# AI-assisted application shipping checklist

Use this after generation and before production approval. Adapt it to the risk of the application.

## Intent and ownership

- [ ] The change names the actor, protected resource and allowed outcome.
- [ ] Failure behaviour is written down before implementation review.
- [ ] A human owner accepts the production and recovery responsibility.
- [ ] Generated code and suggestions are reviewed as untrusted contributions.

## Identity and data

- [ ] Every privileged operation is authorized at the server boundary.
- [ ] Tenant or organization identity is derived from trusted session state where possible.
- [ ] External identities are bound by provider and stable subject, not email alone.
- [ ] Logs, fixtures, examples and browser bundles contain no credentials or private data.
- [ ] Data retention and deletion behaviour are defined.

## Dependencies and build

- [ ] Dependencies are necessary, reviewed and locked.
- [ ] Install scripts and transitive packages have been considered.
- [ ] A clean checkout produces the expected build.
- [ ] The build runs in a controlled environment with an identified toolchain.
- [ ] The reviewed source can be connected to the deployed artifact.

## Failure and recovery

- [ ] External calls have explicit timeouts.
- [ ] Retried writes are idempotent or safely deduplicated.
- [ ] Partial failure cannot silently leave contradictory state.
- [ ] Invalid input, provider failure and stale sessions are tested.
- [ ] A known-good release can be restored without rebuilding it.
- [ ] Data migrations have a compatible rollback or forward-recovery plan.

## Production evidence

- [ ] Telemetry identifies the release without collecting secrets or full private payloads.
- [ ] Alerts correspond to an action somebody can take.
- [ ] Usage and resource ceilings are enforced outside customer-controlled code.
- [ ] The release record includes source revision, artifact identity and approval evidence.

Reference: https://blinkhost.me/resources/shipping-ai-generated-applications