Pack · 8 skillsOfficialVerified

Production Readiness Review

A go/no-go launch review that runs against your real repo: vulnerable dependencies, leaked secrets, lock-taking migrations rehearsed on a scratch Postgres, rollback, observability, config drift and a staging load test, each ending in evidence.

by Skill Me

Eight skills that review a release the way a senior SRE would, as scripts against your own repository, each ending in a machine-checked gate that prints PASS, FAIL or BLOCKED with file, line and evidence. Write the readiness contract (tier, SLO, release base, staging host, waivers); look up every locked dependency in OSV and scan the working tree and full git history for live credentials; review pending Postgres migrations for locks, rewrites and renames the running code still reads, then rehearse them on a throwaway Postgres with seed rows, recording locks, measured table rewrites and a down/up round trip; prove the previous release can be redeployed onto the new schema, with backups and a runbook; find swallowed errors, missing timeouts and missing error tracking; compare the env vars the code reads against what production defines; load-test staging open-loop against your SLO; and roll it all into one evidence-bound go/no-go report that refuses stale gates. Covers Node/TypeScript and Python services on Postgres. Python 3 standard library only, no installs. It reviews code and configuration, not business logic or authorization, and the report says what it did not check. Requires an AI that can run commands on your computer (Claude Code, Codex or Cursor). The worked example is a fictional invoicing API; every skill reads your own contract first.

What you get, shown on a sample run

Version 1.0.0

Sample run: Ledgerline

Fictional company

Ledgerline is not a real company. An invoicing API: Express and Postgres, a Python worker and a Vite client. Ledgerline is built as a real git repository with 29 planted defects, plus a fixed twin. The whole chain ran on both from a clean checkout, using the scripts exactly as the skills ship them.

Launch candidate: NO-GO, with all 29 planted findings raised

Gate

From the report

MIG-RENAME-COLUMN · db/migrations/20260915_004_customer_email.sql:2
customers.email -> email_address; code still uses 'email': src/routes/customers.js:6
Fix: Expand/contract: add the new name, dual-write, move reads, drop the old one in a later release.
MIG-REHEARSAL-FAILED · db/migrations/20260910_003_invoice_currency.sql
Statement at line 3: column "currency" of relation "invoices" contains null values.
Fix: Fix the migration; it fails on a database shaped like production.
SECRET-STRIPE-LIVE · src/stripe.js
sk…(45 chars, sha256 3454fdc6) in git history only: deleted from HEAD, still recoverable.
Fix: Revoke and rotate it at the provider first (deleting the file does not revoke it), then move it to the secret store.
CONFIG-PUBLIC-SECRET · web/src/config.ts:2
VITE_STRIPE_SECRET_KEY: the VITE_ prefix bundles it into browser JavaScript.
Fix: Move the secret server-side (no public prefix) and rotate it.

What each skill delivers, in run order

1.Readiness Contract Detects the stack and tools, then writes and validates readiness-contract.json: tier, SLO, release base, staging host, backups and waivers.
2.Dependency and Secret Scan Every lockfile parsed and looked up in OSV with severity and the smallest safe upgrade, plus live credentials and tracked .env files found in the working tree and git history (it reports exactly how many commits it read; shallow or truncated history fails the gate), with evidence redacted.
3.Migration Safety Lock, rewrite and compatibility findings for pending Postgres migrations, then a rehearsal on a throwaway Postgres with seed rows: locks per file, measured table rewrites and a down/up round trip.
4.Rollback Path Whether the previous release can be redeployed onto the new schema, PITR and restore-test status, and a drafted rollback runbook with commands.
5.Observability Coverage A route and job inventory with missing error tracking or error middleware, swallowed exceptions, outbound calls without timeouts, health endpoints and unmonitored jobs.
6.Config Drift Env vars the code reads compared with .env.example and each deployed environment: secrets behind public prefixes, staging/production drift and stale variables.
7.Staging Load Test An open-loop, fixed-rate load test against an allowlisted staging host, judged against your SLO.
8.Readiness Report One evidence-bound decision (GO, GO with accepted risks, or NO-GO) in Markdown and HTML, refusing missing or stale gates.

Requirements

An AI client that runs commands on your machine: Claude Code, Codex or Cursor.
Python 3.9+ (standard library only, nothing to install)
git

Optional

PostgreSQL client and server binaries, for the migration rehearsal
Outbound HTTPS to api.osv.dev, for the vulnerability lookup (package names and versions only)

How it was verified

Run for real: the full chain on both Ledgerline variants from a fresh fixture each time, with the scripts as extracted from the skill text.
Survives strangers: two buyer tests by fresh agents with only the pack, on open-source repos it was not built against (papermark: Next.js, Prisma and Postgres; healthchecks: Django and Postgres). Every failure was fixed and re-run.
Judged: three adversarial SRE reviews (15, then 11, then 1 must-fix), each fix backed by a regression test; 42 regression cases run before every release.

What it does not do

1.Covers Node/TypeScript and Python services on PostgreSQL. Route and job detection supports Express, Fastify, Hono, Nest, Next.js, SvelteKit, Nuxt, FastAPI, Flask and Django; other frameworks, Knex, Rails and other databases are reported as needing manual review, not checked.
2.Checks are static pattern matches on your code: they will miss dynamic or custom patterns and sometimes flag code that is fine. Every finding names a file and line so you can confirm it or waive it with an owner and an expiry.
3.Backup, restore-test and rollback-rehearsal status, table sizes, SLOs and the load-test rate come from what your team records in the contract. The review checks they are recorded and recent, not that they are true.
4.Migration rehearsal runs on a throwaway local Postgres with sample rows you supply. It proves files apply, roll back and which locks they take, not how long those locks are held at production volume. Django and Alembic migrations are rehearsed by hand.
5.The load test is a single-machine generator for a launch gate, up to 500 requests per second, against a staging host you own. It does not reuse connections, does not verify which commit staging runs, and is not capacity planning. A run against a local server is labelled LOCAL in the report.
6.Vulnerability lookup sends package names and versions to OSV (api.osv.dev). Nothing else leaves your machine except load-test traffic to your own staging host.
7.Secret scanning checks the working tree and git history for a fixed set of credential formats, and needs a full clone to cover all of history. Keep a dedicated scanner such as gitleaks in CI.
8.Requires an AI client that can run commands (Claude Code, Cursor, Codex), Python 3.9+ and git; the migration rehearsal also needs local PostgreSQL binaries.
9.A GO means these checks passed on this commit; it is not a guarantee the launch will go well.

Skills in this pack

8 skills

Arranged in the author's recommended order. Walk through them in sequence, or open any one on its own.

01
Readiness Contract
CodingPremium
Starts a production readiness review of a real repository – detects the stack (Node/TS or Python, framework, Postgres, migration tool, deploy target, CI), probes which tools the machine has.
02
Dependency and Secret Scan
CodingPremium
Runs the two supply-side launch gates on a real repository – parses every lockfile (npm, pnpm, yarn, pip requirements, Poetry, uv, Pipfile), checks lock drift and unpinned or git-sourced dependencies.
03
Migration Safety
CodingPremium
Reviews the Postgres migrations a release will run before they reach production – finds the statements that lock or rewrite busy tables (index builds without CONCURRENTLY, NOT NULL columns without defaults, type changes, SET NOT NULL.
04
Rollback Path
CodingPremium
Checks whether a release can be undone before it ships – that the previous version is still redeployable (immutable image tags or a platform with native rollback).
05
Observability Coverage
CodingPremium
Checks that a service's failures will be seen before launch – inventories HTTP routes (Express, Fastify, Hono, Nest, Next.js route handlers and API routes, SvelteKit endpoints, Nuxt server routes, FastAPI, Flask, Django) and background jobs.
06
Config Drift
CodingPremium
Compares the environment variables a service actually reads (process.env, import.meta.env, os.environ, os.getenv, destructuring, with or without defaults) against .env.example and against the variable NAMES exported from each deployed environment.
07
Staging Load Test
CodingPremium
Load-tests a staging service against its contract SLO before launch with an open-loop, fixed-arrival-rate generator (Python standard library, no k6 or Locust install) – weighted scenarios, warm-up excluded.
08
Readiness Report
CodingPremium
Turns the production readiness gates into one go/no-go decision with evidence – reads every gate file, rejects gates run on a different commit or before uncommitted changes, re-applies the contract's current waivers (owner, reason, expiry.