Workflow · Brew 3 · Espresso

Decide whether a site is safe to launch

Get one honest answer to "can we ship?": check for exposed files, red-team the app, audit its speed, then let a release gate weigh the three verdicts.

The steps, in order.

  1. Step 1

    Web Preflight Checks a site you own before you ship it, without pretending a status code is a finding. A 200 on /.env that matches the app shell is catch-all routing, a blanket 403 is an unanswered question, and a check that never ran becomes INCONCLUSIVE — never a pass. unversioned · shown working 24 Oct 2026

  2. Step 2

    Pre Ship Security Red Team Red-teams a web app you own before launch, in an isolated local environment. Three parallel read-only subagents run fourteen authorization and abuse checks across three groups (identity and authorization; UI and API bypass; browser, network, cache and AI), each with captured evidence, then the fix is rerun against the same check. A check that cannot fail is falsified first, and findings stay on the record even when the pass clears. unversioned

  3. Step 3

    Pre Ship Performance Audit Audits and fixes a web app's real-world speed before launch: four read-only subagents sweep twenty known slow-downs across images, bundles, database queries and servers, then the same mobile Lighthouse protocol, three runs per page, proves each fix before and after. Never removes a feature for a score, never invents a baseline, and asks before touching dependencies, the database or the deploy region. unversioned

  4. Step 4 · pick one

    Release Gate · Chair One answer to “can we deploy?”: runs web-preflight, the security red team and the performance audit in order, keeps three separate verdicts, and computes HOLD or ready with a script instead of judgement. v0.1.0 Release Gate · Ledger The release gate where each lane writes its own rows into one ledger through a validating recorder, so a malformed or missing verdict is rejected the moment it is written. v0.1.0 Release Gate · Validator The cheapest release gate: turns three pre-launch reports that already exist into one posture, HOLD or ready, without running any lane or sending a single request. v0.1.0

ship-sentinel holds git push and deploys until the gate has run.

Install the whole workflow.

npx skills add arm-pz/web-preflight               # step 1
npx skills add arm-pz/pre-ship-security-red-team  # step 2
npx skills add arm-pz/pre-ship-performance-audit  # step 3
npx skills add arm-pz/release-gate-chair          # step 4
npx skills add arm-pz/release-gate-ledger         # step 4, or the line above
npx skills add arm-pz/release-gate-validator      # step 4, or the line above

In Claude Code you can take every skill at once instead: /plugin marketplace add arm-pz/caffeinity-skills, then /plugin install caffeinity@caffeinity-skills. Not sure this is the right workflow? Install caffeinity-routing and describe the outcome; it picks one.

Other workflows.

Need this fitted to your team's own tools and rules? We build custom skills.