Production hardening

Hardening checklist

Supply chain

• verify package digests and publisher signatures;
• scan model formats and runtime dependencies;
• prohibit unsafe deserialization and arbitrary package hooks;
• pin runtime images and tool versions;
• record software and model bills of materials;
• support revocation by ancestor, signer, dataset, and dependency.

Runtime

• deny outbound network by default;
• enforce memory, compute, output, and time ceilings;
• mediate every tool call;
• use short-lived least-privilege credentials;
• separate build, evaluation, shadow, and production environments;
• test graceful degradation and fallback.

Data

• classify inputs and outputs;
• minimize telemetry;
• prevent holdout leakage;
• verify training consent, license, retention, and jurisdiction;
• detect prompt injection and data exfiltration;
• maintain deletion and revocation propagation.

Configuration

• version prompts, router thresholds, policy, contracts, and scoring weights;
• use atomic deployment aliases;
• prohibit unreviewed environment overrides;
• validate configuration at startup;
• keep secrets outside packages and prompts.

Reliability

• maintain at least one verified rollback target;
• test shadow, canary abort, and rollback routinely;
• monitor dependency health and load time;
• cap coalition fan-out and retries;
• ensure judge failure has defined behavior.

Preflight gate

FUNCTION production_preflight(package, release)
    checks <- [
        SIGNATURE_VALID(package),
        SBOM_APPROVED(package),
        CONTRACT_VERIFIED(package),
        EVALUATION_CURRENT(package),
        PERMISSIONS_MINIMAL(package),
        ROLLBACK_TESTED(release),
        OBSERVABILITY_COMPLETE(release),
        INCIDENT_OWNER_ASSIGNED(release)
    ]

    RETURN ALL(checks)
END FUNCTION

Environment parity

Evaluation and production need not be identical, but material differences must be documented and tested. Hardware, precision, batching, tokenizer, context limits, retrieval, and tool mediation can all alter behavior.

Human operations

Train operators to identify artifact IDs, inspect lineage, stop traffic, revoke packages, and recover aliases without relying on the breeding controller. Emergency procedures should work when the control plane is degraded.