Production responsibilities

Use Stable public APIs with application-owned operational controls. The overall package is Beta; evaluate each extension’s classification before adoption.

• Authenticate every request and authorize actions against a tenant-owned data partition.
• Keep provider credentials server-side, and apply request, time, concurrency and cost limits.
• Own Postgres backups, retention, migrations, checkpoint recovery and side-effect idempotency.
• Redact prompts, tool arguments, responses and secrets before telemetry export.
• Enable observability explicitly and bound label cardinality and sampling.
• Close streams and HTTP clients on cancellation and service shutdown.

See production APIs, observability and stability policy for the documented version. Evaluations, protocol hosting and Experimental APIs remain separately labeled extensions.

In 0.24, built-in OTel spans restrict attributes and omit exception payloads, stack traces, and idempotency keys. Review any application-added attributes too. Provider certification binds to the exact wheel, source, target and operation set; evidence older than 30 days is stale. Evidence from 0.23 does not certify 0.24.