docs/PRODUCTION_OPERATOR_CHECKLIST.md

Production Operator Checklist

Use this checklist before running the PII Redactor as a KG/RAG ingestion firewall in a regulated environment.

Required Configuration

• PIIR_REQUIRE_API_KEY=true
• PIIR_REQUIRE_PRODUCTION_SAFETY=true
• PIIR_BACKEND=ollama, llama_cpp, or hf
• PIIR_BACKEND is not mock
• PIIR_API_KEY is set
• PIIR_REIDENTIFY_API_KEY is set and differs from PIIR_API_KEY
• PIIR_AUDIT_KEY is set
• PIIR_FAIL_ON_LLM_ERROR=true
• PIIR_MAX_TEXT_CHARS is set for the deployment tier
• PIIR_MAX_BATCH_DOCS is set for the deployment tier

Model Controls

• Confirm model_used from /redact is the intended model.
• For this machine, current validated local model is qwen2.5:7b.
• Keep Qwen/Ollama timeout high enough for long documents: PIIR_LLM_TIMEOUT_SECONDS=600.
• Use deterministic temperature for audit reproducibility.

Audit Controls

• Store PIIR_AUDIT_KEY outside source control.
• Rotate PIIR_AUDIT_KEY through a documented break-glass process.
• Restrict /reidentify to caseworker or administrator roles only.
• Use a separate PIIR_REIDENTIFY_API_KEY; do not reuse the redaction API key.
• Review audit-log storage location before pilot ingestion.

KG/RAG Ingestion Controls

• Raw sources go to raw/incoming or another non-ingestion staging area.
• KG/RAG ingestion consumes only raw/redacted outputs.
• Use scripts/register-source-secure.ps1 for source registration by default.
• Direct scripts/register-source.ps1 raw registration requires explicit -AllowRaw.
• Keep PII manifests under manifests/pii-redaction.

Pre-Pilot Gates

• Full production gate passes.
• Encrypted audit gate passes.
• Qwen/Ollama quick gate passes if using Ollama.
• Docker image builds.
• Docker production-safety mock refusal passes.
• Docker real-backend API smoke passes.
• Secure KnowledgeGraph wrapper smoke passes.

Latest passing validation record:

• docs/KG_RAG_PRODUCTIZATION_VALIDATION_20260504.md

Pilot Exit Criteria

• Zero known plaintext PII leaks in redacted outputs.
• Audit metadata contains no plaintext original values.
• Re-identification works only with the audit key and re-identification credential.
• Operators can reproduce evidence packs from run directories.
• Any failed ingestion fails closed before graph/vector ingestion.