| name | production-readiness |
| description | Enterprise-grade production readiness assessment system for comprehensive codebase evaluation. Use when (1) Evaluating a GitHub repository for production deployment, (2) Conducting pre-launch security and architecture reviews, (3) Assessing technical debt and system reliability, (4) Identifying gaps, vulnerabilities, and incomplete features, (5) Generating actionable remediation plans for engineering teams, (6) Validating scalability, observability, and operational readiness, (7) Reviewing cost optimization and resource efficiency, (8) Auditing compliance with industry standards (SOC2, GDPR, HIPAA, PCI-DSS), (9) Evaluating API contracts and integration stability, (10) Assessing team knowledge transfer and documentation completeness. Performs CTO-level multi-dimensional analysis exceeding top-tier tech company standards. |
Production Readiness Assessment System
Enterprise-grade production readiness evaluation framework that exceeds the standards of top-tier technology companies (Google, Meta, Amazon, Microsoft). This skill conducts exhaustive multi-dimensional analysis of any GitHub repository to determine production deployment readiness.
Overview
Production readiness is not just about working code—it encompasses security posture, operational excellence, scalability architecture, observability infrastructure, compliance requirements, cost efficiency, and team preparedness. This skill evaluates all dimensions systematically.
Quick Start
python scripts/production_readiness.py https://github.com/owner/repo
python scripts/production_readiness.py https://github.com/owner/repo --output report.md
python scripts/production_readiness.py https://github.com/owner/repo --focus security,performance
Assessment Dimensions
This framework evaluates 15 critical dimensions:
| Dimension | Weight | Description |
|---|
| Security | Critical | Vulnerabilities, auth, encryption, secrets management |
| Architecture | Critical | Design patterns, scalability, modularity |
| Reliability | Critical | Error handling, fault tolerance, recovery |
| Performance | High | Latency, throughput, resource efficiency |
| Observability | High | Logging, metrics, tracing, alerting |
| Testing | High | Coverage, quality, automation |
| DevOps | High | CI/CD, IaC, deployment strategies |
| Data Management | High | Migrations, backups, consistency |
| API Contracts | Medium | Versioning, documentation, stability |
| Documentation | Medium | Code docs, runbooks, architecture diagrams |
| Compliance | Variable | Regulatory requirements (GDPR, SOC2, etc.) |
| Cost Optimization | Medium | Resource efficiency, scaling costs |
| Dependencies | Medium | Currency, vulnerabilities, licensing |
| Configuration | Medium | Secrets, environment management |
| Team Readiness | Medium | Knowledge transfer, on-call procedures |
Phase 1: Repository Acquisition & Discovery
Clone Repository
python scripts/clone_repo.py <github_url> --depth full
Initial Discovery
Execute comprehensive project discovery:
python scripts/discovery_analyzer.py <project_path>
Outputs:
- Technology stack identification (languages, frameworks, databases)
- Dependency graph with version analysis
- Architecture pattern detection
- Configuration file inventory
- Environment detection (dev, staging, prod)
- Codebase statistics (LOC, complexity metrics)
Phase 2: Security Assessment
Vulnerability Scanning
python scripts/security_scanner.py <project_path> --level exhaustive
Comprehensive security checks:
Critical Security Controls:
- Secrets detection (API keys, credentials, tokens, certificates)
- Authentication implementation (OAuth, JWT, session management)
- Authorization patterns (RBAC, ABAC, policy enforcement)
- Cryptography usage (algorithms, key management, TLS)
- Input validation and sanitization
- Output encoding and XSS prevention
- SQL injection and command injection patterns
- SSRF and path traversal vulnerabilities
Dependency Security:
- CVE scanning against NVD database
- License compliance verification
- Supply chain attack vectors
- Transitive dependency analysis
Infrastructure Security:
- Container security (base images, privileges)
- Network policies and segmentation
- Secret management infrastructure
- IAM configurations
See references/security-deep-dive.md for OWASP Top 10 detailed analysis.
Phase 3: Architecture Review
Pattern Analysis
python scripts/architecture_analyzer.py <project_path>
Evaluates:
- Separation of Concerns: Layer boundaries, domain isolation
- Coupling Analysis: Dependency injection, interface segregation
- Cohesion Metrics: Module responsibility, feature clustering
- Scalability Patterns: Horizontal scaling readiness, statelessness
- Resilience Patterns: Circuit breakers, bulkheads, retry logic
- Data Flow: Consistency boundaries, transaction management
- API Design: RESTful compliance, GraphQL schema quality
- Event Architecture: Pub/sub patterns, event sourcing
Technical Debt Assessment
python scripts/debt_analyzer.py <project_path>
Identifies:
- Code duplication and dead code
- Complexity hotspots (cyclomatic, cognitive)
- Anti-patterns and code smells
- Outdated patterns and deprecated APIs
- Missing abstractions
- Hardcoded values and magic numbers
Phase 4: Reliability & Fault Tolerance
Error Handling Analysis
python scripts/reliability_analyzer.py <project_path>
Checks:
- Exception handling completeness
- Error propagation patterns
- Graceful degradation implementation
- Timeout configurations
- Retry policies with backoff
- Dead letter queues and error recovery
- Health check endpoints
- Liveness and readiness probes
Chaos Engineering Readiness
Evaluates preparedness for:
- Network partition handling
- Dependency failure scenarios
- Resource exhaustion conditions
- Cascading failure prevention
Phase 5: Performance Analysis
Performance Profile
python scripts/performance_analyzer.py <project_path>
Analyzes:
- Algorithm Complexity: Big-O analysis of critical paths
- Database Queries: N+1 detection, index usage, query optimization
- Caching Strategy: Cache invalidation, TTL policies, hit ratios
- Connection Pooling: Database, HTTP, Redis connections
- Memory Management: Leak detection, garbage collection pressure
- Concurrency Patterns: Thread safety, async/await usage
- Resource Loading: Lazy loading, code splitting, bundling
Scalability Assessment
- Horizontal scaling readiness
- Stateless design verification
- Database sharding strategies
- Queue processing capacity
- Rate limiting implementation
Phase 6: Observability Infrastructure
Logging Analysis
python scripts/observability_analyzer.py <project_path>
Evaluates:
- Structured logging implementation
- Log level appropriateness
- Correlation ID propagation
- PII/sensitive data masking
- Log retention and rotation
- Centralized logging setup
Metrics & Monitoring
- Custom metrics implementation
- RED/USE method coverage
- SLI/SLO definitions
- Alerting thresholds
- Dashboard coverage
Distributed Tracing
- Trace propagation headers
- Span instrumentation
- Service mesh integration
- Trace sampling strategies
Phase 7: Testing Assessment
Coverage Analysis
python scripts/testing_analyzer.py <project_path>
Evaluates:
- Unit Tests: Coverage %, quality, isolation
- Integration Tests: API contracts, database interactions
- E2E Tests: Critical user journeys
- Performance Tests: Load testing, stress testing
- Security Tests: Penetration testing, fuzzing
- Chaos Tests: Failure injection scenarios
Test Quality Metrics
- Test isolation and independence
- Mock/stub appropriateness
- Assertion quality
- Flaky test detection
- Test execution time
Phase 8: DevOps & Deployment
CI/CD Pipeline Review
python scripts/devops_analyzer.py <project_path>
Checks:
- Pipeline configuration and stages
- Build reproducibility
- Artifact management
- Environment parity
- Deployment strategies (blue-green, canary, rolling)
- Rollback procedures
- Feature flags implementation
- Database migration safety
Infrastructure as Code
- Terraform/Pulumi/CloudFormation quality
- State management
- Secret injection
- Environment templating
- Drift detection
Phase 9: Data Management
Database Assessment
python scripts/data_analyzer.py <project_path>
Evaluates:
- Schema design and normalization
- Migration safety and reversibility
- Backup and recovery procedures
- Replication configuration
- Connection pool sizing
- Query performance
- Data retention policies
Data Consistency
- Transaction boundaries
- Eventual consistency handling
- Distributed transaction patterns
- Idempotency implementation
Phase 10: API & Integration Stability
API Contract Analysis
python scripts/api_analyzer.py <project_path>
Checks:
- OpenAPI/Swagger specification
- Versioning strategy
- Backward compatibility
- Rate limiting
- Request/response validation
- Error response standardization
- SDK/client library generation
External Dependencies
- Third-party service reliability
- Fallback implementations
- SLA requirements
- Integration testing coverage
Phase 11: Documentation Assessment
Documentation Completeness
python scripts/docs_analyzer.py <project_path>
Evaluates:
- README quality and completeness
- API documentation (generated/manual)
- Architecture decision records (ADRs)
- Runbooks and playbooks
- Incident response procedures
- On-call documentation
- Code comments and docstrings
- Deployment guides
Phase 12: Compliance Verification
Regulatory Assessment
python scripts/compliance_analyzer.py <project_path> --frameworks soc2,gdpr,hipaa,pci
Checks per framework. See references/compliance-frameworks.md for detailed requirements.
Phase 13: Cost Optimization
Resource Efficiency
python scripts/cost_analyzer.py <project_path>
Evaluates:
- Right-sizing recommendations
- Reserved capacity opportunities
- Spot/preemptible usage potential
- Storage tiering optimization
- Network egress patterns
- Cold start optimization (serverless)
- Auto-scaling configurations
Phase 14: Dependency Health
Dependency Analysis
python scripts/dependency_analyzer.py <project_path>
Checks:
- Version currency (latest vs. installed)
- Security vulnerabilities (CVE database)
- License compatibility
- Maintenance status (abandoned packages)
- Transitive dependency risks
- Bundle size impact
- SBOM generation
Phase 15: Team Readiness
Operational Readiness
python scripts/team_readiness_analyzer.py <project_path>
Evaluates:
- On-call rotation setup
- Incident management procedures
- Knowledge transfer documentation
- Bus factor analysis (code ownership)
- Development workflow documentation
- Onboarding documentation
Report Generation
Comprehensive Report
python scripts/generate_report.py <project_path> --format markdown
Report includes:
- Executive Summary: Overall readiness score, critical blockers
- Dimension Scores: 0-100 rating per dimension with justification
- Critical Issues: Immediate blockers requiring resolution
- High Priority Items: Must-fix before production
- Medium Priority Items: Should address within first month
- Low Priority Items: Technical debt backlog
- Recommendations: Specific, actionable remediation steps
- Effort Estimates: Engineering hours per issue category
- Risk Assessment: Impact/likelihood matrix
- Roadmap: Suggested sequence for addressing issues
Issue Templates
Each finding includes:
Issue: [Specific problem description]
Severity: [Critical/High/Medium/Low]
Dimension: [Security/Architecture/etc.]
Location: [File paths and line numbers]
Impact: [Business and technical impact]
Root Cause: [Why this issue exists]
Remediation: [Step-by-step fix instructions]
Validation: [How to verify the fix]
Effort: [Estimated engineering hours]
References: [Relevant standards and best practices]
Scoring Methodology
Overall Production Readiness Score
Score = Σ(Dimension Score × Weight) / Σ(Weights)
Readiness Levels:
- 90-100: Production Ready - Deploy with confidence
- 75-89: Nearly Ready - Minor issues to address
- 50-74: Significant Work Needed - Major gaps identified
- 25-49: Not Ready - Critical issues blocking deployment
- 0-24: Substantial Rebuild Required - Fundamental problems
Additional Resources
Consult these reference guides for detailed requirements:
references/security-deep-dive.md - OWASP Top 10 and security patternsreferences/scalability-patterns.md - Horizontal scaling and resiliencereferences/observability-standards.md - Logging, metrics, tracing requirementsreferences/compliance-frameworks.md - SOC2, GDPR, HIPAA, PCI-DSS detailsreferences/api-standards.md - RESTful API best practicesreferences/testing-standards.md - Coverage requirements and test qualityreferences/devops-maturity.md - CI/CD and deployment best practices
