# The Production Readiness Standard

Nine evidence-based checks with a published scoring method for deciding whether software is safe to release and practical to operate.

A pass is not a feeling. Version 1.0 uses the same evidence states, weights, thresholds, and critical-finding cap on every assessment.

## Published scoring method

### Score evidence

Each criterion is Pass = 2, Warning = 1, Fail = 0. An evidence gap receives 0 until it is verified; it is never silently treated as a pass.

### Apply weights

Authentication 12%, authorization and isolation 15%, secrets 10%, input handling 10%, transactional integrity 13%, performance 8%, testing 10%, observability 10%, compliance and audit surface 12%.

### Apply the critical cap

A confirmed critical failure in identity, isolation, secrets, money movement, or regulated-data evidence caps the overall score at 54 and produces a Hold verdict.

### Assign the verdict

Ready requires 85 or more with every check at its threshold. Conditional release is 70–84 with no critical failure. Anything else is Hold.


## Authentication and access control

Pass threshold: 90

- [ ] Server-side identity verification
- [ ] Session expiry and revocation
- [ ] Privileged access cannot be self-assigned

## Authorization and data isolation

Pass threshold: 95

- [ ] Every sensitive read and write is authorized
- [ ] Tenant boundaries are enforced below the interface
- [ ] Negative cross-user and cross-tenant tests exist

## Secrets and key management

Pass threshold: 90

- [ ] No production-capable secret reaches a client bundle
- [ ] Keys have clear owners and rotation paths
- [ ] CI blocks committed credentials

## Input validation and error handling

Pass threshold: 85

- [ ] Untrusted input is validated at the boundary
- [ ] Errors fail safely without leaking sensitive detail
- [ ] Partial operations have defined recovery behavior

## Payments and transactional integrity

Pass threshold: 95

- [ ] Money state has an authoritative record
- [ ] Webhooks are verified and idempotent
- [ ] Reconciliation detects missed or duplicated events

## Performance and scalability

Pass threshold: 80

- [ ] Critical paths have measurable budgets
- [ ] Queries and queues are bounded under expected load
- [ ] Capacity assumptions are documented

## Automated testing and CI

Pass threshold: 80

- [ ] Critical workflows have meaningful automated coverage
- [ ] Build, test, and migration checks run consistently
- [ ] Failures block release rather than become warnings

## Observability and deployment

Pass threshold: 85

- [ ] Operators can detect and diagnose critical failures
- [ ] Deployment and rollback are repeatable
- [ ] Alerts have owners and actionable context

## Compliance and audit surface

Pass threshold: 90

- [ ] Sensitive data is classified and its residency and egress are known
- [ ] Privileged and sensitive actions leave durable audit evidence
- [ ] Retention, deletion, and regulated-workflow responsibilities are explicit

## Evidence to keep

- Repository and architecture evidence
- Representative environment and deployment configuration
- Critical-workflow test results
- Monitoring, rollback, and operator runbooks