Skip to main content
Reference — generated from the toolkit

Source of truth: toolkit/gates/production-readiness.md. Edit it there; this page is regenerated on build.

Gate: Production Readiness

Transition: Flow-state → Production Owner: DevOps (with Security + Support) Runs: per release

Purpose​

Define what "production-ready" means so it is checked, not hoped for. "Production-ready" means production-ready and secure, operable, and supportable — you never blast production to find out.

Entry criteria​

  • Refinement Exit passed (or, for a loop iteration, the change is merge-gate green).
  • Release evidence pack auto-assembled by the pipeline.

Exit criteria​

  • Security gates green (DAST + provenance checks before Production; zero unremediated critical/high).
  • SLOs live with alerting; golden signals and tracing in place (OpenTelemetry).
  • Rollback tested; feature-flag / rollback conventions followed.
  • Runbooks written and handed to Support.
  • Monitoring dashboards in place.
  • Release comms drafted and approved (changelog + audience-split release notes).

Evidence required​

  • Release evidence pack: SBOM, gate results, coverage, threat-model reference, DPIA status, human authorisations, provenance summary.

Automated vs human​

CheckAutomated in CI/CDHuman sign-off
Security gates, SBOM, provenance✅—
Rollback tested✅DevOps
Runbooks accepted—Support
Go / no-go—DevOps + Security

Sign-off & waiver​

  • Signs: DevOps, Security; Support accepts the runbooks.
  • May waive: nothing security- or rollback-related is waivable. A deploy is an "authorise the irreversible" action — a named human always authorises.
  • Waiver record: logged in toolkit/registers/ with expiry.