+				"Cookie":     []string{RedactedValue, RedactedValue, RedactedValue},
+				"X-Api-Key":  []string{RedactedValue, RedactedValue},
+				"User-Agent": []string{"browser/1.0"},
 			},
 		},
 	}
@@ -117,44 +117,44 @@ func TestMaskHeaders(t *testing.T) {
 func TestMaskBody(t *testing.T) {
 	tests := []struct {
 		name     string
-		enabled  bool
 		body     string
 		expected string
+		enabled  bool
 	}{
 		{
-			name:    "mask password field",
-			enabled: true,
-			body:    `{"username":"alice","password":"secret123"}`,
+			name:     "mask password field",
+			enabled:  true,
+			body:     `{"username":"alice","password":"secret123"}`,
 			expected: `{"password":"***REDACTED***","username":"alice"}`,
 		},
 		{
-			name:    "mask nested sensitive fields",
-			enabled: true,
-			body:    `{"user":{"name":"alice","password":"secret"},"api_key":"key123"}`,
+			name:     "mask nested sensitive fields",
+			enabled:  true,
+			body:     `{"user":{"name":"alice","password":"secret"},"api_key":"key123"}`,
 			expected: `{"api_key":"***REDACTED***","user":{"name":"alice","password":"***REDACTED***"}}`,
 		},
 		{
-			name:    "mask array of objects",
-			enabled: true,
-			body:    `{"users":[{"name":"alice","password":"pass1"},{"name":"bob","secret":"pass2"}]}`,
+			name:     "mask array of objects",
+			enabled:  true,
+			body:     `{"users":[{"name":"alice","password":"pass1"},{"name":"bob","secret":"pass2"}]}`,
 			expected: `{"users":[{"name":"alice","password":"***REDACTED***"},{"name":"bob","secret":"***REDACTED***"}]}`,
 		},
 		{
-			name:    "mask top-level array with sensitive fields",
-			enabled: true,
-			body:    `[{"name":"alice","password":"secret1"},{"name":"bob","token":"secret2"}]`,
+			name:     "mask top-level array with sensitive fields",
+			enabled:  true,
+			body:     `[{"name":"alice","password":"secret1"},{"name":"bob","token":"secret2"}]`,
 			expected: `[{"name":"alice","password":"***REDACTED***"},{"name":"bob","token":"***REDACTED***"}]`,
 		},
 		{
-			name:    "mask nested arrays with sensitive fields",
-			enabled: true,
-			body:    `[[{"password":"secret1"}],[{"api_key":"secret2"}]]`,
+			name:     "mask nested arrays with sensitive fields",
+			enabled:  true,
+			body:     `[[{"password":"secret1"}],[{"api_key":"secret2"}]]`,
 			expected: `[[{"password":"***REDACTED***"}],[{"api_key":"***REDACTED***"}]]`,
 		},
 		{
-			name:    "mask nested arrays inside map values",
-			enabled: true,
-			body:    `{"users":[[{"password":"secret1"}]],"data":[[{"token":"secret2"}]]}`,
+			name:     "mask nested arrays inside map values",
+			enabled:  true,
+			body:     `{"users":[[{"password":"secret1"}]],"data":[[{"token":"secret2"}]]}`,
 			expected: `{"data":[[{"token":"***REDACTED***"}]],"users":[[{"password":"***REDACTED***"}]]}`,
 		},
 		{
@@ -165,70 +165,70 @@ func TestMaskBody(t *testing.T) {
 				`"password":"***REDACTED***","secret":"***REDACTED***","token":"***REDACTED***"}`,
 		},
 		{
-			name:    "case insensitive field matching",
-			enabled: true,
-			body:    `{"Password":"pass","SECRET":"sec","AccessToken":"tok"}`,
+			name:     "case insensitive field matching",
+			enabled:  true,
+			body:     `{"Password":"pass","SECRET":"sec","AccessToken":"tok"}`,
 			expected: `{"AccessToken":"***REDACTED***","Password":"***REDACTED***","SECRET":"***REDACTED***"}`,
 		},
 		{
-			name:    "non-JSON body without sensitive data unchanged",
-			enabled: true,
-			body:    `not json content`,
+			name:     "non-JSON body without sensitive data unchanged",
+			enabled:  true,
+			body:     `not json content`,
 			expected: `not json content`,
 		},
 		{
-			name:    "empty body",
-			enabled: true,
-			body:    ``,
+			name:     "empty body",
+			enabled:  true,
+			body:     ``,
 			expected: ``,
 		},
 		{
-			name:    "masking disabled",
-			enabled: false,
-			body:    `{"password":"secret"}`,
+			name:     "masking disabled",
+			enabled:  false,
+			body:     `{"password":"secret"}`,
 			expected: `{"password":"secret"}`,
 		},
 		// Fallback masking tests (non-JSON content with sensitive data)
 		{
-			name:    "fallback: redact email addresses",
-			enabled: true,
-			body:    `User email: alice@example.com, contact bob.smith@company.co.uk`,
+			name:     "fallback: redact email addresses",
+			enabled:  true,
+			body:     `User email: alice@example.com, contact bob.smith@company.co.uk`,
 			expected: `User email: ***REDACTED***, contact ***REDACTED***`,
 		},
 		{
-			name:    "fallback: redact credit card numbers",
-			enabled: true,
-			body:    `Card: 4532-1234-5678-9010 and 5425233430109903`,
+			name:     "fallback: redact credit card numbers",
+			enabled:  true,
+			body:     `Card: 4532-1234-5678-9010 and 5425233430109903`,
 			expected: `Card: ***REDACTED*** and ***REDACTED***`,
 		},
 		{
-			name:    "fallback: redact Bearer tokens",
-			enabled: true,
-			body:    `Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9`,
+			name:     "fallback: redact Bearer tokens",
+			enabled:  true,
+			body:     `Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9`,
 			expected: `Authorization: Bearer ***REDACTED***`,
 		},
 		{
-			name:    "fallback: redact API keys",
-			enabled: true,
-			body:    `API_KEY=sk_test_123456789abcdef and api-key: prod_key_xyz`,
+			name:     "fallback: redact API keys",
+			enabled:  true,
+			body:     `API_KEY=sk_test_123456789abcdef and api-key: prod_key_xyz`,
 			expected: `API_KEY=***REDACTED*** and api-key: ***REDACTED***`,
 		},
 		{
-			name:    "fallback: redact form-encoded passwords",
-			enabled: true,
-			body:    `username=alice&password=secret123&email=test@example.com`,
+			name:     "fallback: redact form-encoded passwords",
+			enabled:  true,
+			body:     `username=alice&password=secret123&email=test@example.com`,
 			expected: `username=alice&password=***REDACTED***&email=***REDACTED***`,
 		},
 		{
-			name:    "fallback: redact multiple sensitive patterns",
-			enabled: true,
-			body:    `User: alice@example.com, Token: secret_abc123, CC: 4532123456789010`,
+			name:     "fallback: redact multiple sensitive patterns",
+			enabled:  true,
+			body:     `User: alice@example.com, Token: secret_abc123, CC: 4532123456789010`,
 			expected: `User: ***REDACTED***, Token: ***REDACTED***, CC: ***REDACTED***`,
 		},
 		{
-			name:    "fallback: disabled masking returns original",
-			enabled: false,
-			body:    `password=secret123&api_key=test_key&user@example.com`,
+			name:     "fallback: disabled masking returns original",
+			enabled:  false,
+			body:     `password=secret123&api_key=test_key&user@example.com`,
 			expected: `password=secret123&api_key=test_key&user@example.com`,
 		},
 	}
diff --git a/pkg/middleware/schema_validation.go b/pkg/middleware/schema_validation.go
index 6dab5d92..09d98d03 100644
--- a/pkg/middleware/schema_validation.go
+++ b/pkg/middleware/schema_validation.go
@@ -26,12 +26,12 @@ func handleValidationError(w http.ResponseWriter, r *http.Request, err *errors.S
 
 	// Write RFC 9457 Problem Details error response
 	w.Header().Set("Content-Type", "application/problem+json")
-	w.WriteHeader(err.HttpCode)
+	w.WriteHeader(err.HTTPCode)
 	if encodeErr := json.NewEncoder(w).Encode(err.AsProblemDetails(r.URL.Path, traceID)); encodeErr != nil {
 		logger.With(r.Context(),
 			logger.HTTPPath(r.URL.Path),
 			logger.HTTPMethod(r.Method),
-			logger.HTTPStatusCode(err.HttpCode),
+			logger.HTTPStatusCode(err.HTTPCode),
 		).WithError(encodeErr).Error("Failed to encode validation error response")
 	}
 }
diff --git a/pkg/services/cluster.go b/pkg/services/cluster.go
index cd828731..e37f9580 100644
--- a/pkg/services/cluster.go
+++ b/pkg/services/cluster.go
@@ -167,7 +167,7 @@ func (s *sqlClusterService) UpdateClusterStatusFromAdapters(
 	for _, adapterStatus := range adapterStatuses {
 		// Unmarshal Conditions from JSONB
 		var conditions []api.AdapterCondition
-		if err := json.Unmarshal(adapterStatus.Conditions, &conditions); err != nil {
+		if unmarshalErr := json.Unmarshal(adapterStatus.Conditions, &conditions); unmarshalErr != nil {
 			continue // Skip if can't unmarshal
 		}
 
diff --git a/pkg/services/generic.go b/pkg/services/generic.go
index 34016abc..b7c92ffe 100755
--- a/pkg/services/generic.go
+++ b/pkg/services/generic.go
@@ -54,15 +54,15 @@ var (
 // wrap all needed pieces for the LIST function
 type listContext struct {
 	ctx              context.Context
+	resourceList     interface{}
 	args             *ListArguments
-	username         string
 	pagingMeta       *api.PagingMeta
-	resourceList     interface{}
 	disallowedFields *map[string]string
-	resourceType     string
 	joins            map[string]dao.TableRelation
-	groupBy          []string
 	set              map[string]bool
+	username         string
+	resourceType     string
+	groupBy          []string
 }
 
 func (s *sqlGenericService) newListContext(
diff --git a/pkg/services/node_pool.go b/pkg/services/node_pool.go
index 5b905686..89b21983 100644
--- a/pkg/services/node_pool.go
+++ b/pkg/services/node_pool.go
@@ -168,7 +168,7 @@ func (s *sqlNodePoolService) UpdateNodePoolStatusFromAdapters(
 	for _, adapterStatus := range adapterStatuses {
 		// Unmarshal Conditions from JSONB
 		var conditions []api.AdapterCondition
-		if err := json.Unmarshal(adapterStatus.Conditions, &conditions); err != nil {
+		if unmarshalErr := json.Unmarshal(adapterStatus.Conditions, &conditions); unmarshalErr != nil {
 			continue // Skip if can't unmarshal
 		}
 
diff --git a/pkg/services/types.go b/pkg/services/types.go
index 9dac5c2c..9466a83a 100755
--- a/pkg/services/types.go
+++ b/pkg/services/types.go
@@ -9,12 +9,12 @@ import (
 // ListArguments are arguments relevant for listing objects.
 // This struct is common to all service List funcs in this package
 type ListArguments struct {
-	Page     int
-	Size     int64
-	Preloads []string
 	Search   string
+	Preloads []string
 	OrderBy  []string
 	Fields   []string
+	Page     int
+	Size     int64
 }
 
 // ~65500 is the maximum number of parameters that can be provided to a postgres WHERE IN clause
diff --git a/pkg/services/types_test.go b/pkg/services/types_test.go
index 228a98d5..b5d700b7 100644
--- a/pkg/services/types_test.go
+++ b/pkg/services/types_test.go
@@ -83,8 +83,8 @@ func TestNewListArguments_PageSize(t *testing.T) {
 	RegisterTestingT(t)
 
 	tests := []struct {
-		name         string
 		queryParams  url.Values
+		name         string
 		expectedPage int
 		expectedSize int64
 	}{
diff --git a/pkg/validators/schema_validator.go b/pkg/validators/schema_validator.go
index 3226e5d6..6e811e44 100644
--- a/pkg/validators/schema_validator.go
+++ b/pkg/validators/schema_validator.go
@@ -11,8 +11,8 @@ import (
 
 // ResourceSchema represents a validation schema for a specific resource type
 type ResourceSchema struct {
-	TypeName string
 	Schema   *openapi3.SchemaRef
+	TypeName string
 }
 
 // SchemaValidator validates JSON objects against OpenAPI schemas
diff --git a/plugins/clusters/plugin.go b/plugins/clusters/plugin.go
index d7eae5a5..a7aba150 100644
--- a/plugins/clusters/plugin.go
+++ b/plugins/clusters/plugin.go
@@ -82,7 +82,7 @@ func init() {
 		clustersRouter.HandleFunc("/{id}/nodepools/{nodepool_id}/statuses", nodepoolStatusHandler.Create).Methods(http.MethodPost)
 
 		clustersRouter.Use(authMiddleware.AuthenticateAccountJWT)
-		clustersRouter.Use(authzMiddleware.AuthorizeApi)
+		clustersRouter.Use(authzMiddleware.AuthorizeAPI)
 	})
 
 	// REMOVED: Controller registration - Sentinel handles orchestration
diff --git a/plugins/nodePools/plugin.go b/plugins/nodePools/plugin.go
index 5215174c..1b6e46a2 100644
--- a/plugins/nodePools/plugin.go
+++ b/plugins/nodePools/plugin.go
@@ -58,7 +58,7 @@ func init() {
 		nodePoolsRouter.HandleFunc("", nodePoolHandler.List).Methods(http.MethodGet)
 
 		nodePoolsRouter.Use(authMiddleware.AuthenticateAccountJWT)
-		nodePoolsRouter.Use(authzMiddleware.AuthorizeApi)
+		nodePoolsRouter.Use(authzMiddleware.AuthorizeAPI)
 	})
 
 	// REMOVED: Controller registration - Sentinel handles orchestration
diff --git a/test/helper.go b/test/helper.go
index 25ad1967..055fc36e 100755
--- a/test/helper.go
+++ b/test/helper.go
@@ -56,18 +56,18 @@ var jwkURL string
 type TimeFunc func() time.Time
 
 type Helper struct {
-	Ctx               context.Context
-	DBFactory         db.SessionFactory
-	AppConfig         *config.ApplicationConfig
-	APIServer         server.Server
-	MetricsServer     server.Server
-	HealthServer server.Server
-	TimeFunc          TimeFunc
-	JWTPrivateKey     *rsa.PrivateKey
-	JWTCA             *rsa.PublicKey
-	T                 *testing.T
-	teardowns         []func() error
-	Factories         factories.Factories
+	Factories     factories.Factories
+	Ctx           context.Context
+	DBFactory     db.SessionFactory
+	APIServer     server.Server
+	MetricsServer server.Server
+	HealthServer  server.Server
+	AppConfig     *config.ApplicationConfig
+	TimeFunc      TimeFunc
+	JWTPrivateKey *rsa.PrivateKey
+	JWTCA         *rsa.PublicKey
+	T             *testing.T
+	teardowns     []func() error
 }
 
 func NewHelper(t *testing.T) *Helper {
@@ -100,8 +100,7 @@ func NewHelper(t *testing.T) *Helper {
 		}
 		if logLevel := os.Getenv("LOGLEVEL"); logLevel != "" {
 			logger.With(ctx, logger.FieldLogLevel, logLevel).Info("Using custom loglevel")
-			// Intentionally ignore error from Set — acceptable for tests
-			_ = pflag.CommandLine.Set("-v", logLevel)
+			pflag.CommandLine.Set("-v", logLevel) //nolint:errcheck // best-effort log level override for tests
 		}
 		pflag.Parse()
 
@@ -295,7 +294,7 @@ func (helper *Helper) HealthURL(path string) string {
 	return fmt.Sprintf("%s://%s%s", protocol, helper.AppConfig.Health.BindAddress(), path)
 }
 
-func (helper *Helper) NewApiClient() *openapi.ClientWithResponses {
+func (helper *Helper) NewAPIClient() *openapi.ClientWithResponses {
 	// Build the server URL
 	protocol := "http" //nolint:goconst // Protocol strings used across URL builders
 	if helper.AppConfig.Server.TLS.Enabled {
diff --git a/test/integration/adapter_status_test.go b/test/integration/adapter_status_test.go
index 14d5a5a6..2b2a15ca 100644
--- a/test/integration/adapter_status_test.go
+++ b/test/integration/adapter_status_test.go
@@ -118,7 +118,7 @@ func TestClusterStatusGet(t *testing.T) {
 			},
 			nil,
 		)
-		_, err := client.PostClusterStatusesWithResponse(
+		_, err = client.PostClusterStatusesWithResponse(
 			ctx, cluster.ID,
 			openapi.PostClusterStatusesJSONRequestBody(statusInput), test.WithAuthToken(ctx),
 		)
@@ -244,7 +244,7 @@ func TestNodePoolStatusGet(t *testing.T) {
 			nil,
 		)
 		// Use nodePool.OwnerID as the cluster_id parameter
-		_, err := client.PostNodePoolStatusesWithResponse(
+		_, err = client.PostNodePoolStatusesWithResponse(
 			ctx, nodePool.OwnerID, nodePool.ID,
 			openapi.PostNodePoolStatusesJSONRequestBody(statusInput), test.WithAuthToken(ctx),
 		)
@@ -295,7 +295,7 @@ func TestAdapterStatusPaging(t *testing.T) {
 			},
 			nil,
 		)
-		_, err := client.PostClusterStatusesWithResponse(
+		_, err = client.PostClusterStatusesWithResponse(
 			ctx, cluster.ID,
 			openapi.PostClusterStatusesJSONRequestBody(statusInput), test.WithAuthToken(ctx),
 		)
@@ -671,7 +671,7 @@ func TestAdapterStatusPagingEdgeCases(t *testing.T) {
 			},
 			nil,
 		)
-		_, err := client.PostClusterStatusesWithResponse(
+		_, err = client.PostClusterStatusesWithResponse(
 			ctx, cluster.ID,
 			openapi.PostClusterStatusesJSONRequestBody(statusInput), test.WithAuthToken(ctx),
 		)
diff --git a/test/integration/advisory_locks_test.go b/test/integration/advisory_locks_test.go
index bf855383..a62221ce 100644
--- a/test/integration/advisory_locks_test.go
+++ b/test/integration/advisory_locks_test.go
@@ -374,10 +374,10 @@ func TestAdvisoryLockContextCancellation(t *testing.T) {
 	Expect(err).NotTo(HaveOccurred(), "Failed to acquire first lock")
 	defer db.Unlock(ctx1, lockOwnerID1)
 
-	// Track when the second goroutine gets cancelled
+	// Track when the second goroutine gets canceled
 	gotCancelError := make(chan bool, 1)
 
-	// Create a cancellable context for the second goroutine
+	// Create a cancelable context for the second goroutine
 	ctx2, cancel := context.WithCancel(context.Background())
 
 	// Use WaitGroup to ensure goroutine exits before test cleanup
diff --git a/test/registration.go b/test/registration.go
index 7555c319..656df607 100755
--- a/test/registration.go
+++ b/test/registration.go
@@ -18,7 +18,7 @@ func RegisterIntegration(t *testing.T) (*Helper, *openapi.ClientWithResponses) {
 	// Reset the database to a seeded blank state
 	helper.DBFactory.ResetDB()
 	// Create an api client
-	client := helper.NewApiClient()
+	client := helper.NewAPIClient()
 
 	return helper, client
 }
