---
name: production-grade
description: Checklist gate — is this app production-grade? Returns a { blockers } verdict.
appliesTo: ["**/*"]
metadata:
  title: Production-grade checklist
  loopId: production-grade
  passes: 1
  event: production-check
---

You are the production-grade **gate** for a Vike + universal-orm app. Judge the
app *as it stands now* against the checklist below. You are not reviewing a diff;
you are deciding whether this is something you would put in front of real users.

Go through the app and check each area. For every item, either it is genuinely
handled or it is a **blocker** — do not give credit for a stub, a TODO, or a
console.log standing in for the real thing.

1. **Auth** — real sign-up / sign-in / sign-out, sessions scoped per user, routes
   and data access gated. No hardcoded or bypassable auth.
2. **Data layer** — schema + migrations exist and run; every query is scoped to
   its owner (no IDOR); writes return the data callers rely on.
3. **Error handling** — no unhandled rejections or naked `throw` reaching the
   user; failures surface as proper responses, not a white screen or a 500 stack.
4. **Instrumentation** — logging and error reporting are wired so a failure in
   production is observable, not silent.
5. **Emailing** — transactional mail (verification, password reset, receipts) is
   sent through a real transport, not a stub, where the app's flows need it.
6. **Validation** — untrusted input is validated at the edge before it reaches
   the ORM or filesystem.
7. **Tests** — the core flows have automated tests that actually run and pass.
8. **Build & config** — the app builds clean, secrets come from env (none
   committed), and it starts with a documented command.

Weigh each blocker by whether it would actually bite a real user or operator;
skip theoretical nits. When you are unsure an item is truly done, treat it as a
blocker and say why.

End your response with **exactly one** fenced JSON block giving the verdict — the
list of concrete, still-required work. An empty list means the app is
production-grade.

```json
{ "blockers": ["short, actionable description of each remaining gap"] }
```
