CHECKLIST — Release Readiness

Tick every box with proof (command + output in TEST_REPORT.md) before release. Phase 1 requires Phase 0 + Phase 1 sections.

Phase 0 — Foundation

pnpm install --frozen-lockfile — 0 deprecated warnings
pnpm -r build — all packages green on clean clone
pnpm -r typecheck + lint --max-warnings=0 — green
PROJECT_MEMORY.md initialized from template
Next.js shell builds (marketing + dashboard + healthz)
Prisma migrate init applies + db:seed idempotent (requires SEED_ADMIN_PASSWORD)
docker compose up — web + mariadb (+ valkey optional) healthy ≤60s
scripts/grep-gates.sh — PASS (no TODO, no any, no dangerouslySetInnerHTML, no Math.random for secrets)

Phase 1 — Core 5 Features Fully

Design System

Tokens + Tailwind theme + shadcn vendored + dark/light
Header/footer/mobile nav + dashboard shell with module-aware nav
Original hero illustrations committed (webp, no hotlinks)

Features (each: UI + API + DB + validation + authZ + tests + docs)

F01 Shorten + alias + validation (201, 400, 409, 429)
Redirect GET /:code → 302, expiry, password, bot-filter, count+1
QR GET /v1/qr → PNG/SVG, size gate
Analytics GET /v1/analytics/overview → totalClicks increments, breakdowns
Auth (register/login/me) + API keys (create show once, Bearer use, revoke)
Shorten→redirect→analytics e2e green (real UA + bot excluded)
IDOR: user A cannot read/edit B's links/keys
Rate limits 429 + Retry-After (auth 10/min, links 60/min)
CSV export injection-safe (,=+-@ escaped)

Blogs (5 Production)

5 MDX articles (1,200-2,200 words each) + hero/cover/thumb webp per post
Frontmatter validated (slug, SEO, author, tags, related, FAQ)
TOC + related 3 + internal 4 + JSON-LD Article + Breadcrumb
/blog, /blog/[slug], /blog/category/[slug], /blog/rss.xml, sitemap.xml includes slugs
Remaining 45 stubs listed in blog/content/_stubs.json

API & Docs

OpenAPI 3.1 at /v1/docs/openapi.json + Swagger UI at /v1/docs
All endpoints in 04_API_PLATFORM.md documented with: request/response, errors, rate limits, permissions
Runnable examples for 5 groups: curl + JS (fetch) + TS (SDK) + Python + PHP + Go (tested against local stack)
Contract test: every documented route exists & validates
Errors RFC9457 application/problem+json with stable codes
145 unimplemented features return 501 not_implemented with upgrade CTA + RFC9457

Security & Quality

Headers: CSP nonce, HSTS, nosniff, Referrer-Policy (verified via scripts/security-smoke.sh)
Secrets: gitleaks clean (history + zip), .env.example only placeholders
Dest URL validator: http/https only, no credentials, SSRF guard unit-tested
any = 0, dangerouslySetInnerHTML = 0, TODO/FIXME = 0 (grep gates)
@axe-core/playwright — 0 serious/critical on home, pricing, blog, dashboard
SEO: SSR/SSG, canonical, OG images, robots.txt, security.txt, trailing-slash 301
Perf: first-load JS <200KB gzip marketing, fonts self-hosted

Deployment

cp .env.example .env + Zod boot validation (fail closed on invalid)
Docker prod image non-root, no-new-privileges, cap_drop: ALL, pinned @sha256: digest
docker compose -f docker/docker-compose.prod.yml up -d --wait → all healthy ≤120s
bash scripts/smoke.sh 8/8 + bash scripts/security-smoke.sh PASS (local)
NGINX hardened (nginx -t in CI, client_max_body_size, timeouts)

Docs & Memory

PROJECT_MEMORY.md current to final commit (Current Phase, Versions, Health Log, Routes, Env)
TEST_REPORT.md with pasted logs for every gate above
DEPLOYMENT.md + MAINTENANCE.md + SBOM.spdx.json included
docs/ all 15 files committed

Phase 2-4 (Not Required for Phase 1 Release)

Phase 2 features + teams + audit logs + 15 blogs
Phase 3: 50 FREE complete + 30 blogs
Phase 4: 100 PAID + billing + 50 blogs + webhooks
k6 1000 RPS p95 <100ms, Lighthouse budgets, ZAP baseline, semgrep, trivy SBOM — run on Oracle host before final Enterprise cutover

Final Zip

bash scripts/build-zip.sh  # yas-enterprise-v3-production.zip (~250MB)
# Contains: source, prisma/migrations+seeds, .env.example, docs/, PROJECT_MEMORY.md,
#           TEST_REPORT.md, DEPLOYMENT.md, docker/, nginx/, scripts/, SBOM.spdx.json
# Excludes: node_modules, .git, caches
gitleaks detect --source yas-enterprise-v3-production.zip  # clean

Release is NOT complete if any Phase 1 box is unchecked.