#Production Readiness Checklist

Version: 0.33.0 Updated: 2026-03-15 Applies to: ranvier-core, ranvier-runtime, ranvier-http, ranvier-std, ranvier-inspector Category: Guides

#1. Authentication & Authorization

JWT secret loaded from environment variable (JWT_SECRET), never hardcoded
- See: `auth-tower-integration`, Security Guide
BearerAuth guard configured with timing-attack-safe validation (subtle::ConstantTimeEq)
- See: `inspector-demo`
IAM policy defined via Axon::with_iam() for role-based access control
- See: `auth-jwt-role-demo`
Token expiration and refresh strategy decided
Sensitive endpoints protected (admin routes, data exports)

#2. Security

CorsGuard configured with explicit allowed origins (not * in production)
- See: `guard-demo`
RateLimitGuard applied to public-facing endpoints
- See: `guard-demo`
SecurityHeadersGuard injecting HSTS, CSP, X-Frame-Options
IpFilterGuard configured for admin endpoints if needed
Error responses do not leak stack traces in release mode (Sensitive<T> for redaction)
- See: Security Guide §Error Responses
XorEncryption NOT used for production (deprecated, feature-gated)

#3. Observability

OpenTelemetry exporter configured for traces and metrics
- See: `telemetry-otel-demo`, OTel Ops Playbook
/health and /ready endpoints implemented for load balancer probes
- See: `production-config-demo`
tracing_subscriber initialized with appropriate log levels (RUST_LOG env var)
Inspector dashboard access restricted in production (BearerAuth required)
- See: `inspector-demo`
Audit logging enabled for compliance-relevant operations
- See: `audit-demo`

#4. Resilience

then_with_retry() applied to external service calls with appropriate policy
- RetryPolicy::exponential_default(max_attempts, initial_ms) recommended
- See: `resilience-patterns-demo`
then_with_timeout() applied to operations with unpredictable latency
- See: `resilience-patterns-demo`
Graceful shutdown timeout configured (Tokio signal handler)
- See: `production-operations-demo`
External service calls use Outcome::Fault for retryable errors, Outcome::Branch for client errors
- See: `service-call-demo`

#5. Data & Persistence

Connection pool configured with appropriate max_connections and min_connections
Persistence store selected:
- InMemoryPersistenceStore — local development only
- PostgresPersistenceStore — durable production storage (persistence-postgres feature)
- RedisPersistenceStore — ephemeral/fast checkpoints (persistence-redis feature)
- See: `state-persistence-demo`
ensure_schema() called at startup for PostgresPersistenceStore
Compensation hooks defined for critical workflows (CompensationHook trait)
- See: `state-persistence-demo`
Database table names validated (SQL injection prevention via whitelist pattern)

#6. Deployment & Build

Build with --release profile (LTO, strip, codegen-units=1)
```
cargo build --release
```
Dockerfile uses multi-stage build (builder → runtime)
- See: Deployment Guide

Environment variables documented and loaded:

JWT_SECRET=...          # Required for auth
DATABASE_URL=...        # Required for PostgresPersistenceStore
RUST_LOG=info           # Log level
OTEL_EXPORTER_OTLP_ENDPOINT=...  # Optional: OTLP collector

Secrets NOT committed to version control (.env in .gitignore)
Health check endpoint configured in container orchestrator

#7. CI/CD Pipeline

A minimal GitHub Actions pipeline for Ranvier projects:

name: CI
on: [push, pull_request]
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
      - run: cargo check --workspace
      - run: cargo test --workspace
      - run: cargo clippy --workspace -- -D warnings
      - run: cargo build --release

Tips:

Cache ~/.cargo/registry and target/ for faster builds
Run cargo clippy -- -D warnings to catch lint issues early
For feature-gated code: cargo test --workspace --features persistence-postgres
Consider separate jobs for check, test, clippy for parallel execution

#Quick Validation

# Full workspace check
cargo check --workspace
cargo test --workspace
cargo clippy --workspace

# Run with production-like settings
RUST_LOG=info JWT_SECRET=test-secret cargo run -p your-app --release

Security Guide — security hardening details
OTel Ops Playbook — observability setup
Persistence Ops Runbook — persistence operations
Bus Access Patterns — Bus method selection guide
API Stability Contract — v1.0 API freeze boundaries