Production deployment

Production checklist

Before a remote deployment	Why
Add an authenticator or trusted authenticated proxy	Identify callers
Replace `MemoryStore`	Keep sessions and checkpoints
Share stores across replicas	Resume durable tools and serve response polling from any replica
Configure task PostgreSQL, when tasks exist	Share queue jobs and results
Inject model, MCP, and provider credentials	Keep secrets out of source
Terminate TLS outside the launcher	Protect traffic
Add process supervision and scaling	Run reliably
Enforce network policy outside the launcher	Control reachability

Ownership boundary

Harnest standalone server	Deployment platform
Agent API and event model	TLS termination
Request limits and concurrency	Secret injection
Application authentication hook	External identity proxy, if used
Session and checkpoint interfaces	Durable database operations
Health endpoint	Process supervision and autoscaling
Structured telemetry	Collector, storage, alerts, and retention

A non-loopback bind is not a security boundary. allowRemote: true adds no authentication, TLS, or network policy.

Authentication

Establish caller identity and resolve downstream credentials.

Replace process-local state with a durable backend.

Resume queued and external waits across replicas.

Export privacy-safe logs, traces, and audit signals.

Keep local runtime settings separate from platform operations.