Production checklist

Review identity injection, route authorization, signature verification, idempotency, telemetry, and recovery before sending production traffic through Incld.

Identity and authorization

Check	Required outcome
Server-only credentials	Secret key and webhook secret are absent from client bundles and public environment variables.
Trusted context	resolveContext returns null for anonymous requests and derives user/organization IDs from the server session.
Authorization	authorize denies operations that the authenticated application user cannot perform.
Approval enforcement	Sensitive business actions call approvals.check on the server; ApprovalGate is treated as presentation only.
Audit visibility	Participant and restricted events are queried through the proxy so viewer identity cannot be selected by the browser.

Delivery and idempotency

Check	Required outcome
Separate routes	The same-origin browser proxy and signed webhook endpoint are distinct routes.
Signature verification	The framework webhook handler receives the unmodified request body and current signing secret.
Idempotent handlers	Action handlers deduplicate on event.idempotencyKey before producing external side effects.
Request idempotency	Schedule, approval, decision, Audit, and Bulk creates use stable Idempotency-Key values on retries.
Timeouts	Long application work is queued or checkpointed; the webhook response does not depend on an unbounded request.

Operations

Check	Required outcome
Action sync	Deployment runs syncActions after code is available and before users create schedules or bulk operations.
Health	Your deployment observes both /health/live and /health/ready for the platform service.
Alerts	Failed/retrying runs, expiring approvals, failed chunks, and notification delivery failures are monitored.
Secret rotation	Rolling an API or webhook secret includes an application rollout and an explicit rollback window.
Usage	Component meters and estimated overage are reviewed in Plan & billing before launch volume is enabled.

Release sequence

01

Stage with production-shaped auth

Make sure you test with your actual authentication system, rather than hardcoded demo users.
02

Run an end-to-end canary

Test the entire flow: creating tasks in the UI, catching webhooks, checking retries, and verifying audit logs.
03

Load and failure test

See how your app handles the messy stuff: duplicate webhooks, slow handlers, and missed schedules.
04

Enable production credentials

Create production API keys, configure your live webhook, sync your actions, and start with a small amount of real traffic.