production_launch_checklist v1.0.0

name: production_launch_checklist description: Ship an agent-built web app to production without the usual disasters. Run the pre-launch audit, work the checklist across hosting, database, auth, payments, email, domain, secrets, backups, and rollback, then give a go or no-go verdict. Triggers on "launch checklist", "ready for production", "go live checklist", shipping an app an AI agent built.

Production Launch Checklist

Purpose

Agent-built apps fail at launch in predictable ways: leaked keys in the browser bundle, databases with permissions left off, webhooks that trust any caller, no backups, no error alerting, no rollback plan. A 2026 security scan of 1,072 vibe-coded apps found over 300 exposing database keys in client-side JavaScript and 172 letting anyone delete data with no authentication. This skill runs the audit that catches those failures before real users arrive, and produces a checklist with a go or no-go verdict.

Workflow

1. Run the automated audit first. It scans the repo for leaked secrets, checks the built bundle if one exists, and probes the live URL:

bash
   python3 ~/workspace/skills/production-launch-checklist/bin/launch_audit.py \
     --repo /path/to/repo --url https://app.example.com
   

It prints PASS/FAIL per check and a summary. Read references/agent-built-traps.md for the trap catalog behind each check.

1. For each FAIL, apply the fix in references/agent-built-traps.md, then re-run the audit until the automated checks pass.

1. Open assets/deploy-checklist-template.md and copy it to the project root as DEPLOY-CHECKLIST.md. Work through every section. Automated checks are pre-filled by the audit; the dashboard and manual items (backups, payment live mode, error alerting) must be verified by a human following references/verify-recipes.md.

1. Answer the three rollback questions in the template before launch day: how do you roll back the code, how do you restore the database (a code rollback does not undo a migration), and how will you know something is wrong.

1. Deliver the verdict: GO only when every blocking item is checked with real evidence. Anything still open is a no-go with the reason named.

Output Contract

The deliverable is DEPLOY-CHECKLIST.md in the project root, filled out, with:

• An audit summary section pasted from the launch_audit.py output.
• Every blocking item checked, each with the evidence that closed it (command output, dashboard screenshot note, URL).
• The three rollback answers written out, not assumed.
• A final line: Verdict: GO or Verdict: NO-GO with the open items named.

A checklist with 40 blocking items gets ignored, so keep the blocking list short and real. If an item does not apply to this stack, mark it N/A with one line saying why.

Operating Rules

1. Automated checks passing does not mean launch is safe. The dashboard items (managed backups, payment live keys, alert routing) are the ones agent-built apps most often skip, and no script can check them for you.
2. Any secret found in the client bundle or git history counts as leaked. Deleting the file later does not fix it. Rotate the key, then remove it.
3. Do not launch on a hosting or database free tier that pauses or throttles under real use. Confirm the plan's limits and backup retention before launch.
4. Test payments in live mode with a real small charge, not just test mode.
5. If the app has no error alerting, the launch is not ready. "A user will email me" is not a monitoring strategy.
6. Quality beats cadence. If the checklist fails, the verdict is NO-GO and that is the correct outcome.