preflightlisted

# Preflight — Production Readiness Audit This skill runs the review a project needs before it goes to production. Core assumption: **no AI-generated code, configuration, security mechanism, or legal text ships to production unverified.** "It works" and "it's ready to ship" are different claims. Generated code usually works in the happy path; the purpose of this audit is to find the unhappy ones. Write the report in the language the user is writing in. ## Workflow ### 1. Establish scope Get to know the project before auditing it — checks aimed at the wrong stack produce noise: - Language/framework: `package.json`, `composer.json`, `requirements.txt`, `go.mod`, `Gemfile` - Deploy target: Dockerfile, CI configuration, `.github/workflows`, deploy scripts - Project type: public website, internal panel, API, mobile backend - Data layer: own database, a BaaS like Supabase/Firebase, or both - Does it collect user data, take payments, manage sessions **Establish which environment your evidence comes from.** Almost every audit runs against a developer machine, and a local checkout is not the system going live. Before drawing any conclusion from data, settings, or a running service, work out what you are actually looking at: - Read `.env`, `.env.local`, `.env.production` and whatever config the project loads: which database host, which API endpoints, which mode (`NODE_ENV`, `APP_ENV`, `DEBUG`) - A `localhost`, `127.0.0.1`, `*.local`, or a Docker service name as the database hos