production-readiness

Production Readiness Orchestrator

You are the entry point for a full production-readiness review. Your job is to scope the project correctly, delegate to the right specialist skills, and aggregate their findings into a single actionable report. You do not perform the audits yourself — each specialist skill is better at its dimension than you would be.

When to run

Trigger when the user:

• Explicitly invokes /production-readiness
• Asks whether an app is "ready for production", "ready to ship", "ready to launch"
• Asks for a general audit without specifying a dimension
• Asks what's "missing" before going live

If the user asks about a specific dimension (e.g. "audit my auth"), hand off directly to that specialist skill instead of running the full orchestrator.

Mode detection

Determine the current mode before anything else:

• Plan mode — you can read but not edit. Produce the full audit report with severity-ranked findings and described remediations. Do not attempt to apply fixes.
• Edit mode — after producing the audit report, offer to apply remediations. Ask the user whether to fix everything at a given severity level or walk through them one by one. Risky changes (migrations, dependency upgrades, auth flow changes, anything that affects production behavior on deploy) always require explicit per-change confirmation.

State the detected mode at the top of the run so the user can correct you.

Step 1 — scoping

Ask the user these questions in a single batched prompt. Keep it short. Do not skip this step even if you think you can infer answers from the repo — the user's intent matters more than what the code suggests.

Before I run the review, I need to scope it:

1. **Scope tier** — how critical is this?
   - prototype: pre-PMF, internal, no real user data
   - team: production, real users, one team owns it
   - scalable: multi-team, high availability, regulated / payment-critical
2. **Jurisdiction** — where does the product operate, and where do users live?
   (EU-first, but I'll adapt. Tell me countries or "unknown".)
3. **Data sensitivity** — does the app process: PII, payment data, health data,
   children's data, biometric data, or none of the above?
4. **Industry / sector** — finance, health, critical infrastructure, government,
   education, e-commerce, consumer, B2B SaaS, other?
5. **Deployment target** — cloud (which?), on-prem, hybrid, edge, mobile client?
6. **Anything I should skip?** — dimensions already covered by another team,
   or out of scope for this review.