Appendix C — Deployment Checklist

Use before promoting ShopOps (or any agent runtime) past laptop demo.

Topology

• API and worker are separate processes
• Durable DB for cases / checkpoints / memory
• Queue with per-case_id ordering or leases
• Model keys only via env / secret manager
• Health checks: API /healthz, worker heartbeat metric

Data & migrations

• Versioned schema migrations
• tenant_id on all rows before second tenant
• Backup / restore drill documented
• PII retention and deletion path tested

Reliability

• Idempotency keys on all consequential side effects
• Timeouts and deadlines on model + tools
• Retry policy with backoff + cap
• DLQ for poison messages
• Checkpoint resume after kill tested

Safety gates

• Policy pack version pinned in traces
• Dry-run / shadow path for channels
• HITL timeout safe default (usually no send)
• Kill switch to disable Contact writes

Observability

• Structured traces for model/tool/policy/state
• Dashboards: queue depth, lease expiry, $/case, violation rate
• Audit evidence pack export for one golden case

CI / CD

• Ring-0/1 tests on PR
• Policy fixture suite required green
• Image build + Compose smoke (create case)
• Rollback procedure for prompt/policy/model pins

Go-live

• Staging with scrubbed data
• Shadow compare vs human baseline
• On-call runbook + escalation contacts
• Chapter 49 mistake catalog reviewed on the design