MCP-Project-bus/docs/PRODUCTION_PROFILE.md

Production Profile

The MVP is suitable for local integration and controlled proof-of-concept use. Internet-facing or business-critical deployment requires a separate production hardening work package.

Required changes

1. Implement the persistence interface for PostgreSQL 16+. Use transactions, SELECT … FOR UPDATE or conditional updates, unique idempotency constraints, and database roles that cannot update/delete the event table.
2. Replace StaticTokenAuthProvider with validated OIDC/JWT or mTLS workload identity. Bind issuer, audience, subject, expiry, and revocation policy.
3. Put the service behind TLS and authenticated ingress. Do not trust arbitrary forwarded identity headers.
4. Run multiple stateless instances only after PostgreSQL conformance and concurrency tests pass.
5. Add structured audit export, metrics, tracing correlation, alerts, backup, point-in-time recovery, and restore exercises.
6. Add membership lifecycle, token revocation, retention/export policy, and project deletion/archival decisions. Event deletion is intentionally absent.
7. Pin and scan the base image; generate an SBOM and sign release artifacts.
8. Run load, fault, client interoperability, and penetration tests.

MCP activation

The deployed endpoint must support POST /mcp with application/json. The current service returns normal JSON instead of SSE and uses no session IDs. Validate that each intended client accepts this stateless profile before production gate acceptance.

Chat threads are not push subscribers. A client, automation, or PA invocation must call sync_since(last_cursor). The cursor itself belongs in durable client state and is advanced only after successful processing.