KWJ Production Checklist

Setup

• SetupAPI token configured

  KWJ_API_KEY exported in your agent environment — verify with: curl https://kwj.ai/api/v1/health -H "Authorization: Bearer $KWJ_API_KEY"
• SetupHealth check passing

  GET /api/v1/health returns {"ok":true} — wire into your deployment pipeline before promoting.
• SetupCanary run complete

  Run a single agent turn with KWJ active and confirm token count drops vs baseline before scaling.

Performance

• PerfCache warm-up done

  Pre-populate cache_put for your top 10 repeated agent queries so cold-start sessions get immediate hits.
• Perfcontext_map before every slice

  Always call context_map first to get the symbol outline, then context_slice for just the needed function — never slice blind.
• PerfBuild output piped through digest

  POST build logs to /api/v1/digest before feeding to LLM. Collapses 10k-line cargo output to failures-only (usually <50 lines).

Security

• SecVault passphrase in env, not code

  KWJ_VAULT_PASS must come from a secrets manager or CI secret — never hardcoded or committed to repo.
• SecKWJ_PIN_VERSION pinned in prod

  Set KWJ_PIN_VERSION=1 so production never auto-upgrades to a new API version mid-deployment.
• SecToken rotation scheduled (90 days)

  Add a calendar reminder to rotate KWJ_API_KEY every 90 days — old key remains valid for 7 days post-rotation for zero-downtime deploys.

Observability

• ObsMetrics reviewed weekly

  GET /api/v1/metrics weekly — track cache_hit_rate, p95_compress_ms, and total_tokens_saved over the trailing 7 days.
• ObsTelegram alert configured

  Set ALERT_CHAT_ID + ALERT_BOT_TOKEN so KWJ can push budget and error alerts to your ops channel automatically.
• ObsCache hit rate target >60%

  A hit rate below 60% means your cache keys are too unique — broaden the key template or increase TTL to improve reuse.

Cost

• CostUsage tracking active

  Call meter_log after every LLM response. GET /api/v1/usage shows daily/monthly token spend vs cap.
• CostAlert if hit rate drops below 40%

  A sudden drop in cache hit rate signals a prompt template change or key-generation regression — alert and investigate within 24 hours.