Production Readiness Checklist
Reviewed on: 2026-01-21
This checklist is for internal readiness validation. It does not replace legal, security, or compliance reviews.
Status rules:
- PASS means there is repository evidence of the requirement (docs, code, or tests).
- FAIL means evidence is missing or the requirement has not been verified.
- PASS does not imply production configuration or external audits are complete.
- Evidence links are repository-relative and may not resolve in published docs.
Global Gates (Required for Release)
| Item | Status | Evidence |
|---|---|---|
| Threat model completed and reviewed | FAIL | threat-model.md |
| Data classification documented (PII/PHI/PCI/Secrets) | PASS | data-handling.md |
| Data flows and egress reviewed and approved | FAIL | data-flows.md |
| Encryption at rest and in transit validated | FAIL | encryption.md |
| Access control and least privilege verified | FAIL | access-control.md |
| Secrets management configured (no secrets in source control) | FAIL | secrets-management.md, secret-scan.log (artifacts/test-results/secret-scan.log) |
| Logging and alerting configured | FAIL | logging-alerting.md |
| Backup and disaster recovery plan tested | FAIL | disaster-recovery.md |
| Rollback plan documented | PASS | rollback-plan.md |
| Incident response plan documented | PASS | incident-response.md |
| Security testing completed (SAST, dependency scan, DAST where applicable) | FAIL | security-testing.md, dotnet-vulnerable.log (artifacts/test-results/dotnet-vulnerable.log), npm-audit/summary.json (artifacts/test-results/npm-audit/summary.json) |
| Performance/load testing completed for expected traffic | FAIL | performance-testing.md |
| Compliance review completed for US and India targets | FAIL | compliance-review.md |
Identity and Access (PrimusSaaS.Identity.Validator)
| Item | Status | Evidence |
|---|---|---|
| All issuers configured and validated (Auth0/Azure AD/Okta/etc.) | FAIL | None |
| Token validation rules verified (issuer, audience, lifetime, signing keys) | PASS | PrimusSaaS.Identity.Validator.Tests.trx (artifacts/test-results/PrimusSaaS.Identity.Validator.Tests.trx) |
| Tenant isolation configured (if multi-tenant) | FAIL | None |
| Refresh token store is durable (not in-memory) | FAIL | None |
| Rate limiting and brute-force protections enabled | FAIL | None |
| Audit logs for auth events enabled | FAIL | None |
Notifications (PrimusSaaS.Notifications)
| Item | Status | Evidence |
|---|---|---|
| Production email provider configured and tested (SMTP or provider adapter) | FAIL | None |
| SMS provider configured and tested (Twilio/SNS/Azure) | FAIL | None |
| Durable queue configured (not in-memory) | FAIL | None |
| Template validation and fallback behavior verified | PASS | Primus.Notifications.Tests.trx (artifacts/test-results/Primus.Notifications.Tests.trx) |
| Delivery failure handling and retries verified | FAIL | None |
Payments (PrimusSaaS.Payments)
| Item | Status | Evidence |
|---|---|---|
| Stripe webhook validation tested with live signatures | FAIL | Primus.Payments.Tests.trx (artifacts/test-results/Primus.Payments.Tests.trx) (unit tests only) |
| PayPal webhook validation tested with verify API | FAIL | None |
| Idempotency storage configured for production | FAIL | None |
| All required event handlers implemented | FAIL | None |
| Error handling and retry policy verified | FAIL | None |
Storage (PrimusSaaS.Storage)
| Item | Status | Evidence |
|---|---|---|
| Provider configured (Azure Blob/AWS S3/Local) | FAIL | Primus.Storage.Tests.trx (artifacts/test-results/Primus.Storage.Tests.trx) (local provider only) |
| Tenant isolation path template validated | PASS | Primus.Storage.Tests.trx (artifacts/test-results/Primus.Storage.Tests.trx) |
| Pre-signed URL expiry validated | FAIL | None |
| Access control and bucket/container policies verified | FAIL | None |
Logging and Audit (PrimusSaaS.Logging / PrimusSaaS.Audit)
| Item | Status | Evidence |
|---|---|---|
| PII masking rules configured and verified | PASS | PrimusSaaS.Logging.Tests.net8.trx (artifacts/test-results/PrimusSaaS.Logging.Tests.net8.trx) (net8 only) |
| Log sinks configured for production (AppInsights/Serilog/NLog/etc.) | FAIL | None |
| Retention and deletion policies documented | FAIL | None |
| Audit trail coverage validated for sensitive operations | FAIL | None |
Feature Flags (PrimusSaaS.FeatureFlags)
| Item | Status | Evidence |
|---|---|---|
| Production provider configured (not only in-memory) | FAIL | None |
| Rollout rules validated | PASS | PrimusSaaS.FeatureFlags.Tests.trx (artifacts/test-results/PrimusSaaS.FeatureFlags.Tests.trx) |
| Kill switch behavior validated | FAIL | None |
Security Core (PrimusSaaS.Security)
| Item | Status | Evidence |
|---|---|---|
| CVE database pipeline configured (local DB provided) | FAIL | None |
| Analyzer configuration validated for build and CI | FAIL | PrimusSaaS.Security.Tests.trx (artifacts/test-results/PrimusSaaS.Security.Tests.trx) (unit tests only) |
| Secret patterns reviewed and tuned for your codebase | FAIL | None |
| Policy engine thresholds reviewed and approved | FAIL | None |
Security AI (PrimusSaaS.Security.AI)
| Item | Status | Evidence |
|---|---|---|
| Default heuristic detectors reviewed | FAIL | PrimusSaaS.Security.AI.Tests.trx (artifacts/test-results/PrimusSaaS.Security.AI.Tests.trx) (unit tests only) |
| Optional: external AI pipeline configured and validated | FAIL | None |
| Remediation agent usage reviewed (human-in-the-loop) | FAIL | None |
Security Reporting (PrimusSaaS.Security.Reporting)
| Item | Status | Evidence |
|---|---|---|
| Report generation validated (JSON/HTML/SARIF) | PASS | PrimusSaaS.Security.Reporting.Tests.trx (artifacts/test-results/PrimusSaaS.Security.Reporting.Tests.trx) |
| PDF provider configured (Primus.PdfGenerator or equivalent) | FAIL | None |
| Compliance mapping disclaimers included in external reports | PASS | SecurityReportGenerator.cs |
Documents and PDF (PrimusSaaS.Documents / PrimusSaaS.PdfGenerator)
| Item | Status | Evidence |
|---|---|---|
| Document rendering tested with your templates | FAIL | Primus.Documents.Tests.trx (artifacts/test-results/Primus.Documents.Tests.trx) (self-test only) |
| PDF provider configured for production (no placeholder output) | FAIL | None |
| Storage and access controls validated | FAIL | None |
AI Copilot (Primus.AI)
| Item | Status | Evidence |
|---|---|---|
| Provider configured (Azure OpenAI/GitHub Models) | FAIL | None |
| Prompt injection detection configured and validated | PASS | Primus.AI.Tests.trx (artifacts/test-results/Primus.AI.Tests.trx) |
| Token budgets and tenant isolation enforced (if multi-tenant) | PASS | Primus.AI.Tests.trx (artifacts/test-results/Primus.AI.Tests.trx) |
| Data egress review completed for AI requests | FAIL | None |
Banking Modules (Primus.Banking.*)
| Item | Status | Evidence |
|---|---|---|
| In-memory providers replaced with durable implementations | FAIL | Primus.IntegrationTests.trx (artifacts/test-results/Primus.IntegrationTests.trx) (integration tests use in-memory providers) |
| External integrations validated (KYC/AML/Transactions) | FAIL | Primus.IntegrationTests.trx (artifacts/test-results/Primus.IntegrationTests.trx) (no external provider validation) |
| Regulatory requirements reviewed (RBI/PCI as applicable) | FAIL | None |
Insurance Modules (Primus.Insurance.*)
| Item | Status | Evidence |
|---|---|---|
| In-memory providers replaced with durable implementations | FAIL | Primus.IntegrationTests.trx (artifacts/test-results/Primus.IntegrationTests.trx) (integration tests use in-memory providers) |
| External integrations validated (claims, fraud, compliance) | FAIL | Primus.IntegrationTests.trx (artifacts/test-results/Primus.IntegrationTests.trx) (no external provider validation) |
| Regulatory requirements reviewed (IRDAI as applicable) | FAIL | None |
Frontend (React/Angular + CLI)
| Item | Status | Evidence |
|---|---|---|
| Component APIs validated against docs | PASS | catalog.md, generate-docs-catalog.py, angular-docs-usage.json (artifacts/test-results/angular-docs-usage.json), react-docs-usage.json (artifacts/test-results/react-docs-usage.json) |
| Accessibility review completed | FAIL | None |
| Security review for client-side data handling | FAIL | None |
| Build and bundle verified for production | PASS | primus-ui-cli.build.log (artifacts/test-results/primus-ui-cli.build.log), primus-react-ui.build.log (artifacts/test-results/primus-react-ui.build.log), primus-angular-ui.build.log (artifacts/test-results/primus-angular-ui.build.log) |
| Real-user smoke test (React + Angular current + Angular legacy) | PASS | real-user-smoke-2026-01-22.log (artifacts/test-results/real-user-smoke-2026-01-22.log), run-2026-01-22T00-08-18-657Z (artifacts/real-user-smoke/run-2026-01-22T00-08-18-657Z) |
Final Release Decision
| Item | Status | Evidence |
|---|---|---|
| All applicable checkboxes above are complete | FAIL | None |
| Release approved by security and compliance stakeholders | FAIL | None |
| Release approved by engineering leadership | FAIL | None |
If any item is not complete, the release is not production-ready.