> ## Documentation Index
> Fetch the complete documentation index at: https://usefused.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Production deployment

> Add the security, durability, and operations missing from the standalone launcher.

The standalone server is a runtime process, not a complete production platform.

Deploy the compiled `harnest-agent` launcher using the production runtime environment. Compiled agents and the Python runtime wheel exclude playground assets and its Markdown parser. The launcher does not expose playground, trace-viewer, or evaluation routes, even when `server.playground.enabled` is `true`; that setting only controls local `harnest serve`.

## Production checklist

| Before a remote deployment                          | Why                                                              |
| --------------------------------------------------- | ---------------------------------------------------------------- |
| Add an authenticator or trusted authenticated proxy | Identify callers                                                 |
| Replace `MemoryStore`                               | Keep sessions and checkpoints                                    |
| Share stores across replicas                        | Resume durable tools and serve response polling from any replica |
| Configure task PostgreSQL, when tasks exist         | Share queue jobs and results                                     |
| Inject model, MCP, and provider credentials         | Keep secrets out of source                                       |
| Terminate TLS outside the launcher                  | Protect traffic                                                  |
| Add process supervision and scaling                 | Run reliably                                                     |
| Enforce network policy outside the launcher         | Control reachability                                             |

## Ownership boundary

| Harnest standalone server         | Deployment platform                       |
| --------------------------------- | ----------------------------------------- |
| Agent API and event model         | TLS termination                           |
| Request limits and concurrency    | Secret injection                          |
| Application authentication hook   | External identity proxy, if used          |
| Session and checkpoint interfaces | Durable database operations               |
| Health endpoint                   | Process supervision and autoscaling       |
| Structured telemetry              | Collector, storage, alerts, and retention |

<Warning>
  A non-loopback bind is not a security boundary. `allowRemote: true` adds no authentication, TLS, or network policy.
</Warning>

<CardGroup cols={2}>
  <Card title="Authentication" icon="key" href="/docs/harnest/runtime/authentication-and-credentials">
    Establish caller identity and resolve downstream credentials.
  </Card>

  <Card title="Storage" icon="database" href="/docs/harnest/runtime/checkpoints-and-storage">
    Replace process-local state with a durable backend.
  </Card>

  <Card title="Durable execution" icon="rotate" href="/docs/harnest/runtime/durable-execution">
    Resume queued and external waits across replicas.
  </Card>

  <Card title="Telemetry" icon="chart-line" href="/docs/harnest/runtime/telemetry">
    Export privacy-safe logs, traces, and audit signals.
  </Card>

  <Card title="Server properties" icon="sliders" href="/docs/harnest/runtime/serving/server-configuration">
    Keep local runtime settings separate from platform operations.
  </Card>
</CardGroup>