Production configuration is validated input to the process, structured logs are queryable events with controlled fields, and health endpoints communicate distinct operational truths. The application should fail startup on invalid mandatory configuration, remain live during recoverable dependency trouble, and become unready when it cannot safely serve traffic.
Install pydantic-settings, use .env only for local development, and let production inject secrets. Never log model_dump() of settings. Validate cross-field rules: production may require HTTPS issuer metadata, while Redis stays optional unless an enabled feature requires it.
Use stable event names and bounded fields. High-cardinality values belong in traces or logs, not unconstrained metric labels. Hashing an identifier does not automatically anonymize it; treat the mapping risk seriously.
Avoid calling every dependency from liveness. A model-provider outage should not create a restart storm; keep the process live, mark the relevant capability degraded, and use a fallback or 503 for that feature.
Models add volatile latency, quotas, safety blocks, and cost. Record capability health and budgets separately from core API health. Do not expose raw prompts or retrieved documents in standard logs; use governed, sampled trace content with retention and access controls.
Implement configuration validation and three health states: healthy, database unavailable, and model provider unavailable. Capture logs containing a fake API key.
Acceptance criteria: invalid required config prevents startup, the fake key is absent, database failure removes readiness, and provider failure degrades only the AI capability.