prodpilot 1.0.0__tar.gz

prodpilot-1.0.0/.cursor/mcp.json

@@ -0,0 +1,9 @@
+{
+  "mcpServers": {
+    "prodpilot": {
+      "type": "stdio",
+      "command": "${workspaceFolder}/.venv/Scripts/prodpilot.exe",
+      "args": ["serve"]
+    }
+  }
+}

prodpilot-1.0.0/.github/workflows/release.yml

@@ -0,0 +1,98 @@
+name: Release
+
+# Publishes to PyPI when a version tag such as v1.0.0rc1 is pushed. It uses
+# PyPI's trusted publishing, so no PyPI token is stored anywhere: the project
+# must first be registered on PyPI with this repository and this workflow as
+# its trusted publisher, and the pypi environment created in the repository.
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Refuse a tag that does not match the package version
+        run: |
+          version=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])")
+          if [ "v$version" != "$GITHUB_REF_NAME" ]; then
+            echo "tag $GITHUB_REF_NAME does not match version $version in pyproject.toml"
+            exit 1
+          fi
+
+      - name: Build
+        run: |
+          python -m pip install build
+          python -m build
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          # A re-run of a tag whose files are already on PyPI passes instead of
+          # failing, because a version can never be uploaded twice.
+          skip-existing: true
+          # Each file is signed as built by this workflow, so anyone can check
+          # where it came from.
+          attestations: true
+
+  # The GitHub release is made from the tag, so a tag push is all it takes to
+  # publish. Its notes are the section this version already has in CHANGELOG.md.
+  release:
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Take the notes for this version out of the changelog
+        run: |
+          python - <<'PY' > notes.md
+          import os, pathlib, re
+          version = os.environ["GITHUB_REF_NAME"].lstrip("v")
+          text = pathlib.Path("CHANGELOG.md").read_text(encoding="utf-8")
+          found = re.search(rf"^## {re.escape(version)}(?:,[^\n]*)?\n(.*?)(?=^## |\Z)",
+                            text, re.S | re.M)
+          print((found.group(1).strip() if found else
+                 f"ProdPilot {version}.").strip())
+          PY
+          test -s notes.md
+
+      - name: Create the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          case "$GITHUB_REF_NAME" in
+            *rc*|*a[0-9]*|*b[0-9]*) pre="--prerelease" ;;
+            *) pre="" ;;
+          esac
+          gh release create "$GITHUB_REF_NAME" dist/* \
+            --title "ProdPilot $GITHUB_REF_NAME" --notes-file notes.md $pre

prodpilot-1.0.0/.github/workflows/tests.yml

@@ -0,0 +1,78 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        # Linux runs the Docker tests against the runner's daemon. macOS and
+        # Windows runners have no Docker daemon, so those tests skip there, as
+        # they do on any machine without one. Windows is here because ProdPilot
+        # is developed on it, so it is the platform most users of this code see.
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python: ["3.11", "3.12", "3.13", "3.14"]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Give git an identity for the commits the tests make
+        run: |
+          git config --global user.name "ProdPilot CI"
+          git config --global user.email "ci@prodpilot.invalid"
+          git config --global init.defaultBranch main
+
+      - name: Install
+        run: python -m pip install -e . pytest pytest-asyncio
+
+      - name: Test
+        run: python -m pytest -q
+
+  # What a user gets from pip, checked on all three systems: the wheel installs
+  # outside the repository, the command runs, and the shipped model loads.
+  package:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Build the wheel and the source distribution
+        run: |
+          python -m pip install build
+          python -m build
+
+      - name: Install the wheel outside the repository and load the shipped model
+        shell: bash
+        run: |
+          python -m venv "$RUNNER_TEMP/user"
+          bin="$RUNNER_TEMP/user/bin"
+          [ -d "$bin" ] || bin="$RUNNER_TEMP/user/Scripts"
+          "$bin/python" -m pip install --quiet dist/*.whl
+          cd "$RUNNER_TEMP"
+          "$bin/prodpilot" --help
+          "$bin/python" -c "from prodpilot import scoring; m = scoring.load(); print('model loaded, operating point', m.threshold)"
+
+      - uses: actions/upload-artifact@v4
+        if: matrix.os == 'ubuntu-latest'
+        with:
+          name: dist
+          path: dist/

prodpilot-1.0.0/.gitignore

@@ -0,0 +1,35 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+build/
+dist/
+
+.venv/
+venv/
+env/
+
+.pytest_cache/
+.coverage
+htmlcov/
+
+.env
+.env.*
+!.env.example
+
+.DS_Store
+Thumbs.db
+
+# Vendored JavaScript parser. The dist rule above matches acorn's build
+# directory, which would drop the parser itself from both the repository and
+# the wheel and ship a package that cannot parse anything.
+!src/prodpilot/vendor/node_modules/acorn/dist/
+!src/prodpilot/vendor/**
+
+# Phase 5 dataset. Manifest and cache only, never committed.
+data/
+
+# Retired and superseded data files, kept locally rather than deleted.
+backup/
+
+# Devin project-local MCP config: holds a path that only works on one machine
+.devin/mcp_config.local.json

prodpilot-1.0.0/.vscode/mcp.json

@@ -0,0 +1,9 @@
+{
+  "servers": {
+    "prodpilot": {
+      "type": "stdio",
+      "command": "${workspaceFolder}/.venv/Scripts/prodpilot.exe",
+      "args": ["serve"]
+    }
+  }
+}

prodpilot-1.0.0/CHANGELOG.md

@@ -0,0 +1,120 @@
+# Changelog
+
+## 1.0.0, 20 September 2026
+
+The first stable release. What changed is what the project now promises, how
+widely it is tested, and two faults that running the suite on Windows for the
+first time uncovered.
+
+### Fixed
+
+- A Docker daemon in Windows container mode was reported as available, and
+  every build then failed with "no matching manifest for windows/amd64" and no
+  classification. ProdPilot now says the daemon runs Windows containers and
+  that its images are Linux, which names what to change.
+- On Windows, the credential file was reported as readable by other accounts
+  when the only entries left were SYSTEM, the Administrators group and OWNER
+  RIGHTS. The first two read every file on the machine whatever a file's
+  entries say, and they survive breaking inheritance on an account that is an
+  administrator, so the warning could not be acted on; they are now expected
+  and named in the report. OWNER RIGHTS is not an account at all, but a bound
+  on what the file's owner may do, so it is not counted. Any other account on
+  the file is still a fault.
+
+### Added
+
+- [docs/stability.md](docs/stability.md): what 1.x keeps stable. The five tool
+  names and their fields, the rule identifiers, the commands and their flags,
+  where credentials live, and the gate's three conditions. It also says what is
+  not promised, including the score a given project receives, the number of
+  rules and the model's estimates.
+- The test workflow runs on Windows as well as Linux and macOS, so the platform
+  ProdPilot is developed on is covered by its own suite.
+- The packaged wheel is installed outside the repository on all three systems,
+  and the shipped model is loaded there, so what `pip install prodpilot` gives
+  a user is checked on each of them.
+- Files published to PyPI carry attestations, so anyone can check that they
+  were built by this repository's release workflow.
+
+### Known limits
+
+These are unchanged from the release candidates and are stated here rather than
+dropped:
+
+- Supported stacks are Node.js with Express and React with Vite; the only
+  deployment target is Render.
+- How often a live agent's delegated fix passes verification has not been
+  measured across the six delegated rules.
+- Not yet observed end to end on a real service: the deploy tool called by an
+  IDE agent, and the CI/CD workflow ProdPilot writes redeploying a live service
+  from GitHub Actions. The nine stages and the generated workflow are covered
+  by the suite against scripted APIs.
+- Render's own automatic deploy stays on, so a push can start a second deploy
+  beside the workflow's; the workflow waits for the newer one.
+
+## 1.0.0rc2, 20 September 2026
+
+A packaging and documentation release. The code is the same as 1.0.0rc1.
+
+### Fixed
+
+- The description on PyPI said the release was not on PyPI yet, because that
+  was true when 1.0.0rc1 was built. A description can only be corrected by
+  publishing again, which is what this version is for.
+
+### Changed
+
+- The install table names pip beside pipx and uv, and says why pipx and uv are
+  recommended for a command line tool.
+- Tagging now publishes on its own: the release workflow creates the GitHub
+  release after the upload, with the notes this changelog already holds for the
+  version, the wheel and the sdist attached, and a candidate marked as a
+  pre-release. An upload skips files already on PyPI, so a re-run of a tag no
+  longer fails.
+
+## 1.0.0rc1, 20 September 2026
+
+The first release candidate, prepared for a beta with outside users.
+
+### Added
+
+- The MCP server with five tools: stack detection with production blueprints,
+  fix instructions and independent verification of applied fixes for fifty
+  rules, and ProdPush, which takes a project that passes the scoring gate to a
+  live, smoke tested Render service with an active CI/CD pipeline.
+- `prodpilot connect vscode|cursor|devin`, which connects each IDE's agent to
+  the installed ProdPilot in the place that IDE documents.
+- `prodpilot doctor` now checks git, Node.js and the Docker daemon.
+- Tool annotations: four tools are marked read only and the deploy tool as
+  changing its environment.
+- LICENSE, SECURITY.md, third-party notices, a test workflow and a release
+  workflow for PyPI trusted publishing.
+
+### Changed
+
+- The gate's model ships inside the package, so an installed ProdPilot has
+  one; scikit-learn is pinned to 1.9.0, the version that saved it.
+- Runs on Python 3.11 to 3.14, where it was 3.11 only. The full suite passes
+  on 3.11, 3.13 and 3.14 on Windows with a Docker daemon; 3.12 is covered by
+  the test workflow.
+- The CI/CD workflow ProdPilot writes waits for the deploy it started before
+  checking the service, instead of a fixed 90 second wait.
+- Content fixes declare the environment keys they read, so a CORS fix no
+  longer breaks the environment template and gets reverted.
+
+### Fixed
+
+- A failed Docker build kept none of its output, because the build log was read
+  twice from a one-pass generator; its summary now names the cause.
+
+### Known limits
+
+- Supported stacks are Node.js with Express and React with Vite; the only
+  deployment target is Render.
+- How often a live agent's delegated fix passes verification has not been
+  measured.
+- Not yet observed on real services: the deploy tool called by an IDE agent,
+  the new workflow on GitHub Actions, and `prodpilot connect` in the real
+  clients.
+- Render's own automatic deploy stays on, so a push can start a second deploy
+  beside the workflow's; the workflow waits for the newer one.

prodpilot-1.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Muhammad Sudais Khalid, Muhammad Farooq Khan, Muhammad Talha Khan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

prodpilot-1.0.0/PKG-INFO

@@ -0,0 +1,310 @@
+Metadata-Version: 2.5
+Name: prodpilot
+Version: 1.0.0
+Summary: A layered MCP-based system for automated production readiness and deployment of vibe-coded projects.
+Project-URL: Homepage, https://github.com/prodpilotai/ProdPilot
+Project-URL: Repository, https://github.com/prodpilotai/ProdPilot
+Project-URL: Documentation, https://github.com/prodpilotai/ProdPilot/blob/main/docs/quickstart.md
+Project-URL: Changelog, https://github.com/prodpilotai/ProdPilot/blob/main/CHANGELOG.md
+Project-URL: Issues, https://github.com/prodpilotai/ProdPilot/issues
+Author-email: Muhammad Sudais Khalid <msudaiskhalid.ai@gmail.com>, Muhammad Farooq Khan <farooqhoi52@gmail.com>, Muhammad Talha Khan <hotikhanbhai@gmail.com>
+License: MIT
+License-File: LICENSE
+Keywords: audit,ci-cd,deployment,devops,mcp,production-readiness,render
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Software Development :: Build Tools
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: System :: Installation/Setup
+Requires-Python: <3.15,>=3.11
+Requires-Dist: docker>=7.0.0
+Requires-Dist: joblib>=1.4.0
+Requires-Dist: mcp>=2.0.0
+Requires-Dist: pynacl>=1.5.0
+Requires-Dist: scikit-learn==1.9.0
+Requires-Dist: tomli-w>=1.0.0
+Requires-Dist: typer>=0.16.0
+Description-Content-Type: text/markdown
+
+# ProdPilot
+
+**Takes a web app you built with an AI coding assistant from "it works on my machine" to a live, verified deployment, without leaving your IDE.**
+
+[![Tests](https://github.com/prodpilotai/ProdPilot/actions/workflows/tests.yml/badge.svg)](https://github.com/prodpilotai/ProdPilot/actions/workflows/tests.yml)
+[![Python 3.11 to 3.14](https://img.shields.io/badge/python-3.11%20to%203.14-blue)](pyproject.toml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-green)](LICENSE)
+[![Version 1.0.0](https://img.shields.io/badge/version-1.0.0-brightgreen)](CHANGELOG.md)
+
+AI coding assistants make it quick to build a Node.js API or a React app that
+runs on your laptop. Getting it to run in production is where it breaks:
+credentials hardcoded in the source, no security headers, no container setup,
+no health check, and a deploy that fails with an error you have never seen.
+
+ProdPilot finds those gaps, has your IDE's own coding agent fix them one at a
+time, checks every fix itself, and deploys the project to Render with a CI/CD
+pipeline once it is ready. It works as a Model Context Protocol (MCP) server: a
+small program on your machine that the agent in VS Code with GitHub Copilot,
+Cursor or Devin can call as a set of tools. ProdPilot calls no AI service
+itself.
+
+It is for developers building **Node.js with Express** APIs or **React with
+Vite** apps who want them deployed properly, not just deployed.
+
+## Features
+
+- **A production audit of 50 rules** across security, secrets, environment,
+  build, connectivity, API, structure, observability and git hygiene, scored
+  from 0 to 100.
+- **Fixes your agent applies and ProdPilot verifies.** The agent reports a
+  fix; ProdPilot re-runs that rule's own check on your files and decides. A fix
+  that breaks something that already worked is undone.
+- **Predictable changes.** 44 of the 50 rules come with an exact change for the
+  agent to apply; only 6 ask it to write code, inside limits ProdPilot sets.
+- **A gate that asks whether it will really deploy.** A score of at least 90,
+  no critical failures, and an estimate from a model trained on 684 real Render
+  deployments.
+- **Deployment in one call.** Nine stages, from a local Docker build to a live,
+  smoke tested Render service with a GitHub Actions pipeline. It stops at the
+  first stage that fails and tells you why.
+- **Your credentials stay yours.** They live in a file only your account can
+  read, never in the project, and repository secrets are encrypted before they
+  leave your machine.
+- **Works in the IDE you already use.** One command connects VS Code, Cursor or
+  Devin, formerly Windsurf.
+
+## Quick start
+
+You need Python 3.11 to 3.14, Node.js 20 or later, Docker running, git, a
+GitHub token and a Render API key.
+
+```bash
+pipx install prodpilot          # 1. install
+prodpilot setup                 # 2. store your GitHub token and Render API key
+prodpilot connect vscode        # 3. connect your IDE: vscode, cursor, or devin --project PATH
+```
+
+To pin the version, ask for `prodpilot==1.0.0`.
+
+Then check that everything ProdPilot needs is in place:
+
+```bash
+prodpilot doctor
+```
+
+```text
+ProdPilot doctor
+
+Config file: ~/.prodpilot/config.toml
+  found
+  github_token: stored
+  render_api_key: stored
+  permissions: access is limited to the current user
+
+Tools ProdPilot runs:
+  git: git version 2.54.0.windows.1
+  Node.js: v26.3.0
+  Docker: daemon 29.7.2
+
+All checks passed.
+```
+
+In VS Code, run **MCP: List Servers** and start `prodpilot`. Open your project
+and ask the agent:
+
+> Use ProdPilot to audit this project and fix what it reports, one rule at a time.
+
+## Installation
+
+| Method | Command |
+| --- | --- |
+| pipx, recommended | `pipx install prodpilot` |
+| uv | `uv tool install prodpilot` |
+| pip | `pip install prodpilot` |
+| From source | `git clone https://github.com/prodpilotai/ProdPilot && cd ProdPilot && pip install .` |
+
+`pip install prodpilot` works and is the shortest route. pipx and uv are
+recommended because ProdPilot is a command line tool: they keep it and its
+dependencies in their own environment, so it cannot clash with the packages of
+whatever project you are working on. That matters here because ProdPilot pins
+scikit-learn to the version that saved the model it ships, which only that
+version is guaranteed to read.
+
+Check the install with `prodpilot --help`, which lists `serve`, `setup`,
+`doctor` and `connect`.
+
+| Requirement | Why |
+| --- | --- |
+| Python 3.11, 3.12, 3.13 or 3.14 | ProdPilot itself |
+| Node.js 20 or later | The audit parses your JavaScript with Node |
+| Docker, running | The gate and the deploy build your project in a container first |
+| git, and a GitHub repository set as the project's `origin` | Deploys push the files ProdPilot generated |
+| A GitHub token | A classic token with the `repo` and `workflow` scopes, or a fine grained one with read and write access to contents, secrets and workflows |
+| A Render account and API key | Render is where the project is deployed |
+
+ProdPilot is developed on Windows 11, and its test workflow runs the suite on
+Linux, macOS and Windows for Python 3.11 to 3.14. The same workflow installs
+the built wheel outside the repository on all three systems and loads the
+shipped model, which is what `pip install prodpilot` gives you.
+
+## Usage
+
+### Audit and fix
+
+> Use ProdPilot to audit this project and fix what it reports, one rule at a
+> time, reporting each fix with prodpilot_fix_applied.
+
+The agent asks ProdPilot for the exact change each failing rule needs, applies
+it, and reports back. ProdPilot re-runs the rule's check and answers
+`resolved`, `unresolved` or `blocked`, whatever the agent claimed. On one of
+the deliberately broken sample projects in this repository, the first audit
+scores 13 out of 100 with 6 critical failures; after the fix loop it scores 96
+with none.
+
+### Deploy
+
+Commit your changes, then:
+
+> Deploy this project with prodpilot_deploy.
+
+The deploy creates a real Render service on the free plan and pushes to your
+GitHub repository, so the agent is told to confirm with you first. You get a
+live URL and a GitHub Actions workflow that redeploys on every push and checks
+the service afterwards. A small Express API that the fix loop took from 69 to
+100 went live on Render this way, all nine stages passing, in 82 seconds.
+
+### When something is refused
+
+ProdPilot always says which condition failed. These are real messages:
+
+```text
+score 89 but 1 critical rule(s) still fail: SEC-003
+score 99 meets the threshold, but the model estimates a 5% chance of deploying, below its operating point of 37%
+build failed, missing dependency: npm error The `npm ci` command can only install with an existing package-lock.json or
+```
+
+## Tools and commands
+
+The five tools your IDE's agent sees:
+
+| Tool | What it does |
+| --- | --- |
+| `prodpilot_ping` | Confirms the server is running |
+| `prodpilot_detect_stack` | Identifies the project's stack and returns what a production-ready version must contain |
+| `prodpilot_fix_instruction` | Returns the exact change, or the limits for the change, that fixes one failing rule |
+| `prodpilot_fix_applied` | Takes the agent's report of a fix and answers from the rule's own check |
+| `prodpilot_deploy` | Runs the nine deploy stages; creates a real Render service and pushes to GitHub |
+
+The commands you run:
+
+| Command | What it does |
+| --- | --- |
+| `prodpilot setup` | Stores the GitHub token and Render API key in `~/.prodpilot/config.toml`, readable only by you |
+| `prodpilot doctor [--project PATH]` | Checks the credentials, git, Node.js and Docker; with `--project`, that the project's state file is kept out of git |
+| `prodpilot connect vscode\|cursor\|devin [--project PATH]` | Adds ProdPilot to that IDE's configuration; `--project` is for Devin, which is set up per project |
+| `prodpilot serve` | Starts the MCP server over stdio; your IDE runs this for you |
+
+## How it works
+
+```mermaid
+flowchart LR
+    A[Your project] --> B[Audit: 50 rules, score 0 to 100]
+    B --> C[Fix loop: your agent applies, ProdPilot verifies]
+    C --> B
+    C --> D{Gate: score 90 or more, no critical failure, model estimate}
+    D -- refused --> C
+    D -- cleared --> E[Deploy: 9 stages]
+    E --> F[Live on Render, with CI/CD]
+```
+
+Each rule has its own check, and a fix only counts when that check passes on
+the files on disk. Each rule gets three attempts, and the loop runs up to five
+times while the gate stays shut. The deploy stages are pre-flight checks,
+environment sealing, a local Docker build and run, a push of the generated
+files, the Render deployment, deploy monitoring, a smoke test of the live
+service, and CI/CD wiring. The design, the model and the data behind it are in
+[docs/architecture.md](docs/architecture.md).
+
+## Privacy and security
+
+- ProdPilot talks only to GitHub, Render, and, while building your project,
+  Docker Hub and the npm registry. It sends no telemetry.
+- Your GitHub token and Render API key are stored outside every project, in a
+  file restricted to your account.
+- Secrets go to the test container at run time, never into the image, and to
+  GitHub encrypted with your repository's public key.
+
+Report a vulnerability privately as described in [SECURITY.md](SECURITY.md).
+
+## Limitations
+
+- Two stacks only: Node.js with Express, and React with Vite.
+- One deployment target: Render, on its free plan.
+- For the 6 rules where the agent writes the change, how often a live agent's
+  change passes on the first try has not been measured yet.
+- A project whose code requires a file it does not contain can pass the audit;
+  the Docker build during the deploy catches it and names the missing module.
+- Render's own automatic deploy stays on, so a push can start a second deploy
+  beside the workflow's; the workflow waits for the newer one.
+- This is a beta. Not yet observed on real services: a deploy started by an IDE
+  agent, the generated workflow running on GitHub Actions, and `prodpilot
+  connect` inside Cursor and Devin.
+
+## What's in 1.0.0
+
+- The deployability model ships inside the package.
+- `prodpilot connect` sets up VS Code, Cursor and Devin in one command.
+- `prodpilot doctor` checks git, Node.js and Docker.
+- The generated CI/CD workflow waits for its own deploy before checking the
+  service.
+- Runs on Python 3.11 to 3.14.
+
+The full list is in [CHANGELOG.md](CHANGELOG.md).
+
+## Documentation
+
+- [Quick start and troubleshooting](docs/quickstart.md)
+- [Architecture: the audit, the fix loop, the gate, the model and the data](docs/architecture.md)
+- [IDE compatibility, observed in each client](docs/compatibility.md)
+- [The whole chain run on every sample project](docs/pipeline.md)
+- [Measured fix reliability](docs/metrics.md)
+- [The deployability model's evaluation](docs/evaluation.md)
+- [What 1.x keeps stable](docs/stability.md)
+
+## Contributing
+
+```bash
+git clone https://github.com/prodpilotai/ProdPilot
+cd ProdPilot
+python -m venv .venv
+.venv/bin/pip install -e . --group dev     # on Windows: .venv\Scripts\pip; needs pip 25.1 or later
+.venv/bin/python -m pytest
+```
+
+The tests reach no live service: Render and GitHub are scripted. Tests that
+build real Docker images are skipped when no Docker daemon is running. Please
+open an issue before a large change, and run the suite before sending a pull
+request.
+
+Questions and bug reports go to
+[GitHub issues](https://github.com/prodpilotai/ProdPilot/issues).
+
+## License
+
+MIT, see [LICENSE](LICENSE). Bundled third-party code is listed in
+[THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
+
+## Credits
+
+Built by Muhammad Sudais Khalid, Muhammad Farooq Khan and Muhammad Talha Khan
+as the Final Year Project BSAI-FYP-2026 of the Department of Artificial
+Intelligence, Shifa Tameer-e-Millat University, at the Artificial Intelligence
+Technology Centre, National Centre for Physics, Islamabad. Supervised by Mr.
+Rehan Naveed Abbasi, Muhammad Tahir with industrial supervision by Dr. Rana Fayyaz Ahmad and Muhammad Junaid Asif.