docs/production_notes.md

Production Notes

Secrets

Real API keys must never be committed to GitHub.

Use:

• .env locally
• Hugging Face Secrets for Spaces
• Cloud secret managers in production

Generated Files

Do not commit:

• vector_db/
• outputs/
• logs/
• .env

Monitoring

A production RAG app should log:

• user question
• model name
• prompt version
• retrieved source chunks
• latency
• error type
• token usage if available

Safety

The model should answer only from retrieved context unless explicitly configured otherwise.

Evaluation

Maintain test questions with expected answers and expected sources.