We ran our own go-live checklist against ourselves. We passed 64%.

Insomniac Agents' sister product sells a 23-topic "go-live doctrine" — the production mistakes that sink apps built fast with AI. It would be dishonest to sell that checklist without ever running it on ourselves. So we did: an evidence-first audit of all five of our live properties (the platform itself, plus three tenant storefronts and the doctrine store) against every check in our own doctrine. Nothing was marked PASS without a live probe or a cited file.

The headline number: the platform passes ~64% of its applicable checks outright (34 of 53), with 8 outright fails and 6 we honestly couldn't verify from the outside. The three static tenant storefronts and the doctrine store scored 80–90% each, sharing one common fail.

The worst fails, ranked:

1. No tested database backup or restore. Zero mentions of backup or restore anywhere in the repo. Our own doctrine calls this out by name: "you can rebuild code, you can't rebuild lost data." This is still open — it needs a paid Atlas tier decision, which isn't ours to make.
2. Missing security headers on every live site. At audit time, the platform's tenant storefronts and the doctrine store served HSTS and nothing else — no CSP, no X-Frame-Options, no nosniff.
3. A client-facing error leak. Unexpected server errors were returning the raw internal error message to the browser instead of a generic one — a real, if minor, information-disclosure bug in our own error handler.

We didn't sit on the fixable ones. Same day: the security-header gap was closed across all five properties (CSP, X-Frame-Options: DENY, nosniff, Referrer-Policy, Permissions-Policy, all live-verified), and the error handler now returns a generic message to clients while logging the real detail server-side. The backup gap is still open — it's the one item on this list that genuinely isn't ours to close without a billing decision, and we've said so rather than quietly hiding it.

What's still true and strong: code-enforced AI budget caps at every LLM entry point, password hashing + login lockout + MFA, input validation returning clean 400s instead of 500s, rate limiting proven live (429s captured in the wild), and 200/200 automated tests passing at the time.

We're not publishing "we pass our own checklist" as a blanket claim — we don't, yet. What we are publishing is the scorecard itself, fails included. If we're going to sell a production-readiness audit, the least we can do is submit to one first.