How do I run a production-readiness audit?

Audit first, redesign later:

1. Pin one application, repository, branch, commit and the current production deployment — don't mix production evidence with local demo data
2. Inventory (read-only): routes, APIs, roles, jobs, queues, migrations, integrations, data stores and trust boundaries; list the unknowns
3. Verify independently: security (authorization, secrets), database (integrity, migration order, duplicate requests), SRE (real telemetry vs assumptions)
4. Build a capability matrix: need (NOW/LATER/NO) × status (IMPLEMENTED / PARTIAL / MISSING / N/A / UNVERIFIED) × evidence × risk × owner
5. One findings register, severity-sorted: P0 exploitable compromise or data corruption; P1 likely outage or financial-integrity issue; P2 likely performance/maintenance cost; P3 enhancement — each with proof, safe reproduction, fix, test plan and rollback
6. Score maturity 0–5 (absent → ad hoc → basic → managed → measured → continuously validated) only with evidence
7. Fix in small sequential PRs, test on staging, verify every CI gate, then decide on actual results — never on confidence

Rules: a dependency being installed or a README mentioning a service proves nothing; never invent benchmarks or compliance claims; and an audit never means "safe from all attacks". Review cadence: checks per PR, monthly dependency/backup/SLI reviews, quarterly threat-model review, annual DR rehearsal.