dsg-production-readiness-validator

Files (4)

• README.md
• SKILL.md
• package.json
• skill.ts

SKILL.md (first lines)

# DSG Production Readiness Validator

Complete production readiness validation for **DSG ONE / ProofGate Control Plane**.

Covers infrastructure health, security posture, compliance readiness, governance functionality, evidence collection, audit trails, and regulatory compliance.

***

## When to invoke this skill

| Intent                              | Use this skill                              |
| ----------------------------------- | ------------------------------------------- |
| "Is DSG production-ready?"          | ✅ Yes — comprehensive validation            |
| "Prepare for production GO/NO-GO"   | ✅ Yes — run full checklist                  |
| "Generate compliance evidence pack" | ✅ Yes — evidence collection                 |
| "Verify governance gates work"      | ✅ Yes — gate evaluation tests               |
| "Check audit trail functionality"   | ✅ Yes — audit readiness                     |
| "Verify evidence collection"        | ✅ Yes — CCVS L1-L5 checks                   |
| "Prepare for SOC2/ISO27001 audit"   | ✅ Yes — compliance mapping                  |
| "Quick health check (5 min)"        | ❌ Use infrastructure-deployer verify action |

***

## Production Readiness Validation Framework

### Level 0: Infrastructure Health (15 min)

```
Checklist:

☐ AWS CloudFormation
  ✓ Stack status: CREATE_COMPLETE or UPDATE_COMPLETE
  ✓ 75+ resources created
  ✓ No failed or in-progress resources
  ✓ Stack outputs available (ALB DNS, ARNs, endpoints)
  ✓ Estimated monthly cost < $5,000 (dev/staging)
  ✓ Estimated monthly cost < $50,000 (production)

☐ ECS Cluster
  ✓ Cluster status: ACTIVE
  ✓ Running tasks = desired count (≥1)
  ✓ Task CPU/memory utilization healthy
  ✓ No crashed tasks or restart loops
  ✓ Task definition deployed successfully
  ✓ Service endpoint responding

☐ Application Load Balancer
  ✓ ALB status: active
  ✓ Listeners: 80 (HTTP) + 443 (HTTPS)
  ✓ Target groups healthy (all targets passing)
  ✓ Response times < 500ms (p99)
  ✓ Error rate < 0.1%
  ✓ Can reach /api/health → 200 OK
  ✓ Can reach /api/readiness → ready: true

☐ Database (Supabase / RDS)
  ✓ Connection successful
  ✓ Schema migrations applied
  ✓ CCVS tables exist (audit, evidence, compliance)
  ✓ RLS policies enabled
  ✓ Backups configured
  ✓ Query performance baseline established

☐ Secrets & Encryption
  ✓ All secrets in Secrets Manager or vault
  ✓ No hardcoded secrets in code
  ✓ KMS encryption keys active
  ✓ IAM roles follow least-privilege
  ✓ Certificate valid (TLS, not self-signed)
  ✓ API keys rotatable

☐ Monitoring & Logging
  ✓ CloudWatch logs collecting
  ✓ X-Ray tracing enabled
  ✓ CloudTrail audit logging active
  ✓ VPC Flow Logs enabled
  ✓ Custom metrics published
  ✓ Alarms configured for critical metrics
```

### Level 1: Security Posture (15 min)

```
Checklist:

☐ Network Security
  ✓ VPC configured (10.0.0.0/16)
  ✓ Public/private subnets separated
  ✓ Security groups restrict inbound to ports 80, 443
  ✓ NAT Gateway for private egress
  ✓ VPC Flow Logs enabled
  ✓ Network ACLs locked down
  ✓ No security group allowing 0.0.0.0/0 on privileged ports

☐ API Security
  ✓ CORS headers configured
  ✓ Rate limiting enabled
  ✓ Request body size limits enforced
  ✓ SQL injection protection active
  ✓ XSS protection headers present
  ✓ CSRF tokens enabled (if applicable)
  ✓ API key rotation policy documented

☐ Data Protection
  ✓ All data encrypted at rest (KMS)
  ✓ All data encrypted in transit (TLS 1.2+)
  ✓ S3 buckets: block public access
  ✓ S3 buckets: versioning enabled
  ✓ S3 buckets: lifecycle policies configured
  ✓ DynamoDB: point-in-time recovery enabled
  ✓ Database: automated backups (daily minimum)

☐ Access Control
  ✓ IAM users use temporary credentials
  ✓ No root user API keys
  ✓ MFA enabled on AWS console
  ✓ Service roles follow least-privilege
  ✓ Cross-account access denied by default
  ✓ Resource-based policies audited

From tdealer01-crypto/tdealer01-crypto-dsg-control-plane, MIT.

More from tdealer01-crypto/tdealer01-crypto-dsg-control-plane