Production-readiness checklist for AI-built software

01

Product and ownership

Confirm the repository, branch, licence, dependencies, project owner, acceptance criteria, and responsible operator. Make sure the selected project is the exact target of every write and deployment.

• One canonical repository and branch are visible
• Generated and third-party assets have usable rights
• The team can continue development without hidden source

02

Identity, permissions and secrets

Enforce authentication, authorisation, tenant scope, and privileged actions on trusted server paths. Keep secrets out of browser bundles, source control, logs, and analytics.

• Roles are tested directly
• Provider access uses the minimum required scope
• Session expiry and revoked access fail safely

03

Data and migrations

Review schema constraints, migrations, row-level rules where applicable, retention, export, deletion, backup, and restoration. Test partial failures and retries.

04

Quality and accessibility

Run the repository’s real type checks, tests, linting, production build, and representative browser checks. Verify keyboard use, focus, labels, contrast, zoom, narrow layouts, and meaningful error states.

05

Performance and discovery

Measure real page experience where data exists. Keep important content server-rendered, metadata unique, canonical URLs consistent, sitemap entries intentional, and private surfaces out of the index.

06

Deployment and operations

Verify environment selection, migrations, build identity, deployment URL, health, logs, alerts, quotas, and rollback. A provider accepting an upload does not prove the application works.

07

Release decision

Record the exact commit, checks that passed, skipped checks, known limitations, approvals, and rollback owner. If critical evidence is missing, use “needs attention” rather than “live.”