workflow-launch-ready — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited workflow-launch-ready (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Degree of freedom: MIXED. Skip/condition judgment [HIGH freedom]; sweep order and quality-gate NO-GO block [LOW freedom — run exactly].
The pre-launch sequence. Run once, get the complete picture across SEO, PWA, performance, quality, and post-launch monitoring.
Local dirty-tree → merge-ready PR is `workflow-release-prep`, not this.
Copy this checklist and tick items as you go:
- [ ] Step 1: SEO: title, description, OG, canonical, JSON-LD, sitemap
- [ ] Step 2: PWA: manifest, service worker, offline; or note the skip
- [ ] Step 3: Bundle size: first-load JS 200 KB gzip or less
- [ ] Step 4: i18n: no hardcoded strings; skip if single locale, noted
- [ ] Step 5: Quality gate: a NO-GO verdict blocks launch
- [ ] Step 6: Deploy and smoke right after the production deploy
- [ ] Step 7: Day-1 iteration loop scheduled; launch checklist with verdict| Skill | Owns |
|---|---|
| workflow-launch-ready (this) | Pre-launch sweep: SEO, PWA, bundle, i18n, gate, deploy, day-1 loop |
workflow-quality-gate | Pre-release gate across red-team, security, bundle, performance, unit tests |
workflow-release-prep | Local working tree to a merge-ready PR against main; never merge |
deploy-verify | Post-deploy smoke test across browser, Sentry, Supabase, Langfuse, public web |
iterate-post-launch | Live app feedback loop: read signals, rank issues, fix, verify, repeat |
enhance-web-seo | Audit and fix SEO: meta tags, structured data, sitemap, canonicals |
enhance-pwa | Add or upgrade PWA features: manifest, service worker, offline, install prompt |
Scope: first public launch of a Next.js + Supabase app; single locale; PWA wanted. Sweep: SEO + PWA + bundle + quality-gate; skip i18n with a note. Verdict: NOT READY — quality-gate NO-GO on missing RLS onprofiles. Handoff: fix RLS, re-run Gate 2, thendeploy-verify; do not treat this asworkflow-release-prep.
workflow-release-prep; npm package → deploy-npm1. SEO → enhance-web-seo (meta, OG, JSON-LD, sitemap, canonicals)
2. PWA → enhance-pwa (manifest, service worker, offline, install)
3. BUNDLE → audit-bundle-size (first-load JS ≤ 200 KB goal)
4. i18n → audit-i18n (if multi-locale: natural copy, no hardcoded strings)
5. QUALITY GATE → workflow-quality-gate (red-team + security + perf + unit tests)
6. DEPLOY → deploy-verify (post-deploy smoke after the release)
7. ITERATE → iterate-post-launch (close loop on day-1 production signals)Skip steps 2 (PWA) and 4 (i18n) if not applicable — note the skip in the checklist.
Read the enhance-web-seo skill and follow it.Every public page needs: <title>, meta description, OG tags, canonical URL, structured data (JSON-LD), and a sitemap entry.
Read the enhance-pwa skill and follow it.Required: Web App Manifest + service worker with offline fallback, and no installability errors in Chrome DevTools → Application → Manifest (Lighthouse 12 removed its PWA score).
Read the audit-bundle-size skill and follow it.Target: first-load JS ≤ 200 KB gzip. All routes lazy-loaded.
Read the audit-i18n skill and follow it.Priority: no hardcoded user-facing strings, natural copy in all supported locales, correct date/number/currency formatting.
Read the workflow-quality-gate skill and follow it.This step runs test-red-team, audit-security, audit-performance, and test-unit internally. A NO-GO verdict from this step blocks launch.
Read the deploy-verify skill and follow it.Run immediately after the production deploy. Confirm no new Sentry errors, schema is healthy, and critical flows work.
Read the iterate-post-launch skill and follow it.Schedule this 24–48 hours after launch. Pull first real-user signals and prioritize the first fix pass.
## Launch Readiness — [App] — [Date]
### Verdict: LAUNCH-READY / LAUNCH WITH CONDITIONS / NOT READY
| Step | Status | Open items |
|------|--------|------------|
| SEO | ✅ / ⚠️ / ❌ | [list] |
| PWA | ✅ / ⚠️ / ❌ / skipped | [list] |
| Bundle size | ✅ / ⚠️ / ❌ | [X KB] |
| i18n | ✅ / ⚠️ / skipped | [list] |
| Quality gate | GO / NO-GO / CONDITIONAL | [see gate report] |
| Deploy smoke | ✅ / ❌ | [notes] |
| Day-1 plan | scheduled / not yet | [date] |
### Blockers (must fix before launch)
[list]
### Post-launch backlog (fix within 48 h)
[list]~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.