Production readiness checklist

​

Production verification

1. Package: install the exact public version in a clean project.
2. Contract: validate the request, response, scope, and version metadata.
3. Authentication: test valid, missing, expired, revoked, and wrong-scope credentials.
4. Isolation: prove the caller cannot read or mutate another subject or tenant.
5. Idempotency: replay the same logical mutation and then send a digest mismatch.
6. Lifecycle: observe the terminal state rather than stopping at admission.
7. Cleanup: delete test data and confirm the documented retention boundary.

​

Release checklist

​

Contract

• Pin the API, SDK, CLI, or MCP version.
• Record the expected wire-contract version and fingerprint where exported.
• Validate every request and response shape used by the application.

​

Authentication and isolation

• Use the intended credential type.
• Prove missing, malformed, expired, revoked, and wrong-scope failures.
• Prove another tenant and another subject cannot be accessed.
• Keep secrets out of browser output, logs, error messages, and URLs.

​

Lifecycle and recovery

• Reuse a stable idempotency key for the same logical mutation.
• Prove a changed payload under the same key is rejected.
• Resume SSE from the last processed event.
• Deduplicate webhook retries.
• Read the terminal resource after an interrupted response.
• Exercise cancellation and timeout handling.

​

Operations

• Capture run, request, event, delivery, and version identifiers.
• Set alerting for stuck work, repeated reconnects, and reconciliation gaps.
• Document rate-limit behavior.
• Rotate the disposable release credential.
• Delete test candidates and other removable fixtures.
• Record any provider-owned data that Praxa deletion cannot erase.

​

Release decision