What ships, and the gates it passes

"Done" is a claim that needs evidence. These are the gates that produce it. They are the default on every engagement; a client can raise the bar, and lowering it is a decision made explicitly rather than by drift.

Tests

New behaviour arrives with tests. Fixed bugs arrive with the test that would have caught them, because a bug reaching production means an invariant was unguarded, and the fix is not finished until that gap is closed.

Judgment applies: a typo does not need a regression test. Anything touching authentication, routing, configuration wiring, middleware, external API error handling or data migration does.

Review

Every change is reviewable as a change. In practice that means small, focused commits with a stated reason, and pull requests scoped so a reviewer can actually hold the whole diff in their head. A pull request nobody can review is not a reviewed pull request.

Continuous integration

The build, the tests and whatever project-specific guards exist run automatically, and a red suite blocks the merge. Guards worth having are usually the boring ones: a check that a forbidden string never reappears after a vendor migration, a check that a link convention is not bypassed, a check that generated artifacts were regenerated.

Accessibility

Where a client cares about accessibility, it is tested rather than asserted. This site is the worked example. It targets WCAG 2.2 AAA contrast in both light and dark themes, and it is held there by two separate automated checks, because one of them was not enough:

• A static check over the colour tokens, run on every push.
• A rendered check that walks the live DOM across a set of routes in both themes and measures each piece of text against the background it is actually painted on, run on every pull request.

The second gate exists because the first one passed while buttons on the live site measured well under the bar. Every token was individually valid; only the combination was broken, and only a rendered audit can see that. The accessibility statement has the full picture.

The general lesson travels beyond colour: a check on the inputs is not a check on the output.

Dependency and dead-code hygiene

Unused exports, files and dependencies get found and removed, with a trace run first, because automated dead-code detection cannot see code wired in through build configuration and will confidently tell you to delete something load-bearing. Deletions are reviewed by a person. Automatic deletion is never wired into a pipeline.

Security

Reviewing the dependency and security surface is part of the standard code review, not a separate product. See Security practices.

What this costs you

Nothing extra, and that is the point. These are not an upsell tier. They are the reason a fixed-price estimate is what it is, and skipping them would not make an engagement meaningfully cheaper, only cheaper-looking until the second month.