Next.js Deliverable Quality Gates

Pre-Deployment Checklist

Compilation

Requirements:

• TypeScript compilation passes without errors
• Next.js build completes successfully (next build)
• No build warnings for missing pages or routes
• Static generation succeeds for all designated pages

Commands:

npm run build
npm run type-check  # if configured

Acceptance:

• Pass: Build completes with exit code 0
• Fail: Any TypeScript errors or build failures

Linting

Requirements:

• ESLint passes with no errors
• ESLint warnings reviewed and addressed
• Prettier formatting applied consistently
• No disabled rules without justification

Commands:

npm run lint
npm run format:check  # if configured

Acceptance:

• Pass: Zero lint errors, warnings reviewed and justified
• Fail: Any lint errors or unaddressed critical warnings

Testing

Requirements:

• All tests passing
• No skipped tests without justification
• Coverage meets minimum thresholds
• E2E tests pass for critical paths

Commands:

npm test
npm run test:e2e
npm run test:coverage

Acceptance:

• Pass: 100% test pass rate, coverage > 80% for core features
• Fail: Any failing tests or coverage below threshold

Functionality

Routing

Criteria:

• All routes accessible and render correctly
• Dynamic routes handle all expected params
• 404 pages show for invalid routes
• Navigation works without page refresh
• Deep linking works (URLs are shareable)

Verification:

• Manual testing of all routes
• E2E tests covering navigation flows
• Browser back/forward buttons work correctly

Data Fetching

Criteria:

• All data displays correctly on initial load
• Loading states show during data fetch
• Error states display for failed requests
• Stale data invalidated appropriately
• No unnecessary re-fetches

Verification:

• Test with slow 3G network simulation
• Test with offline mode
• Verify caching behavior
• Check Network tab for request patterns

Interactivity

Criteria:

• All forms submit successfully
• Form validation works correctly
• Buttons and links respond to clicks
• Loading indicators during async operations
• Success/error feedback after actions

Verification:

• Test all user flows
• Verify form validation messages
• Test keyboard navigation
• Test with JavaScript disabled (where applicable)

Performance

Core Web Vitals

Requirements:

Metric	Target
Largest Contentful Paint (LCP)	< 2.5s
First Input Delay (FID)	< 100ms
Cumulative Layout Shift (CLS)	< 0.1
First Contentful Paint (FCP)	< 1.8s
Time to Interactive (TTI)	< 3.8s

Verification:

• Lighthouse audit score > 90
• PageSpeed Insights check
• WebPageTest.org analysis
• Real-world testing on 3G networks

Bundle Size

Criteria:

• Initial JavaScript bundle < 200KB (gzipped)
• Total page weight < 1MB
• No duplicate dependencies in bundle
• Large libraries loaded dynamically

Verification:

• Bundle analysis with @next/bundle-analyzer
• Check Network tab in DevTools
• Verify code splitting working

Caching

Criteria:

• Static assets cached appropriately
• API responses cached with correct strategy
• Stale-while-revalidate for dynamic content
• Cache invalidation works after updates

Verification:

• Check Response headers (Cache-Control)
• Verify cache behavior in Network tab
• Test cache invalidation scenarios

Accessibility

WCAG Compliance

Criteria:

• WCAG 2.1 Level AA compliance
• All images have alt text
• Proper heading hierarchy (h1-h6)
• Sufficient color contrast (4.5:1 for text)
• Keyboard navigation works completely
• Screen reader friendly

Verification:

• Lighthouse accessibility audit > 95
• axe DevTools scan with 0 violations
• Manual keyboard navigation test
• Screen reader test (VoiceOver/NVDA)

Focus Management

Criteria:

• Focus visible on all interactive elements
• Tab order logical and predictable
• Focus trapped in modals
• Skip links for keyboard users

Verification:

• Tab through entire page
• Verify focus indicators visible
• Test modal focus behavior

SEO

Metadata

Criteria:

• Unique title for each page
• Meta descriptions for all pages
• Open Graph tags for social sharing
• Twitter Card metadata
• Canonical URLs set correctly
• Robots.txt configured
• Sitemap.xml generated

Verification:

• View page source for each route
• Test social share previews
• Check robots.txt and sitemap.xml
• Google Search Console validation

Structured Data

Criteria:

• Schema.org markup where appropriate
• JSON-LD for structured data
• Valid structured data (no errors)

Verification:

• Google Rich Results Test
• Schema markup validator

Security

Authentication

Criteria:

• Protected routes require authentication
• JWT tokens stored securely (httpOnly cookies)
• Session timeout implemented
• Logout clears all auth data

Verification:

• Test accessing protected routes without auth
• Verify token storage method
• Test session expiration

API Security

Criteria:

• Input validation on all API routes
• SQL injection prevention (parameterized queries)
• XSS prevention (sanitized output)
• CSRF protection for mutations
• Rate limiting on public endpoints
• API keys in environment variables

Verification:

• Penetration testing
• Input fuzzing
• Check .env not committed
• Verify CORS configuration

Headers

Criteria:

• Content-Security-Policy header set
• X-Frame-Options set to DENY or SAMEORIGIN
• X-Content-Type-Options: nosniff
• Strict-Transport-Security (HSTS) for HTTPS

Verification:

• Security headers check (securityheaders.com)
• Verify headers in Response

Mobile

Responsive Design

Criteria:

• Works on screen sizes 320px - 2560px
• Touch targets minimum 44x44px
• No horizontal scrolling on mobile
• Font sizes readable on mobile (16px minimum)
• Images scale appropriately

Verification:

• Test on actual devices (iOS, Android)
• Chrome DevTools device emulation
• Test in portrait and landscape

Performance

Criteria:

• LCP < 2.5s on 3G
• First load < 3s on 3G
• Total page weight < 500KB for mobile

Verification:

• Lighthouse mobile audit
• Test on 3G throttled connection

Browser Compatibility

Support

Criteria:

• Last 2 versions of Chrome, Firefox, Safari, Edge
• Safari iOS latest 2 versions
• Chrome Android latest 2 versions
• Graceful degradation for older browsers

Verification:

• BrowserStack testing
• Manual testing on major browsers
• Check caniuse.com for feature support

Error Handling

User Experience

Criteria:

• Error boundaries catch all React errors
• User-friendly error messages
• Recovery options provided (retry, go back)
• Errors logged to monitoring service

Verification:

• Simulate various error conditions
• Verify error tracking in monitoring service
• Check error messages are non-technical

Monitoring

Production Readiness

Criteria:

• Error tracking configured (Sentry, etc.)
• Performance monitoring active
• Analytics tracking implemented
• Health check endpoint available
• Logging configured appropriately

Verification:

• Verify errors appear in tracking service
• Check analytics events firing
• Test /api/health endpoint

Deployment

Configuration

Criteria:

• Environment variables documented
• Production .env.production configured
• Database migrations applied
• CDN configuration verified
• Domain SSL certificate valid

Verification:

• Review .env.example completeness
• Verify all environment variables set in production
• Check SSL certificate expiration

Rollback Plan

Criteria:

• Rollback procedure documented
• Previous version can be restored quickly
• Database migrations are reversible

Final Sign-Off

Required Approvals

• Developer self-review completed
• Peer code review approved
• QA testing passed
• Product owner acceptance
• Security review completed (for sensitive features)
• Performance benchmarks met
• Accessibility audit passed

Documentation

• README updated
• API documentation current
• Deployment instructions documented
• Environment variables documented
• Known issues documented

Release Notes

• CHANGELOG updated
• Breaking changes documented
• Migration guide provided (if needed)

Acceptance

Go/No-Go

Pass Criteria:

• All critical tests passing
• No critical bugs open
• Performance meets requirements
• Security review complete
• Accessibility standards met

Blockers:

• Any critical security vulnerabilities
• Core functionality broken
• Performance regression > 20%
• Accessibility violations
• Data loss scenarios