Gate FastAPI Services for Production Readiness

Required inputs

Have these details available before following the usage instructions.

• FastAPI repository or relevant code excerpts, including route definitions, dependencies, middleware, schemas, auth logic, and background workers.
• Deployment topology and runtime context, such as ASGI server, containers, ingress, configuration names, secret-loading design without values, databases, queues, and external services.
• API contracts, expected consumers, validation rules, error semantics, and compatibility expectations.
• Security requirements, data sensitivity, authentication and authorization model, and known threat or compliance constraints.
• Observability evidence, including logs, metrics, tracing, health checks, alerts, dashboards, and runbooks if available.
• Testing evidence, CI status, dependency information, migration or configuration changes, and rollback or recovery procedures.
• Release objective, risk tolerance, decision owner, and any known deadlines or constraints.

How to use this Skill

When to use:
- Before launching a new or materially changed FastAPI service.
- When reviewing ASGI deployment, workers, lifespan hooks, environment configuration, authentication, authorization, validation, or observability before release.
- When a team needs a structured readiness record for security, SRE, platform, or release-owner review.
- When comparing evidence-backed release options such as approve, approve with conditions, hold, or remediate first.

When not to use:
- Do not use as a substitute for executing deployment, penetration testing, load testing, or incident response.
- Do not use when the service is not FastAPI or the available evidence does not include enough service, deployment, and operational context.
- Do not use to approve production release automatically; consequential deployment decisions require accountable human authorization.
- Do not use to invent compliance, security, uptime, or performance claims that are not supported by supplied evidence.

Instructions:
1. Open AMO-P-000232, supply its required inputs, and run the complete source Prompt in Codex. Review its evidence register and limitations before using the result. Use the authorized repository environment; a text-provider relay cannot inspect or change the repository for you. Inspect repository instructions and existing changes first, preserve unrelated work, and keep edits, commands and external actions within explicit authorization.
2. Inventory the service boundary: endpoints, request and response models, authentication paths, authorization checks, dependency injection, background workers, startup and shutdown behavior, storage, queues, and external integrations.
3. Classify evidence as supplied fact, inference, assumption, missing information, or uncertainty. Require concrete repository, configuration, deployment, test, or operational evidence for factual claims.
4. Assess security and data boundaries, including input validation, auth bypass risks, secret handling, sensitive data exposure, CORS, rate limiting where relevant, dependency risk, and least-privilege access.
5. Review production-operability readiness: health checks, readiness and liveness behavior, worker lifecycle, timeout behavior, retries, idempotency, error handling, logging, metrics, alerts, ownership, runbooks, and incident escalation.
6. Review release and rollback readiness, including database or schema compatibility, environment parity, feature flags if applicable, deployment sequencing, rollback conditions, stop criteria, and post-release monitoring.
7. Produce a prioritized findings register with severity, evidence reference, affected component, risk mechanism, proposed remediation, verification check, and release impact.
8. Separate recommendations from authorization. Flag production, security, privacy, customer-impacting, or irreversible decisions for accountable human review.

Expected output:
A FastAPI production-readiness brief containing a service boundary map, evidence ledger, risk findings, security and operational readiness assessment, test and observability gaps, release and rollback gates, and an evidence-qualified recommendation such as Ready, Ready with conditions, Hold, or Not enough evidence.

Constraints and boundaries:
- Do not claim that tests, scans, deployments, or runtime checks were executed unless the user supplies evidence of those results.
- Do not expose secrets, credentials, sensitive personal data, or proprietary implementation details beyond what is necessary for the review.
- Do not provide legal, compliance, or security certification; provide evidence-based readiness analysis for qualified human review.
- Keep proposed fixes bounded and linked to observed risks; avoid broad rewrites unless evidence shows they are necessary.
- Preserve uncertainty where evidence is incomplete or conflicting.
- Begin read-only. Do not run production probes, load tests, migrations, restarts, or deployments through this readiness review. Record actual command results separately from proposed checks; a readiness recommendation does not authorize release.

Based on an Amo.ng Prompt

FastAPI Production Readiness Gate

Open the linked Prompt to read the instructions this Skill is based on.

Completion criteria

Complete when:
- Every material finding cites supplied code, configuration, test, deployment, or operational evidence, or is explicitly labeled as an assumption or gap.
- The output distinguishes service readiness from release authorization.
- Security, deployment, observability, rollback, and ownership checks are covered or explicitly marked not applicable with justification.
- High-risk issues include concrete verification steps and owner-facing decision gates.
- The final recommendation follows from the evidence and does not overstate confidence.