DevRunbook-Public/content/playbooks/production-readiness-audit/playbook.yaml

apiVersion: devrunbook.io/v1alpha1
kind: Playbook
metadata:
  id: release.production-readiness
  slug: production-readiness-audit
  version: 1.0.0
  title: Production Readiness Audit
  summary: Evaluate deployability, security, migrations, recovery, monitoring, documentation and release evidence.
  category: audits
  tags:
  - production
  - readiness
  - release
  lifecycle: reviewed
  riskTier: high
  authors:
  - name: DevRunbook Core Team
  license: MIT
package:
  files:
  - path: prompt.md
    role: template
    digest: true
    exportByDefault: false
  - path: README.md
    role: documentation
    digest: true
    exportByDefault: false
  - path: CHANGELOG.md
    role: changelog
    digest: true
    exportByDefault: false
  - path: examples/minimal.yaml
    role: example
    digest: true
    exportByDefault: false
  - path: evaluations/static-structure.yaml
    role: evaluation
    digest: true
    exportByDefault: false
spec:
  type: run-pack
  intent:
    problem: A repository can pass local tests while still lacking safe deployment, migration, recovery, monitoring and operator
      evidence.
    outcome: Produce a release decision with blocking findings, evidence gaps and a sequenced path to production readiness.
    whenToUse:
    - Before a first production deployment.
    - Before promoting a release candidate.
    - After major architectural or deployment changes.
    whenNotToUse:
    - When the goal is only a narrow code review.
    - When no target deployment assumptions can be established.
  modes:
  - inspect
  - plan
  defaultMode: inspect
  autonomy:
    min: observe
    max: plan
    default: plan
  inputs:
  - key: targetEnvironment
    label: Target environment
    description: Describe hosting platform, persistence, reverse proxy, network and operational ownership.
    type: multiline
    required: true
    sensitive: false
    includeInOutput: true
  - key: releaseCandidate
    label: Release candidate
    description: Provide the branch, tag, commit or version being assessed.
    type: string
    required: true
    sensitive: false
    includeInOutput: true
  - key: requiredDimensions
    label: Required dimensions
    description: Select readiness dimensions to assess.
    type: multiselect
    required: true
    sensitive: false
    includeInOutput: true
    default:
    - build
    - tests
    - security
    - deployment
    - migrations
    - backup-restore
    - observability
    - documentation
    options:
    - build
    - tests
    - security
    - deployment
    - migrations
    - backup-restore
    - observability
    - documentation
    - performance
    - licensing
  - key: riskTolerance
    label: Risk tolerance
    description: Choose how strictly incomplete evidence should block release.
    type: enum
    required: true
    sensitive: false
    includeInOutput: true
    default: conservative
    options:
    - conservative
    - balanced
    - experimental
  compatibility:
    repositoryRequired: true
    languages: []
    frameworks: []
    packageManagers: []
    databases: []
    deploymentTypes: []
    requiredProfileCapabilities: []
    incompatibleConditions: []
  guardrails:
  - id: read-only
    severity: blocking
    text: Do not modify application code, deployment settings, data or external systems.
  - id: evidence-gate
    severity: blocking
    text: Do not mark a dimension ready without executed or directly observable evidence.
  - id: no-production-tests
    severity: blocking
    text: Do not run destructive or load tests against production systems.
  - id: release-honesty
    severity: blocking
    text: Separate Passed, Failed, Not run and Not applicable. Do not convert unknown evidence into a pass.
  - id: migration-critical
    severity: blocking
    text: Treat unvalidated destructive migrations or unrecoverable data changes as blocking.
  workflow:
  - id: context
    title: Establish release context
    instruction: Identify exact candidate, target environment, architecture, data stores, deployment path and operator ownership.
    required: true
  - id: gate-inventory
    title: Build gate inventory
    instruction: Map selected dimensions to existing commands, documentation and evidence.
    required: true
  - id: static-review
    title: Review static readiness
    instruction: Inspect configuration, containerization, migration, backup, health, logging, secrets and release documentation.
    required: true
  - id: safe-validation
    title: Execute safe available checks
    instruction: Run non-destructive build, test and packaging checks appropriate to the candidate and environment.
    required: true
  - id: gap-analysis
    title: Classify readiness gaps
    instruction: Classify blockers, high-risk gaps, advisory improvements and evidence unavailable.
    required: true
  - id: decision
    title: Produce release decision
    instruction: State Go, Conditional Go or No-Go with precise conditions and staged remediation.
    required: true
  - id: run-pack
    title: Produce readiness Run Pack
    instruction: Export report, gate matrix, remediation plan and release handoff checklist.
    required: true
  validation:
    commandRoles:
    - lint
    - typecheck
    - unit-test
    - integration-test
    - end-to-end-test
    - build
    - smoke-test
    - migration-status
    - security-scan
    - dependency-audit
    checks:
    - id: candidate
      type: assertion
      description: The exact candidate identifier and target environment are recorded.
      blocking: true
      evidence: Report header.
    - id: gate-evidence
      type: artifact
      description: Each readiness gate has Pass, Fail, Not run or Not applicable with evidence.
      blocking: true
      evidence: Gate matrix.
    - id: no-writes
      type: assertion
      description: No production or repository changes were made.
      blocking: true
      evidence: Task report.
    - id: decision
      type: artifact
      description: Release decision follows directly from gate evidence and risk tolerance.
      blocking: true
      evidence: Decision section.
    - id: remediation
      type: artifact
      description: Every blocker has an owner-shaped action, validation and dependency.
      blocking: true
      evidence: Remediation plan.
  completion:
    criteria:
    - Exact candidate and deployment assumptions are recorded.
    - Every selected readiness dimension has explicit status and evidence.
    - Blocking gaps and unknowns are not hidden.
    - Release decision and conditions are justified.
    - Remediation is sequenced into actionable follow-up playbooks.
  failurePolicy:
    onValidationFailure: Investigate failures caused by the current work, repair them when they remain within scope, rerun
      the affected validation and report any genuine blocker without claiming success.
    onAmbiguity: Use repository evidence and existing conventions for minor choices. For material product ambiguity, preserve
      current behavior, document the decision needed and stop before an irreversible change.
    onMissingContext: Inspect the repository for the missing non-sensitive context. Never invent commands, credentials, production
      behavior or validation results. Report what remains unavailable.
    onOutOfScopeCause: Explain the evidenced out-of-scope cause, avoid broad unrelated changes and provide the smallest safe
      follow-up recommendation.
    onExternalDependencyUnavailable: Use a safe local fixture only when it preserves the behavior under test. Otherwise report
      the blocked validation and do not claim the external path succeeded.
    onUnableToReproduce: Record attempted reproduction and environment evidence. Do not make speculative production changes;
      provide the narrowest next diagnostic action.
  reporting:
    sections:
    - id: decision
      title: Release decision
      required: true
      description: Go, Conditional Go or No-Go with concise justification.
    - id: context
      title: Candidate and environment
      required: true
      description: Exact version/commit and deployment assumptions.
    - id: gates
      title: Readiness gate matrix
      required: true
      description: Status, evidence and notes for every selected dimension.
    - id: blockers
      title: Blocking and high-risk findings
      required: true
      description: Issues that prevent or materially endanger release.
    - id: remediation
      title: Remediation plan
      required: true
      description: Sequenced actions, validation and suggested playbooks.
    - id: limitations
      title: Evidence limitations
      required: true
      description: Checks not run, permission constraints and unverified assumptions.
  template:
    main: prompt.md
    partials: []
  exports:
    prompt: true
    markdown: true
    runPack: true
    agentsSuggestion: false
quality:
  reviewStatus: technical-reviewed
  testedStacks: []
  knownLimitations:
  - A read-only audit cannot replace an isolated restore test or live operational rehearsal when those are unavailable.
  evaluationCaseIds:
  - production-readiness-audit.static-structure