Production Readiness Checklist

Engineering gates

  • [x] pnpm test — Vitest unit/integration (903 passed)
  • [x] pnpm test:python — Python services (48 passed)
  • [x] pnpm run audit — master audit (365 checks)
  • [x] pnpm test:e2e:playwright-ci — Playwright smoke + user journeys (25 tests)
  • [x] pnpm test:integrity
  • [x] pnpm layout:check
  • [x] pnpm docs:validate
  • [x] GATE-0–4 scripts in tests/e2e/
  • [x] GATE-5 production go-live gate
  • [x] PKCS#11 HSM adapter (packages/encryption/src/hsmPkcs11.ts, docs/hsm.md)
  • [x] StubPlanner removed — unified ONNX intent planner
  • [x] MOCK_AGENTS removed — agent-pool registry
  • [x] Spam detector error logging + metrics
  • [x] Mobile biometric via expo-local-authentication
  • [x] M2 managed cloud beta (lapse offboard, beta guards, beta-status API, paid checkout UI) — m2ManagedBeta.test.ts
  • [x] M1 deliverability guardrails (suspend, mesh send limits, abuse report, managed lite gate) — m1Deliverability.test.ts
  • [x] M3 outbound deliverability (per-tenant subdomains, bounce/complaint webhooks, suppression, auto-suspend, blocklist monitor) — m3OutboundDeliverability.test.ts
  • [x] Feature flags documented (docs/feature-flags.md)
  • [x] Integration test stack (docker-compose.test.yml)
  • [x] extrax/ excluded from Docker/git builds
  • [x] CONTRIBUTING.md + proprietary LICENSE

Production-only (pending external)

Internal audit playbooks archived under extrax/docs/archive/.

  • [ ] Third-party crypto audit signature (CRYPTO_AUDIT_SIGNED)
  • [ ] Hardware HSM slot validation in production environment
  • [ ] Pen test report (0 Critical / 0 High)
  • [ ] Legal counsel sign-off
  • [ ] SRE sign-off
  • [ ] Load test baselines in staging (k6, p95 < 500ms)

Internal sign-off (dev attestation)

  • [x] Crypto code review + CRYPTO_AUDIT_SIGNED=dev-attestation for CI
  • [x] Hybrid PQ-TLS documented as roadmap (ANOOBOT_KYBER_TLS_ENABLED=false)

License

Proprietary (LICENSE) — not MIT.