# LedgerLens production-pilot checklist

## Access and ownership

- [ ] Protect `app.ledgerlens.dev` with Cloudflare Access and allow only pilot emails.
- [ ] Add each user to the LedgerLens workspace with the minimum role they need.
- [ ] Keep at least two owner accounts and test owner recovery before launch.
- [ ] Create one developer API key per agent integration; never embed an owner credential.
- [ ] Rotate the integration key once before production and store it in the agent platform's secret manager.

## Runtime protection

- [ ] Create an active spend policy with a merchant allowlist, per-payment cap, daily budget, approval threshold, and velocity limit.
- [ ] Call `POST /api/v1/policies/preflight` before the payment provider API.
- [ ] Execute only when the decision is `allow`; route `review` to a human and stop on `deny`.
- [ ] Commit the reservation after provider success or release it after provider failure.
- [ ] Send mandate, intent, offer, policy result, execution, and receipt to the Universal Evidence API.

## Evidence and recourse

- [ ] Confirm the captured transaction has six artifacts and a valid Ed25519 packet signature.
- [ ] Open and resolve one test case; export and independently verify its proof.
- [ ] Confirm retention matches legal, privacy, and insurance requirements.
- [ ] Document the issuer/network submission owner; native chargeback submission requires partner credentials.

## Operations

- [ ] Configure a signed webhook endpoint and verify a test delivery.
- [ ] Monitor `https://api.ledgerlens.dev/api/v1/health` from outside Cloudflare.
- [ ] Route failed health checks and webhook dead letters to an on-call owner.
- [ ] Set Cloudflare billing alerts and hard usage limits for nonessential services.
- [ ] Agree pilot success metrics: protected volume, denial/review rate, packet completeness, dispute time, and API availability.

## Partner-dependent work

- [ ] Obtain Visa TAP/AP2 or Mastercard Agent Pay access and certification for native connectors if required.
- [ ] Obtain issuer/acquirer credentials for direct chargeback and arbitration submission.
- [ ] Agree data-sharing terms with the insurer or risk partner before exposing evidence.