> ## Documentation Index
> Fetch the complete documentation index at: https://docs.acornops.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Production readiness

> Validate a self-hosted deployment before operational use

Complete this checklist after installation and after material platform configuration changes.

## Release integrity

* The installed Helm chart or VM image references exactly match one published [`stack-versions.yaml` release matrix](https://github.com/acornops/acornops-deployment/blob/main/release/stack-versions.yaml).
* No component was upgraded independently from the rest of its pinned stack.
* The deployed image digests were recorded after registries resolved the pinned tags.

## Public access

* The management console loads through the intended console host.
* The public API is reachable only through the intended API and console proxy routes.
* OIDC returns to the exact registered callback.
* Execution-engine and LLM-gateway endpoints are not publicly reachable.
* NetworkPolicy ingress-controller peers match the controller that actually owns public routing.

## State and coordination

* Control-plane and LLM-gateway database migrations completed.
* Postgres and Redis use durable, monitored services.
* Backup and recovery procedures are documented and tested.
* Multiple replicas use the required Redis coordination paths.

## Identity and policy

* Enabled sign-in methods match deployment policy.
* Self-service signup and development login are disabled unless explicitly intended.
* Workspace roles and capability ceilings are reviewed.
* Admin API enablement, token storage, scopes, and audit handling are reviewed.

## Models and tools

* At least one approved provider and model is ready.
* A read-only run can stream events and complete.
* Write-capable tools require the intended approval policy.
* MCP and webhook egress allow only intended destinations.
* Remote credentials remain secret-backed.
* Provider base URLs and the OpenAI API surface match the intended endpoints and required native-tool behavior.

## Target connectivity

* A workspace can be created and listed.
* A registered AgentK can connect and report cluster inventory.
* A clean supported VM can install read-only AgentV using only the one copied enrollment command and report host inventory.
* A read-write VM installs only the selected exact restart-service allowlist and exposes `restart_service`; the default run policy requires approval, and an explicit auto-run policy still cannot bypass the local allowlist.
* The AgentV release matrix references a published bootstrap, archive, and checksum for the exact pinned version.
* AgentV same-command rerun, credential-free repair, failed-cutover rollback, reboot recovery, and credential replacement have passed the Ubuntu 24.04 live-systemd gate.
* AgentK keys and AgentV credentials can be replaced through their distinct supported flows.
* Connected targets require no public inbound route.
* Private-CA bundles are mounted where required without disabling certificate or hostname verification.

## Operations

* Health endpoints and metrics are scraped.
* Supplied alert rules are loaded.
* Logs exclude credentials, tokens, prompts, tool arguments, and sensitive target output.
* Complete tool-result artifacts and generated documents use approved size and retention limits.
* Upgrade, rollback, secret rotation, and incident ownership are documented.
* High-availability behavior has been exercised outside production when running multiple replicas.

Continue with [day-two operations](/deploy/operations).