vt-c-promote¶

Sandbox-to-production promotion with production-readiness audit. Moves code from prototype/sandbox to deployable partition after security, quality, and performance checks.

Plugin: core-standards
Category: Governance
Command: /vt-c-promote

/vt-c-promote — Sandbox-to-Production Promotion¶

Unified Repo Workflow: /vt-c-pd-6-handoff → /vt-c-1-bootstrap → /vt-c-promote → /vt-c-2-plan → /vt-c-3-build

Replaces manual copy-paste of prototype code into production paths.

Purpose¶

The "Promotion Path" from the Unified Repo Governance model. When code needs to move from a sandbox partition (e.g., 04-prototyp/) to the deployable partition (src/), this skill:

Audits the code for production readiness (security, quality, performance)
Moves files to the correct deployable location
Updates imports and references
Adds traceability links (SPEC- references)
Verifies nothing is broken

When to Use¶

After /vt-c-pd-6-handoff when moving prototype components to production
When sandbox experiments are ready for production
Anytime code needs to cross from sandbox to deployable partition

Prerequisites¶

.repo-manifest.yaml must exist (defines partitions)
Source files must be in a sandbox partition path
Target must be a deployable partition path

Invocation¶

/vt-c-promote                                    # Interactive — scan sandbox, ask what to promote
/vt-c-promote 04-prototyp/components/Dashboard   # Promote specific component
/vt-c-promote --dry-run                          # Show what would happen without moving

Execution Steps¶

Step 1: Review Gate Check¶

Before promoting any code, verify that code review has passed.

Read .review-gate.md from the project root

If missing:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
BLOCKED: No Review Gate Found
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Promotion to production requires a passing code review.
Run /vt-c-4-review first, then retry /vt-c-promote.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

STOP. Do not proceed with promotion.

If status: FAIL:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
BLOCKED: Review Gate FAILED
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

The last code review did not pass.
Fix the issues, re-run /vt-c-4-review, then retry /vt-c-promote.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

STOP. Do not proceed with promotion.

If status: PASS: Display confirmation and continue.

✓ Review gate: PASS — proceeding with promotion.

Step 1.5: Test Gate Check¶

Also verify that automated tests have passed:

Read .test-gate.md from the project root

If missing:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
BLOCKED: No Test Gate Found
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Promotion requires passing tests. Run /vt-c-4-review first, then retry /vt-c-promote.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

STOP. Do not proceed with promotion.

If status: FAIL:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
BLOCKED: Test Gate FAILED
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Tests are failing. Fix tests and re-run /vt-c-4-review before promoting.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

STOP. Do not proceed with promotion.

If status: PASS: Display confirmation and continue.
```
✓ Test gate: PASS — tests verified.
```

Step 2: Load Manifest¶

Read .repo-manifest.yaml to identify: - partitions.sandbox.paths — source locations - partitions.deployable.paths — target locations

If no manifest:

No .repo-manifest.yaml found. Cannot determine partition boundaries.
Run /vt-c-repo-init to initialize unified repo governance.

Step 3: Identify Promotable Code¶

Scan sandbox paths for code files.

04-prototyp/
├── src/app/
│   ├── shared/components/
│   │   ├── vt-button/vt-button.component.ts    ← promotable
│   │   └── vt-card/vt-card.component.ts        ← promotable
│   ├── features/
│   │   ├── dashboard/dashboard.component.ts     ← promotable
│   │   └── auth/login.component.ts              ← promotable
│   └── core/
│       └── theme/vt-preset.ts                   ← promotable
└── package.json              ← reference only (not promoted directly)

Step 4: Select Components to Promote¶

If no argument provided, use AskUserQuestion:

Found promotable code in 04-prototyp/:

Which components should be promoted to src/?

Options (multi-select): - components/Dashboard.tsx — Dashboard layout with charts - components/UserProfile.tsx — User profile card - components/LoginForm.tsx — Authentication form - lib/api-client.ts — API client wrapper - All of the above

Step 5: Pre-Promotion Audit¶

Invoke sub-agents to audit selected files for production readiness:

4a: Security Audit¶

Invoke security-sentinel agent with the selected files:

Check for: - Hardcoded API keys, tokens, passwords - XSS vulnerabilities (innerHTML, dangerouslySetInnerHTML, Angular [innerHTML] without DomSanitizer) - SQL injection patterns - Insecure HTTP calls (http:// instead of https://) - Missing input validation - CORS misconfiguration

4b: Code Quality Audit¶

Invoke code-simplicity-reviewer agent:

Check for: - TODO, FIXME, HACK, XXX comments - console.log, console.debug statements - Mock data / hardcoded test data - Commented-out code blocks - Missing error handling - Missing TypeScript types (any usage)

4c: Performance Audit¶

Invoke performance-oracle agent:

Check for: - N+1 query patterns - Missing memoization on expensive computations - Unbounded list rendering (no virtualization) - Missing loading states - Synchronous operations that should be async - Bundle size concerns (large imports)

Step 6: Show Audit Results¶

Pre-Promotion Audit Results
═══════════════════════════════════════════

Security:    ⚠ 1 warning
  - components/LoginForm.tsx:42 — Missing CSRF token in form submission

Quality:     ❌ 3 issues
  - components/Dashboard.tsx:15 — console.log("debug data")
  - lib/api-client.ts:8 — TODO: add error handling
  - components/Dashboard.tsx:67 — Mock data: const users = [...]

Performance: ✅ Clean

═══════════════════════════════════════════

3 issues must be resolved before promotion.
Fix now, or promote with warnings?

Use AskUserQuestion: - Fix issues first (Recommended) — address findings, then re-run /vt-c-promote - Promote with warnings — proceed despite warnings (issues tracked) - Cancel — abort promotion

Step 7: Execute Promotion¶

For each selected file:

Determine target path:

04-prototyp/components/Dashboard.tsx → src/components/Dashboard.tsx
04-prototyp/lib/api-client.ts → src/lib/api-client.ts

Create target directory if it doesn't exist
Move file from sandbox to deployable partition
Update imports in the moved file:
Adjust relative import paths for new location
Replace mock data imports with real data references

Add traceability comment at the top of each moved file:

// Promoted from 04-prototyp/ — SPEC-002: Dashboard Layout
// Original: 04-prototyp/components/Dashboard.tsx

Update references in other files that imported the moved file

Step 8: Post-Promotion Verification¶

# Run type check
npx tsc --noEmit

# Run tests if they exist
npm test

# Run linter
npx eslint src/

Report results:

Post-Promotion Verification:
  TypeScript: ✅ No errors
  Tests:      ✅ All passing
  Lint:       ⚠ 2 warnings (non-blocking)

IMPORTANT: If tests fail after promotion, BLOCK — do not proceed to Step 9.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
BLOCKED: Post-Promotion Tests Failed
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Promotion moved files but tests now fail. This must be fixed before
recording the promotion as complete.

Failing tests: [list]

Fix the issues (likely import paths or missing dependencies),
then re-run the verification step.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Step 9: Record Promotion¶

Update .repo-manifest.yaml with promotion history:

promotions:
  - date: "2026-02-13T10:00:00"
    spec_id: SPEC-002
    files:
      - from: 04-prototyp/components/Dashboard.tsx
        to: src/components/Dashboard.tsx
      - from: 04-prototyp/lib/api-client.ts
        to: src/lib/api-client.ts
    audit_result: warnings_accepted
    audit_findings: 1

Step 10: Display Summary¶

Promotion Complete!

Promoted 2 files from 04-prototyp/ → src/
  ✅ components/Dashboard.tsx → src/components/Dashboard.tsx
  ✅ lib/api-client.ts → src/lib/api-client.ts

Traceability: SPEC-002 (Dashboard Layout)
Verification: TypeScript ✅ | Tests ✅ | Lint ⚠

Remaining in sandbox: 2 files
  - components/UserProfile.tsx
  - components/LoginForm.tsx

Next steps:
  /vt-c-promote                  — promote more components
  /vt-c-complete                 — mark current specs done
  /vt-c-repo-audit               — verify governance compliance

Dry Run Mode (`--dry-run`)¶

Shows what would happen without moving any files:

DRY RUN — No files will be moved

Would promote:
  04-prototyp/components/Dashboard.tsx → src/components/Dashboard.tsx
  04-prototyp/lib/api-client.ts → src/lib/api-client.ts

Would add traceability: SPEC-002
Would update 3 import references

Run /vt-c-promote without --dry-run to execute.

vt-c-promote¶

/vt-c-promote — Sandbox-to-Production Promotion¶

Purpose¶

When to Use¶

Prerequisites¶

Invocation¶

Execution Steps¶

Step 1: Review Gate Check¶

Step 1.5: Test Gate Check¶

Step 2: Load Manifest¶

Step 3: Identify Promotable Code¶

Step 4: Select Components to Promote¶

Step 5: Pre-Promotion Audit¶

4a: Security Audit¶

4b: Code Quality Audit¶

4c: Performance Audit¶

Step 6: Show Audit Results¶

Step 7: Execute Promotion¶

Step 8: Post-Promotion Verification¶

Step 9: Record Promotion¶

Step 10: Display Summary¶

Dry Run Mode (--dry-run)¶

Dry Run Mode (`--dry-run`)¶