菜单
Audit the project against its production/deploy checklist — required secrets, migrations, store/push config, security toggles, and the verification gate. Use before a release, a deploy, or when asked if the app is production-ready.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | production-readiness |
| description | Audit the project against its production/deploy checklist — required secrets, migrations, store/push config, security toggles, and the verification gate. Use before a release, a deploy, or when asked if the app is production-ready. |
Walk these and report status (✅/⚠️/❌) with the file/setting for each gap.
JWT_SECRET ≥ 32 chars high-entropy · ENCRYPTION_KEY real openssl rand -base64 32
(the .env.example value is an all-zero dev placeholder — must change).DATABASE_URL, REDIS_URL (prod uses a password), S3_*.CORS_ORIGIN = explicit allow-list (wildcard throws in production — intended).APPLE_ROOT_CA_CERTS (Apple Root CA - G3 PEM) or webhooks reject.GOOGLE_PUBSUB_AUDIENCE + GOOGLE_PUBSUB_SERVICE_ACCOUNT_EMAIL
(Pub/Sub guard fails closed in prod without them) + GOOGLE_PLAY_PACKAGE_NAME.APPLE_IAP_SKIP_VERIFICATION must NOT be true (it throws in prod anyway).bun run prisma:deploy (= prisma migrate deploy, applies
pending migrations in order). On an existing prod DB, baseline with
prisma migrate resolve --applied <name> rather than reset.prisma db seed) or created via admin.EXPO_PUBLIC_API_URL points at prod /api.aps-environment = production (driven by EXPO_PUBLIC_ENV), APNs key
uploaded to Firebase, Push capability on the App ID.DELETE /api/v1/auth/account)
— App Store requires it for apps that create accounts.POST_NOTIFICATIONS flow works.@SkipThrottle()./verify (tsc + build + lint + test) for both packages — all green..github/workflows/ci.yml).PaymentTransaction.amount is Decimal and populated; verify store payloads
actually carry price in your config.relationMode = "prisma" (no native FKs) — acceptable but note for data integrity./subscription/upgrade path.Scaffold a new mobile screen and/or API call in the Expo app following this project's conventions (design-system components, navigation, TanStack Query api/core, theme, i18n). Use when adding or extending a mobile screen or backend call.
Change the Prisma schema and create an incremental migration the standard Prisma way (migrate dev for local, migrate deploy for prod), then regenerate the client and seed. Use whenever editing backend/prisma/schema.prisma or adding/altering DB tables, columns, indexes, or enums.
Scaffold a new NestJS endpoint/module/route in the backend following this project's conventions (module + controller + service + dto + constants, auth/roles, pagination, prisma, tests). Use when adding or extending a backend API.
Add a new environment variable to the backend the right way — boot-time validation, .env.example documentation, and typed access. Use when introducing any new backend config/secret/flag.
Diagnose and fix this project's known environment, toolchain, build, and runtime traps (bun/node shell errors, ESLint version/commit failures, TS path/CSS errors, IAP/auth 500s, FCM iOS errors). Use when a command fails, a commit is blocked, or the app errors in a way that matches a known symptom.
Write unit tests following this repo's conventions for backend (NestJS, ts-jest, *.spec.ts) and mobile (jest-expo, *.test.ts, RNFB/native mocking). Use when adding test coverage for services, guards, pipes, hooks, stores, or utilities.