Security and tenancy
Separate credentials, scopes, personal tenants, organization roles, and provider authority.
Observability
Reconcile admission, lifecycle events, terminal readback, webhooks, and usage.
Production checklist
Run the minimum positive, negative, isolation, recovery, and cleanup cases.
Troubleshooting
Diagnose authentication, idempotency, events, webhooks, and memory failures.
Production verification
Verify each layer independently:- Package: install the exact public version in a clean project.
- Contract: validate the request, response, scope, and version metadata.
- Authentication: test valid, missing, expired, revoked, and wrong-scope credentials.
- Isolation: prove the caller cannot read or mutate another subject or tenant.
- Idempotency: replay the same logical mutation and then send a digest mismatch.
- Lifecycle: observe the terminal state rather than stopping at admission.
- Cleanup: delete test data and confirm the documented retention boundary.