Prototype to Production: AI App Deployment Checklist

# Bad: AI-generated test that tests nothing meaningful
def test_calculate_price():
    result = calculate_price(100)
    assert result is not None  # This tells us nothing

# Good: Test that validates actual business rules
def test_calculate_price_with_discount():
    # 20% discount for orders over $50
    assert calculate_price(100, discount_tier="gold") == 80.0

def test_calculate_price_rejects_negative():
    with pytest.raises(ValueError, match="Price cannot be negative"):
        calculate_price(-10)

def test_calculate_price_applies_tax():
    # Tax should be applied AFTER discount
    result = calculate_price(100, discount_tier="gold", tax_rate=0.1)
    assert result == 88.0  # (100 * 0.8) * 1.1

# Test that the API layer correctly talks to the service layer
async def test_create_order_integration():
    # Setup: seed test database
    user = await create_test_user()
    product = await create_test_product(price=50.0)

    # Act: call the actual API endpoint
    response = await client.post("/api/orders", json={
        "user_id": user.id,
        "product_id": product.id,
        "quantity": 2
    })

    # Assert: check the full chain worked
    assert response.status_code == 201
    order = response.json()
    assert order["total"] == 100.0
    assert order["status"] == "pending"

    # Verify side effects
    db_order = await get_order(order["id"])
    assert db_order is not None
    assert db_order.user_id == user.id

// Test the complete user flow
test('user can complete checkout', async ({ page }) => {
  await page.goto('/products');
  await page.click('[data-testid="add-to-cart-btn"]');
  await page.click('[data-testid="checkout-btn"]');
  await page.fill('#email', '[email protected]');
  await page.fill('#card-number', '4242424242424242');
  await page.click('[data-testid="pay-btn"]');
  await expect(page.locator('.order-confirmation')).toBeVisible();
});

# .github/workflows/test.yml
name: Test Suite
on: [push, pull_request]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run unit tests
        run: pytest tests/unit/ --cov=src --cov-fail-under=80
      - name: Run integration tests
        run: pytest tests/integration/
      - name: Run E2E tests
        run: npx playwright test

# AI often generates code like this - DANGEROUS
@app.post("/api/query")
async def query(request: Request):
    body = await request.json()
    result = db.execute(f"SELECT * FROM users WHERE name = '{body['name']}'")
    return result

# Production version with proper validation
from pydantic import BaseModel, validator

class QueryRequest(BaseModel):
    name: str

    @validator('name')
    def validate_name(cls, v):
        if len(v) > 100:
            raise ValueError('Name too long')
        # Strip any SQL injection attempts
        if any(char in v for char in [';', '--', "'", '"']):
            raise ValueError('Invalid characters in name')
        return v.strip()

@app.post("/api/query")
async def query(request: QueryRequest):
    result = db.execute(
        "SELECT * FROM users WHERE name = :name",
        {"name": request.name}
    )
    return result

# Scan dependencies for known vulnerabilities
npm audit
pip-audit
snyk test

# Keep dependencies updated
npm update
pip install --upgrade -r requirements.txt

# N+1 Problem: 1 query for orders + N queries for users
orders = db.query(Order).all()
for order in orders:
    user = db.query(User).filter(User.id == order.user_id).first()
    order.user_name = user.name  # This fires a query PER order

# Fixed: Eager loading gets everything in 2 queries
orders = db.query(Order).options(joinedload(Order.user)).all()
for order in orders:
    order.user_name = order.user.name  # No extra query

import redis
from functools import wraps

cache = redis.Redis(host='localhost', port=6379)

def cached(ttl=300):
    """Cache function results in Redis for `ttl` seconds."""
    def decorator(func):
        @wraps(func)
        async def wrapper(*args, **kwargs):
            cache_key = f"{func.__name__}:{hash(str(args) + str(kwargs))}"
            cached_result = cache.get(cache_key)
            if cached_result:
                return json.loads(cached_result)
            result = await func(*args, **kwargs)
            cache.setex(cache_key, ttl, json.dumps(result))
            return result
        return wrapper
    return decorator

@cached(ttl=600)
async def get_product_catalog():
    """Cached for 10 minutes since catalog rarely changes."""
    return await db.query(Product).filter(Product.active == True).all()

from celery import Celery

celery_app = Celery('tasks', broker='redis://localhost:6379')

# Instead of sending email synchronously during request
@app.post("/api/orders")
async def create_order(order: OrderCreate):
    db_order = await save_order(order)

    # Offload email to background worker
    send_order_confirmation.delay(db_order.id, order.email)

    return {"order_id": db_order.id, "status": "created"}

@celery_app.task
def send_order_confirmation(order_id: str, email: str):
    """Runs in a background worker, not blocking the API."""
    order = get_order(order_id)
    send_email(to=email, subject="Order Confirmed", body=render_template(order))

from slowapi import Limiter
from slowapi.util import get_remote_address

limiter = Limiter(key_func=get_remote_address)

@app.post("/api/login")
@limiter.limit("5/minute")  # Prevent brute force
async def login(request: Request, credentials: LoginRequest):
    return await authenticate(credentials)

@app.get("/api/data")
@limiter.limit("100/minute")  # Prevent API abuse
async def get_data(request: Request):
    return await fetch_data()

import structlog

logger = structlog.get_logger()

@app.post("/api/orders")
async def create_order(order: OrderCreate, user: User = Depends(get_current_user)):
    logger.info(
        "order_created",
        user_id=user.id,
        order_total=order.total,
        product_count=len(order.items),
        payment_method=order.payment_method
    )

    try:
        result = await process_order(order)
        logger.info("order_processed", order_id=result.id, duration_ms=result.processing_time)
        return result
    except PaymentError as e:
        logger.error(
            "payment_failed",
            user_id=user.id,
            error_code=e.code,
            error_message=str(e)
        )
        raise HTTPException(status_code=402, detail="Payment failed")

{
  "event": "order_created",
  "user_id": "usr_123",
  "order_total": 99.50,
  "product_count": 3,
  "timestamp": "2026-03-13T10:30:00Z",
  "level": "info"
}

from opentelemetry import trace
from opentelemetry.sdk.trace import TracerProvider
from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter

# Initialize tracing
provider = TracerProvider()
provider.add_span_processor(BatchSpanProcessor(OTLPSpanExporter()))
trace.set_tracer_provider(provider)
tracer = trace.get_tracer(__name__)

@app.post("/api/orders")
async def create_order(order: OrderCreate):
    with tracer.start_as_current_span("create_order") as span:
        span.set_attribute("order.total", order.total)

        with tracer.start_as_current_span("validate_inventory"):
            await check_inventory(order.items)

        with tracer.start_as_current_span("process_payment"):
            payment = await charge_card(order.payment)

        with tracer.start_as_current_span("save_order"):
            result = await save_to_database(order, payment)

        return result

Alert fires → On-call engineer wakes up → Manual investigation
→ Root cause analysis → Manual fix → Write postmortem

Alert fires → AI Agent automatically collects context
           → AI analyzes probable root causes
           → AI recommends fix with confidence score
           → Human approves (or AI auto-executes low-risk fixes)
           → AI generates postmortem draft

# Complete CI/CD pipeline
name: Deploy
on:
  push:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci
      - run: npm test -- --coverage
      - run: npm run lint
      - run: npx playwright test

  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm audit --audit-level=high
      - run: npx semgrep --config=auto

  deploy:
    needs: [test, security]
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to staging
        run: deploy --env staging
      - name: Run smoke tests
        run: npm run test:smoke -- --target=staging
      - name: Deploy to production (canary)
        run: deploy --env production --canary 10%
      - name: Monitor canary metrics
        run: check-metrics --duration 15m --threshold error_rate<0.01
      - name: Full rollout
        run: deploy --env production --canary 100%

1. Requirements Analysis
   ├── Write clear spec / PRD
   ├── Define acceptance criteria
   └── Identify security and performance requirements

2. Architecture Design
   ├── Choose tech stack (consider AI tool support)
   ├── Design system architecture
   ├── Set up project context (CLAUDE.md, design docs)
   └── Configure tool integrations (MCP servers, APIs)

3. Rapid Prototyping [AI: 80%+ automation]
   ├── Generate prototype with AI
   ├── Validate core functionality
   └── Collect feedback, refine spec

4. Feature Development [AI: 50-70% automation]
   ├── Break requirements into subtasks
   ├── Assign to AI agents for execution
   ├── Checkpoint reviews + human refinement
   └── Code review

5. Quality Assurance [AI: 40-60% automation]
   ├── Unit + integration + E2E test coverage
   ├── Security scanning (SAST + DAST)
   ├── Performance benchmarking
   └── Accessibility audit

6. Deployment [Primarily toolchain automation]
   ├── CI/CD pipeline setup
   ├── Canary / blue-green deployment
   ├── Monitoring and alerting configuration
   └── Rollback plan

7. Operations [AI: 30-50% automation]
   ├── Observability (logs + metrics + traces)
   ├── Automated incident response
   ├── Regular security audits
   └── Continuous optimization

8. Iteration [Loop back to step 1]
   ├── New requirements from production feedback
   └── Update context and documentation