Channel Adapter Production Checklist

Use this checklist before shipping any custom UI, Slack, or WhatsApp adapter.

Reliability

• All message writes include Idempotency-Key.
• Duplicate inbound provider events are deduped before Rooaak send.
• Pending Rooaak responses are handled via polling or webhook completion.

Security

• Provider signatures verified (Slack / Meta).
• Rooaak webhook signatures verified.
• Secrets never logged.
• Secrets rotated on a regular cadence.

Webhooks and retries

• message.responded webhook registered to adapter endpoint.
• Receiver returns 2xx only after successful handling.
• Receiver is idempotent on X-Rooaak-Delivery.
• Backoff behavior understood (30s, 2m, 8m, 32m, 2h).

Observability

• Log correlation fields (messageId, sessionId, provider IDs, correlationId).
• Alert on sustained webhook delivery failures.
• Capture provider API error responses for support debugging.

Operational readiness

• Health endpoint (/healthz) monitored.
• End-to-end smoke test run in production for each enabled channel.
• Runbook documented for token expiry, secret rotation, and provider app changes.