Production readiness is a claim about operations. It means real users can rely on a bounded service and a named team can detect, contain, recover, and learn from failure. The origin of the code—AI-generated, manually written, or mixed—does not change that responsibility.

Use the app launch checklist for the broader launch sequence. Use the seven gates below when the question becomes: can we responsibly operate this version?

Document the primary user flows, architecture boundaries, data stores, background jobs, third-party services, AI model calls, deployment environments, and administrative paths. A new maintainer should know where state changes and which services can block the core job.

Record generated areas that have not been fully understood. Unknown code is not automatically defective, but unknown responsibility is a release risk. Critical behavior needs an owner who can inspect and change it.

List roles and permissions for every sensitive object and action. Test allowed and denied cases at the server boundary. Include administrative interfaces, exports, support impersonation, service accounts, and background jobs.

Verify session expiry, account recovery, access revocation, and organization boundaries. A hidden button, guessed URL, or client-side role flag must not grant access.

Classify what the app collects and why. Trace data through input, storage, model providers, analytics, logs, support tools, export, retention, backup, and deletion. Minimize fields and service access.

Test migrations and restores with representative but safe data. Confirm that deletion behavior matches the product promise across primary storage, derived records, and operational systems. Domain-specific privacy or regulatory obligations require qualified review.

Tests should cover the value path and the dangerous paths: invalid input, cross-account access, repeated actions, timeouts, partial integration failure, model refusal or malformed output, destructive operations, and migrations. Link each critical requirement to a test or review artifact.

Run from a clean environment and in production-like configuration. Mark what cannot be automated and assign a manual release check. Never convert an untested assumption into “covered by AI.”

Define the signals that show whether the core job is healthy: success and failure counts, latency, queue depth, integration errors, model failure categories, and user-reported blockers. Logs should include enough context to debug while excluding secrets and unnecessary personal data.

Every critical alert needs an owner, threshold rationale, and response path. Test that an alert arrives and points to a useful investigation. A dashboard nobody watches is not incident detection.

Inventory packages, APIs, models, databases, storage, domains, certificates, email, payments, and deployment services. Record owners, plans, quotas, rate limits, data terms, failure behavior, and exit paths. Pin and update dependencies through a controlled process.

AI features need cost and abuse controls. Set request limits, spending visibility, input boundaries, fallback behavior, and a way to disable expensive or unsafe paths without taking the entire product offline.

Trace a version from approved source to production. Run migrations safely, verify the live core path, and know how to roll back code or disable a feature. Test backups by restoring them. Preserve a communications path for affected users and a clear incident owner.

Define what happens after launch: monitoring window, support route, issue triage, decision review, and ownership transfer. Production readiness ends only when operations begin.

Heyviber’s dated June 2026 launch-readiness record separated 24 local visual regression checks from 20 production smoke checks, with all recorded checks passing in that run. The artifact does not certify the entire platform. It demonstrates the useful shape of evidence: environment, surface, expected result, actual result, and date.

A production review should extend that shape to access, data, recovery, dependencies, and monitoring. The numbers are not a reusable target; the explicit contract is.

If you are still validating the first workflow, use the narrower MVP launch checklist and constrain exposure before applying a production label.

The checklist synthesizes NIST SSDF 1.1, OWASP ASVS 5.0, GitHub security documentation, and the dated local Heyviber QA artifact, checked 16 August 2026. It cannot replace a threat model, penetration test, legal review, accessibility audit, platform review, or domain-specific assessment where those are required.