# Production Readiness Checklist ## Gate policy Unchecked means not implemented, not tested, or lacking evidence. Do not infer completion from documentation or scaffolding. Every checked item requires a dated evidence link, responsible reviewer, and environment. Local application evidence exists; no target-host deployment or independent-review item is verified. ## Authentication and authorization - [x] Owner bootstrap is one-time and safely disabled afterward. ([local evidence](release-evidence/2026-08-25-local-hardening.md)) - [x] Password hashing, reset, session rotation/expiry, CSRF, and logout-all tested. ([local evidence](release-evidence/2026-08-25-local-hardening.md)) - [x] MFA and recovery flow are available and tested. ([local evidence](release-evidence/2026-08-25-local-hardening.md)) - [x] Login throttling and account-enumeration defenses tested. ([local evidence](release-evidence/2026-08-25-local-hardening.md)) - [ ] Server-side RBAC is deny-by-default across APIs, jobs, WebSockets, and tools. - [x] Workspace scoping and IDOR/cross-workspace negative tests pass. ([local evidence](release-evidence/2026-08-25-local-hardening.md)) - [ ] Revocation terminates active sessions and realtime capabilities. ## Secrets and data protection - [ ] Repository and image secret scans pass. - [ ] Production secrets use an approved store or envelope encryption design. - [ ] Secret redaction, rotation, access audit, and least OAuth scopes are tested. - [ ] Internal API keys are hashed, scoped, expiring, revocable, and displayed once. - [ ] Encryption and signing keys are versioned and recoverable without the database. - [ ] Retention, export, and deletion cover derived data and embeddings. ## AI actions and approvals - [x] LLM output cannot bypass the typed tool registry or deterministic policy engine. ([local evidence](release-evidence/2026-08-25-local-hardening.md)) - [ ] Permissions, autonomy, contact, budget, and schedule constraints are enforced. - [x] Approvals bind actor, canonical payload hash, scope, and expiry. ([local evidence](release-evidence/2026-08-25-local-hardening.md)) - [x] Approval tampering, replay, stale state, and revocation tests pass. ([local evidence](release-evidence/2026-08-25-local-hardening.md)) - [ ] External actions use idempotency, preconditions, and result verification. - [ ] Crash recovery cannot duplicate messages, meetings, calls, or file sharing. - [x] Emergency stop is application-enforced before every implemented side effect. ([local evidence](release-evidence/2026-08-25-local-hardening.md)) - [ ] Prompt injection and malicious tool-result test suites pass. ## Browser and file isolation - [ ] Browser profiles, files, processes, and keys are isolated per workspace. - [x] Browser control uses exclusive locks and fencing tokens. ([local evidence](release-evidence/2026-08-25-local-hardening.md)) - [x] Human takeover atomically pauses/fences AI and safe resume is tested. ([local evidence](release-evidence/2026-08-25-local-hardening.md)) - [ ] CDP, VNC/noVNC, database, Redis, and Docker daemon are not publicly reachable. - [x] Live-control HTTP capabilities are authenticated, short-lived, scoped, and bounded by key rotation/expiry. ([local evidence](release-evidence/2026-08-25-local-hardening.md)) - [ ] SSRF defenses cover redirects, DNS rebinding, metadata, and internal services. - [ ] Browser egress is restricted and tested. - [ ] Downloads are quarantined, scanned, size-limited, and type-validated. - [ ] File path traversal, symlink, cross-workspace, and signed-URL tests pass. ## Dedicated agent computers - [ ] Every activatable runtime agent owns exactly one full VM; no VM, disk, profile, or runtime is shared across agents, including agents in the same workspace. - [ ] KVM/libvirt, Proxmox, or cloud gateway credentials are isolated from Core workers and guests; guests cannot reach hypervisor, host management, Docker, database, Redis, or another guest. - [ ] Linux and licensed Windows golden images are patched, signed, scanned, reproducible, and rejected when unavailable or unverified. - [ ] VM create/start/stop/restart/pause/resume/delete/resize/snapshot/restore are authorization checked, policy evaluated, idempotent, audited before dispatch, and provider-verified afterward. - [ ] Workspace and per-VM CPU/RAM/disk/active-machine quotas survive concurrent requests and provider failures without over-allocation. - [ ] Per-VM disks and browser profiles are encrypted, persistent across reboot, included in tested backup/restore, and securely deleted with auditable verification. - [ ] The in-guest daemon is mutually authenticated, least privileged, boot persistent, revocable, and tested for terminal, application, file, screenshot, browser, update, and graceful shutdown. - [ ] Full-desktop live view and human takeover fence AI atomically and never bypass pause, emergency stop, approval, or network policy. ## Infrastructure and supply chain - [ ] HTTPS, secure headers, origin controls, and gateway rate limits are configured. - [ ] Firewall exposes only approved ports; SSH is restricted. - [ ] Containers run non-root with dropped capabilities and no-new-privileges. - [ ] Images are pinned/scanned; lockfiles, SBOM, and dependency scanning are current. - [x] Python runtime resolution is exactly constrained and local Python/web dependency audits pass. ([local evidence](release-evidence/2026-08-26-production-hardening.md)) - [ ] Docker socket is not mounted; networks enforce service separation. - [ ] Database roles and storage permissions follow least privilege. - [ ] Health checks, restart policies, resource limits, and log rotation are verified. - [x] Production processes and aggregate readiness fail closed on unsafe configuration or missing required workers. ([local evidence](release-evidence/2026-08-26-production-hardening.md)) - [ ] CI security checks and branch/release protections are enabled. ## APIs, webhooks, and realtime - [ ] Request validation, standard errors, request IDs, and safe rate limits are tested. - [ ] Webhooks verify raw-body signatures, timestamps, and replay state. - [ ] Webhook schema, size, retry, secret rotation, and duplicate-event tests pass. - [ ] WebSockets authorize every subscription/action and enforce origin/size/rate limits. ## Audit, privacy, and observability - [x] Audit logs are append-only/tamper-evident and agents cannot alter them. ([local evidence](release-evidence/2026-08-25-local-hardening.md)) - [ ] Auth, policy, approval, delegation, secret, browser, admin, and action events audit. - [ ] Logs redact credentials, tokens, cookies, sensitive bodies, and personal content. - [x] Public health endpoints reveal no sensitive topology or provider detail. ([local evidence](release-evidence/2026-08-25-local-hardening.md)) - [ ] Alerts cover auth abuse, queue stalls, browser/integration loss, disk, and backups. - [ ] Recording consent and jurisdictional requirements are addressed. ## Reliability and recovery - [ ] Durable workflow state survives worker, Redis, container, and server restarts. - [ ] Queue leases, fencing, dead letters, and transactional outbox are tested. - [ ] Graceful shutdown checkpoints work without unsafe replay. - [ ] Encrypted off-host backups cover database, files, profiles, audit, and config. - [ ] A dated isolated restore drill passed and evidence is linked. - [ ] Key rotation and compromised-credential runbooks were exercised. - [ ] Provider outage, browser crash, network failure, and disk-full drills passed. ## Functional and release evidence - [ ] Migrations succeed from a clean production-like environment. - [ ] Unit, integration, authorization, browser, workflow, E2E, and regression tests pass. - [ ] Load tests document queue, realtime, database, browser, CPU, RAM, and disk behavior. - [ ] WhatsApp reconnect, email/calendar OAuth expiry, and voice failure are tested. - [ ] Monitoring, alert routing, retention jobs, and failure notifications are verified. - [ ] Architecture, API, security, deployment, operations, and recovery docs are current. - [x] Known limitations and unconfigured integrations are accurately disclosed. ([local evidence](release-evidence/2026-08-25-local-hardening.md)) - [ ] Independent Security and QA reviewers approve the release with linked evidence. ## Sign-off Production release remains blocked until every critical item is checked or an explicit, time-bounded risk acceptance is documented with owner, rationale, compensating control, review date, and rollback plan.