> ## Documentation Index
> Fetch the complete documentation index at: https://docs.praxa.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Production readiness checklist

> Use a concrete checklist to qualify a Praxa integration before enabling real workloads.

## Production verification

Verify each layer independently:

1. **Package:** install the exact public version in a clean project.
2. **Contract:** validate the request, response, scope, and version metadata.
3. **Authentication:** test valid, missing, expired, revoked, and wrong-scope credentials.
4. **Isolation:** prove the caller cannot read or mutate another subject or tenant.
5. **Idempotency:** replay the same logical mutation and then send a digest mismatch.
6. **Lifecycle:** observe the terminal state rather than stopping at admission.
7. **Cleanup:** delete test data and confirm the documented retention boundary.

## Release checklist

### Contract

* [ ] Pin the API, SDK, CLI, or MCP version.
* [ ] Record the expected wire-contract version and fingerprint where exported.
* [ ] Validate every request and response shape used by the application.

### Authentication and isolation

* [ ] Use the intended credential type.
* [ ] Prove missing, malformed, expired, revoked, and wrong-scope failures.
* [ ] Prove another tenant and another subject cannot be accessed.
* [ ] Keep secrets out of browser output, logs, error messages, and URLs.

### Lifecycle and recovery

* [ ] Reuse a stable idempotency key for the same logical mutation.
* [ ] Prove a changed payload under the same key is rejected.
* [ ] Resume SSE from the last processed event.
* [ ] Deduplicate webhook retries.
* [ ] Read the terminal resource after an interrupted response.
* [ ] Exercise cancellation and timeout handling.

### Operations

* [ ] Capture run, request, event, delivery, and version identifiers.
* [ ] Set alerting for stuck work, repeated reconnects, and reconciliation gaps.
* [ ] Document rate-limit behavior.
* [ ] Rotate the disposable release credential.
* [ ] Delete test candidates and other removable fixtures.
* [ ] Record any provider-owned data that Praxa deletion cannot erase.

## Release decision

Ship only when every required row has evidence from the environment you intend
to enable. A package import, local mock, or unauthenticated <code>401</code> is
valuable evidence, but it is not an authenticated tenant-isolation canary.