Production readiness review

Skill juanibosco/prod-review/skills/production-readiness-review

Spine of the Production Readiness suite. Aggregates per-area readiness reports into one weighted score (0-100) and a phased, evidence-backed go-live plan. Owns the shared scoring contract, severity rubric, evidence rule, and report template. Tuned for NestJS / TypeORM / Cloudflare / GCP / PM2-Ubuntu stacks. Use when consolidating area results from /prod-review:audit, or to score a single area's findings against the contract. Does not re-judge — it only aggregates.From its SKILL.md

Install

npx -y skills add juanibosco/prod-review --skill production-readiness-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

5.8 KB, as published. Nobody here has run it

Production Readiness Review (spine)

This skill is the brain of the suite. The /prod-review:audit orchestrator fans out one subagent per area; every subagent returns the same structured shape (references/area-result.schema.json); this skill aggregates them into a single weighted score and a phased plan, then renders the dated report. It scores; it never re-investigates.

Areas & weights (sum = 100)

#	Area	Key	Weight	Agent (own) soft-invokes	Model
1	Code & arch	code	15	`engineering:architecture` + `code-review` + `tech-debt`	heavy
2	Data model	data	12	`claude-db:audit` (hard dep)	light
3	Security	sec	15	`cyber-neo`	heavy
4	Testing	test	12	`engineering:testing-strategy`	light
5	Stress / load	load	8	own (readiness + optional execute)	light
6	Observability	obs	10	`engineering:incident-response` (partial)	light
7	CI/CD	cicd	10	`engineering:deploy-checklist`	light
8	Documentation	docs	6	`engineering:documentation`	light
9	Deployment/infra	deploy	12	own (CF / App Engine / PM2, health, rollback, backups, cutover)	heavy

Soft-invoke: an agent calls its source skill if installed, else analyzes directly and notes skillUsed: false. Only claude-db is a hard plugin dependency. CI/CD (pipeline) ≠ Deployment (target). Keep them separate. Re-weight here if areas change; weights must always sum to 100.

The scoring contract (every agent returns EXACTLY this)

See references/area-result.schema.json. Example:

{
  "area": "Security",
  "key": "sec",
  "weight": 15,
  "score": 63,
  "scoreRationale": "one critical (-25) and one high (-12) drive the deduction",
  "skillUsed": true,
  "findings": [
    {
      "id": "SEC-001",
      "title": "JWT secret hardcoded in source",
      "severity": "critical",
      "evidenceStatus": "found",
      "evidence": "src/auth/jwt.config.ts:14",
      "recommendation": "Move to env / GCP Secret Manager; rotate the leaked key.",
      "effort": "S",
      "phase": 0
    }
  ],
  "blockers": ["SEC-001"],
  "summary": "2-4 sentence area verdict."
}

Severity → score rubric (deterministic)

Start at 100, subtract per finding:

severity	deduction	meaning
critical	25	go-live blocker; unsafe in prod
high	12	serious; fix before/just after launch
medium	5	should fix; not launch-blocking
low	2	minor / hygiene
info	0	observation, no deduction

Clamp to [0, 100]. score is computed, not vibed. The orchestrator trusts it.

Evidence rule (MANDATORY — propagate to every agent)

Never invent. Every finding carries an evidenceStatus:

found — real artifact; evidence MUST be path:line or a quoted config key.
not_configured — the thing is absent (no load tests, no dashboards). This is itself a finding (usually medium/high), scored accordingly. Set evidence to "NO EVIDENCE FOUND".
not_applicable — genuinely N/A for this stack; no deduction.

Load/stress and observability frequently have nothing in a fresh repo. They must report not_configured and score down — never fabricate, never hard-fail.

Aggregation (executed by `scripts/aggregate.mjs`, not by hand)

The orchestrator runs the script; it recomputes each area score from that area's findings (the rubric below), so the result never depends on the model summing correctly. A self-reported score that disagrees with the recomputed value is logged and overridden. This section documents what the script does — keep them in sync if you change either.

Validate each area result against the schema; reject malformed → request re-run.
overall = round( Σ (area.score × area.weight) / Σ weight ).
Go-live gate: any critical finding anywhere → NO-GO regardless of overall. Else overall ≥ 80 and no high blockers → GO. Else GO-WITH-RISKS.
Phased plan from each finding's phase:
- Phase 0 — Blockers (pre-launch): all critical + any high tagged phase 0.
- Phase 1 — Hardening (launch week): remaining high.
- Phase 2 — Should-fix (first month): medium.
- Phase 3 — Backlog: low. Within a phase, order by (severity, effort asc) so quick wins surface first.
Render references/report-template.md → docs/prod-readiness/YYYY-MM-DD.md.

Inventory rule

scripts/repo_inventory.py runs once in the orchestrator; the snapshot .prod-review/inventory.json is fed to every agent. Agents read it; they do not re-scan the tree for inventory — they investigate their own domain.

Single-area re-run

Re-running one area replaces only that area's block in the latest dated report and recomputes overall + gate. Other areas' scores are preserved.