Skip to main content

Productionalize workflow

Parallel, map-reduce style analysis that produces readiness reports and agent-ready remediation tasks.

Phases​

  1. Gather Signals — Detect stack, package manager, CI/CD, tests, Docker/IaC
  2. Researcher — Web search for compliance standards (SOC 2, OWASP ASVS, NIST SSDF, SRE)
  3. Scanner — Optional SAST (Semgrep, Gitleaks, Trivy)
  4. Planner — Create analysis subtasks per category
  5. Workers — Parallel category execution (code, web, scan sources)
  6. Aggregator — Synthesize findings into Markdown
  7. Prompt Generator — Agent-ready remediation tasks

Categories:

  • Core: security, soc2, code-quality, dependencies, testing, configuration
  • Dynamic (auto): container-security, infrastructure-as-code, ci-cd

Outputs (.ship-spec/outputs/):

  • report-<timestamp>.md — Production Readiness Report
  • task-prompts-<timestamp>.md — Agent-ready remediation tasks
  • Symlinks: latest-report.md, latest-task-prompts.md