promote

Promote

Produce an evidence package for moving an internal Next.js business app from Layer 1 to Layer 2. This is not an approval step and must not update LAYER.md to 2; IT does that after sign-off.

Usage

/promote
/promote --layer 2

Only Layer 2 is supported. Layer 3 is a formal project, not a checklist promotion.

Preconditions

The target repo should be an internal Next.js business app created from this framework:

• LAYER.md exists and has no <<intake:*>> tokens.
• package.json, prisma/schema.prisma, src/lib/auth, src/lib/blob/client.ts, and src/lib/audit-log/repository.ts exist.
• docs/deployment-layers.md exists in the provisioned repo, or the source template doc is available from the framework.

If LAYER.md.template exists or intake tokens remain, stop. The repo has not been provisioned correctly.

Process

Phase 1: Mechanical Checks

Run read-only checks first and record the command/result in the report.

Required checks:

1. Confirm the working tree is clean:

   git status --short
   

2. Confirm LAYER.md exists and LAYER.md.template does not:

   test -f LAYER.md && test ! -f LAYER.md.template
   

3. Confirm no intake tokens remain in stamped seed files:

   grep -n "<<intake:" LAYER.md README.md CLAUDE.md 2>/dev/null
   

   The command should produce no output. Documentation files may still mention token names as examples.
4. Confirm no committed local env files:

   git ls-files | grep -E '(^|/)\.env($|\.|/)' | grep -vE '(^|/)\.env\.example$'
   

   .env.example is allowed. Any committed .env, .env.local, .env.production, or equivalent is a blocker.
5. Run a focused secret scan over tracked files:

   git grep -n -E 'sk-proj-|sk-org-|AKIA[0-9A-Z]{16}|-----BEGIN .*KEY-----|client_secret|password' -- .
   

   Treat findings in examples/docs as warnings unless they contain real-looking values.
6. Confirm Layer 2-relevant app boundaries exist:

   test -f src/lib/auth/oidc.ts
   test -f src/lib/blob/client.ts
   test -f src/lib/audit-log/repository.ts
   test -f prisma/schema.prisma
   

7. Run the project validation commands when dependencies are installed:

   npm run typecheck
   npm run lint
   npm run build
   npm audit --audit-level=high
   

   If dependencies are missing, record that validation could not run and list the missing prerequisite.