POC → Production Checklist
The gate a demo must clear to become a system people depend on: reliability, observability, security, and a real handoff.
Reliability
- Handle the sad path
- Every external call can fail. Timeouts, retries (with jitter), and a graceful fallback.
- Idempotency
- Re-running a job / re-delivering a webhook shouldn’t double-charge or double-write.
- Backpressure & limits
- Bounded queues, rate limits, and a dead-letter path for what you can’t process.
- Data validation
- Reject/quarantine bad input at the edge; don’t let it corrupt downstream.
Observability
- Structured logs
- With a request-id / correlation-id you can trace end to end.
- Metrics + alerts
- Track the one metric that means "it’s working"; alert when it moves.
- Health check
- A real readiness/liveness endpoint — not just "process is up".
- Know when it’s broken
- Before the customer tells you. Wire alerts into their channel too.
Security & config
- Secrets out of code
- Vault/KMS + env. No keys in the repo, no keys in logs.
- Least-privilege access
- Scope every credential to what the job needs.
- Config, not constants
- Per-environment config; nothing hardcoded to one customer.
- Repeatable deploy
- One command / pipeline to deploy + roll back. No snowflake servers.
Handoff
- Runbook
- How to deploy, roll back, rotate secrets, and fix the top 3 failures.
- Docs their team can use
- Architecture + integration points + who to call. Not just your commit history.
- Train the owners
- Walk their engineers through it; watch them operate it once.
- Define the exit
- Who owns it now, what you still support, and for how long.