Skip to main content

Go-Live Checklist

Automated Evidence​

  • File upload abuse: oversized, empty, MIME mismatch, corrupt, and password-protected inputs are tested.
  • Auth bypass: missing, invalid, repeated-failure, and cross-client access paths are tested.
  • Rate-limit bypass: protected endpoints return 429 with rate-limit headers after the configured limit.
  • Metadata/filter abuse: reserved client_id and system metadata paths are rejected.
  • Path traversal: unsafe document ids are rejected before staging.
  • Load evidence: load_performance_report.py exits 0 only when go_live_ready=true, evidence_status=pass, and evidence_failures=[].
  • Runtime image smoke: API and embedding images import required runtime modules and prove build tools are absent.
  • Alerting: run the test-fire procedure in the monitoring guide and attach evidence.

Human-Gated Items​

These items are blocked until a human records real evidence:

  • Security sign-off owner and review date.
  • Independent operator runbook-only deployment walkthrough.
  • Go-live owner.
  • First-30-day success metrics.
  • Post-launch review rhythm.

Do not fill these with placeholders or inferred names.