Production checklist

​

Infrastructure

• Public DNS and TLS forward only to the public allowlist proxy.
• /ready, /metrics, /admin/*, OpenAPI routes, and the console are private.
• Postgres uses durable storage and tested backups.
• Redis is private and uses a deployment-specific key prefix.
• shared_state.type is redis; production does not enable allow_process_local_throttling.
• Provider, database, Redis, bootstrap-key, administrator-password, and webhook secrets come from a secret manager.
• Container/image scanning and a pinned image digest are part of deployment.

​

Configuration

• payload_logging.enabled is false unless a time-bounded, approved diagnostic session is active.
• data_governance.payload_storage is disabled unless tenant access, PII review, and a bounded payload_retention_days policy are approved.
• public_base_url exactly matches the public HTTPS origin.
• The BYOK custom-endpoint policy is deliberate; public_https is paired with tested egress denial of private, link-local, and cloud-metadata destinations.
• Only validated aliases are public.
• Every budget-reachable route has reviewed pricing.
• Model capabilities and unsupported parameters are tested against real providers.
• Every enabled audio alias passes credential-gated live discovery, typed-pricing, bounded STT/translation/TTS, and synthetic text checks; raw audio remains absent from logs and payload storage.
• Every enabled realtime alias has one explicit protocol, reviewed session_second or TTS character pricing, Redis-backed admission leases, bounded renewable budget slices, strict session/idle/frame/concurrency bounds, a WebSocket-capable public proxy, and provider-backed connect/audio/close/outage/revocation/budget/shutdown/load evidence; ElevenLabs STT input formats are reviewed and raw frames remain absent from logs and payload storage.
• Request body, input-token, retry, timeout, and cooldown settings match the workload.
• Bootstrap keys are replaced or tightly controlled after provisioning.
• admin_session_cookie_secure matches the private origin: true for HTTPS, false only for loopback HTTP tunnels.
• admin_auth.require_distributed_throttling is true, password/OIDC initiation limits are reviewed, and Redis is healthy before either authentication entry point is exposed.
• Every console identity has the least-privilege role; each org_* role has exactly one reviewed organization scope and every system_* role has none.
• OIDC uses the exact HTTPS issuer/callback registered at the IdP; immutable subjects, roles, tenant scopes, MFA policy, state replay, and break-glass recovery are exercised.
• The database is at Alembic head, admin_audit_ready is true, and a disposable mutation produces both audit phases without secrets.
• Every process has a unique stable LLM_GATEWAY_INSTANCE_ID; a disposable catalog change reaches current acknowledgements on all live replicas and a forced activation failure degrades the model-catalog component while the last safe runtime keeps serving.
• Request, audit, and finalized-ledger retention matches contracts; reserved ledger rows survive retention, the worker has a recent successful run, an old/current-row drill passes, and backup expiry plus tenant export/deletion are documented.

​

Applications

• Every application/environment has its own least-privilege key.
• Every non-bootstrap key has a reviewed org_id; rotation overlap is bounded and an old-token expiry/revocation drill passes.
• RPM, TPM, budget, and expiry are set where required.
• Applications set output token limits and retain request IDs.
• Streaming and error paths are tested.
• Direct-provider rollback variables are retained for the initial observation period.

​

Operations

• /ready and Prometheus alerts are connected to incident routing.
• Request-log drops alert immediately.
• admin_audit readiness failures and admin_audit_persist_failed events route to operators; audit retention/export is documented.
• Budget-alert delivery is exercised with a disposable low-budget key.
• Postgres restore, Redis outage, provider fallback, stream disconnect, and rollback drills pass.
• Representative load establishes capacity and latency thresholds.
• Upgrade and rollback owner, window, and previous image/config are recorded.