acedergren/agentic-tools/prod-readiness

git status --short          # must be clean
git log --oneline -5        # confirm recent work is committed
npx vitest run --reporter=dot 2>&1 | tail -5  # must be green

Review this codebase for security vulnerabilities. Write ALL findings to REVIEW_SECURITY.md.
 
Check:
1. OWASP Top 10: injection, broken auth, IDOR, XSS, CSRF, misconfiguration
2. RBAC gaps: endpoints not protected by resolveOrgId() or permission checks
3. Input validation: user input reaching SQL without bind parameters
4. Secrets: hardcoded credentials, missing env var validation at startup
5. Dependency vulnerabilities: npm audit --json | jq '.vulnerabilities | length'
6. Auth flows: session fixation, token validation, logout behavior
7. Webhook security: HMAC validation, SSRF protection in isValidWebhookUrl()
 
Format findings as: [CRITICAL|HIGH|MEDIUM|LOW] Description — File:Line — Suggested fix

Analyze test coverage quality. Write ALL findings to REVIEW_TESTING.md.
 
Check:
1. Run: npx vitest run --reporter=json 2>/dev/null | jq '.testResults[].testFilePath' | wc -l
2. Critical paths with ZERO test coverage (routes, services, repositories)
3. Tests that always pass (vi.fn() calls with no assertions)
4. Missing error path tests (most routes only test happy path)
5. Flaky test patterns (time-dependent, missing afterEach cleanup)
6. Mock coverage: branches of mocked functions not tested
 
Format: [CRITICAL|HIGH|MEDIUM|LOW] Area — Current coverage — Risk — Suggested tests

Review performance and infrastructure readiness. Write ALL findings to REVIEW_PERFORMANCE.md.
 
Check:
1. N+1 queries (loops with SQL inside), missing indexes for frequent queries
2. Unbounded queries: SELECT without LIMIT
3. Memory: unclosed connections, event listeners without removeListener
4. Docker: resource limits in docker-compose.yml, health check configuration
5. Graceful shutdown: SIGTERM handling, connection drain
6. Rate limiting: all public endpoints covered
7. Caching: query results that could be cached
 
Format: [CRITICAL|HIGH|MEDIUM|LOW] Issue — File:Line — Impact — Fix

Review error handling and observability completeness. Write ALL findings to REVIEW_OBSERVABILITY.md.
 
Check:
1. Unhandled rejections: async functions without try/catch in route handlers
2. Error boundaries: frontend error handling for route errors
3. PII in logs: user emails, tokens, or sensitive data in log statements
4. Error response consistency: all errors use the project's error hierarchy
5. Structured logging: all log calls use structured objects, not string concatenation
6. Error aggregation coverage: errors reaching the global handler vs. swallowed in try/catch
7. Health endpoint: does /health check critical dependencies (DB connection)?
 
Format: [CRITICAL|HIGH|MEDIUM|LOW] Issue — File:Line — Risk — Fix

Review code quality and architecture health. Write ALL findings to REVIEW_QUALITY.md.
 
Check:
1. Dead code: exported functions never imported
2. Circular dependencies: run pnpm run check:circular if available
3. TODO/FIXME/HACK density: grep -rn "TODO\|FIXME\|HACK" apps/ packages/ --include="*.ts"
4. Package boundary violations: cross-app imports
5. Inconsistent patterns: code not following established conventions
6. Type safety gaps: any casts, @ts-ignore, non-null assertions (!) in production code
 
Format: [CRITICAL|HIGH|MEDIUM|LOW] Issue — File:Line — Debt impact — Suggested refactor

ls -la REVIEW_*.md   # confirm files being written
wc -l REVIEW_*.md    # track progress

# Production Readiness Report — <date>
 
## Executive Summary
<1 paragraph: ship / don't ship with top 3 reasons>
 
## Quality Gate Results
-Tests: <pass/fail count>
-TypeScript: <clean / N errors>
-Lint: <clean / N warnings>
 
## Critical Blockers (fix before deploy)
## High Priority (fix within first sprint post-launch)
## Medium Priority (fix within first month)
## Low Priority / Tech Debt (backlog)

npx vitest run --reporter=dot 2>&1 | tail -10
cd apps/api && npx tsc --noEmit 2>&1 | tail -5
npm audit --audit-level=high 2>&1 | tail -10

git add REVIEW_*.md PRODUCTION_READINESS_REPORT.md
git commit -m "docs(review): production readiness report $(date +%Y-%m-%d)
 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>"