Codex Lead Engineer
37 lines
1.7 KiB
Markdown
37 lines
1.7 KiB
Markdown
# Production Profile
|
|
|
|
The MVP is suitable for local integration and controlled proof-of-concept use.
|
|
Internet-facing or business-critical deployment requires a separate production
|
|
hardening work package.
|
|
|
|
## Required changes
|
|
|
|
1. Implement the persistence interface for PostgreSQL 16+.
|
|
Use transactions, `SELECT … FOR UPDATE` or conditional updates, unique
|
|
idempotency constraints, and database roles that cannot update/delete the
|
|
event table.
|
|
2. Replace `StaticTokenAuthProvider` with validated OIDC/JWT or mTLS workload
|
|
identity. Bind issuer, audience, subject, expiry, and revocation policy.
|
|
3. Put the service behind TLS and authenticated ingress. Do not trust arbitrary
|
|
forwarded identity headers.
|
|
4. Run multiple stateless instances only after PostgreSQL conformance and
|
|
concurrency tests pass.
|
|
5. Add structured audit export, metrics, tracing correlation, alerts, backup,
|
|
point-in-time recovery, and restore exercises.
|
|
6. Add membership lifecycle, token revocation, retention/export policy, and
|
|
project deletion/archival decisions. Event deletion is intentionally absent.
|
|
7. Pin and scan the base image; generate an SBOM and sign release artifacts.
|
|
8. Run load, fault, client interoperability, and penetration tests.
|
|
|
|
## MCP activation
|
|
|
|
The deployed endpoint must support `POST /mcp` with `application/json`. The
|
|
current service returns normal JSON instead of SSE and uses no session IDs.
|
|
Validate that each intended client accepts this stateless profile before
|
|
production gate acceptance.
|
|
|
|
Chat threads are not push subscribers. A client, automation, or PA invocation
|
|
must call `sync_since(last_cursor)`. The cursor itself belongs in durable client
|
|
state and is advanced only after successful processing.
|
|
|