Checklist

Use this before enabling live operator traffic.

Integration contract

• operator launch endpoint working
• wallet adapter endpoints working
• operation lookup implemented
• webhook receiver signature verification working
• dedupe by event_id working

Credentials and secrets

• API keys split by workload
• webhook secret stored in secret manager
• wallet adapter auth secret stored in secret manager
• optional wallet signature secret stored separately
• no secrets in repo, docs, tickets, or screenshots

Behavior validation

• happy-path buy validated
• happy-path sell or redemption validated
• duplicate idempotency safely replayed
• webhook retry drill passed
• dead-letter replay drill passed
• unknown wallet result drill passed

Operations

• team knows where to inspect failed deliveries
• team knows where to inspect balance operations
• support escalation template prepared
• UTC timestamps used in logs and runbooks

Release approval

• operator-side owner approved go-live
• Polynion-side owner approved go-live
• rollback owner identified
• contact path for launch-day incident agreed