Customerio Prod ChecklistSAFE

Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: customerio-prod-checklist
description: 'Execute Customer.io production deployment checklist.

  Use when preparing for production launch, auditing integration

  quality, or performing pre-launch validation.

  Trigger: "customer.io production", "customer.io checklist",

  "deploy customer.io", "customer.io go-live", "customer.io launch".

  '
allowed-tools: Read, Write, Edit, Bash(curl:*), Bash(npx:*), Glob, Grep
version: 1.14.0
license: MIT
author: Jeremy Longshore <[email protected]>
tags:
- saas
- customer-io
- deployment
- production
- audit
compatibility: Designed for Claude Code
---
# Customer.io Production Checklist

## Instructions

1. Complete every production gate with an evidence link: workspace/environment, identity, secret scope, consent, event/schema, template review, observability, rate limits, and rollback.
2. Verify the exact production audience and suppression/consent behavior using approved safe checks.
3. Hold release when any data, identity, delivery, or owner gate is unverified.
4. Record the named go/no-go decision and post-deployment observation result.

## Output

- A production-readiness receipt with owners, evidence, exceptions, and tested rollback path.

## Examples

Before enabling a campaign, validate it in staging with synthetic profiles, confirm the production segment and consent/suppression logic under review, and use an approved canary audience. If the canary differs from expected behavior, stop the launch and restore the previous version rather than widening sends.

## Overview

Comprehensive go-live checklist for Customer.io integrations: credentials audit, integration quality review, email deliverability setup, monitoring configuration, smoke tests, and staged rollout plan.

## Prerequisites

- Customer.io integration complete and tested in staging
- Production workspace credentials ready
- Sending domain configured and verified

## Production Checklist

### 1. Credentials & Configuration

| Item | Check | How to Verify |
|------|-------|---------------|
| Production Site ID | Correct workspace | Settings > API & Webhook Credentials |
| Production Track API Key | Different from dev/staging | Compare with staging `.env` |
| Production App API Key | Set for transactional messages | Test with `curl` bearer auth |
| Region setting | Matches account region (US/EU) | Settings > Workspace Settings |
| Secrets storage | In secrets manager, not `.env` | Check deployment config |
| Key rotation schedule | Documented (90-day cycle) | Calendar reminder set |

### 2. Integration Quality

```typescript
// scripts/prod-audit.ts
import { TrackClient, RegionUS } from "customerio-node";

async function auditIntegration() {
  const checks: { name: string; pass: boolean; detail: string }[] = [];

  // Check 1: Credentials exist
  const siteId = process.env.CUSTOMERIO_SITE_ID;
  const trackKey = process.env.CUSTOMERIO_TRACK_API_KEY;
  const appKey = process.env.CUSTOMERIO_APP_API_KEY;
  checks.push({
    name: "Track credentials",
    pass: !!(siteId && trackKey),
    detail: siteId ? `Site ID: ${siteId.substring(0, 4)}...` : "MISSING",
  });
  checks.push({
    name: "App API credential",
    pass: !!appKey,
    detail: appKey ? "Set" : "MISSING (needed for transactional)",
  });

  // Check 2: API connectivity
  if (siteId && trackKey) {
    const cio = new TrackClient(siteId, trackKey, { region: RegionUS });
    try {
      await cio.identify("prod-audit-test", {
        email: "[email protected]",
      });
      await cio.suppress("prod-audit-test");
      checks.push({ name: "Track API", pass: true, detail: "Connected" });
    } catch (err: any) {
      checks.push({
        name: "Track API",
        pass: false,
        detail: `${err.statusCode}: ${err.message}`,
      });
    }
  }

  // Report
  console.log("\n=== Customer.io Production Audit ===\n");
  for (const check of checks) {
    const icon = check.pass ? "PASS" : "FAIL";
    console.log(`[${icon}] ${check.name}: ${check.detail}`);
  }
  const passed = checks.filter((c) => c.pass).length;
  console.log(`\nResult: ${passed}/${checks.length} passed`);
  return checks.every((c) => c.pass);
}

auditIntegration().then((ok) => process.exit(ok ? 0 : 1));
```

### 3. Email Deliverability

| Item | Status | Dashboard Location |
|------|--------|-------------------|
| Sending domain verified | Required | Settings > Sending Domains |
| SPF record published | Required | DNS TXT record |
| DKIM record published | Required | DNS CNAME record |
| DMARC policy set | Recommended | DNS TXT record `_dmarc.yourdomain.com` |
| Return-Path configured | Recommended | Settings > Sending Domains |
| Unsubscribe link in all marketing emails | Required (CAN-SPAM) | Template editor |
| Physical address in marketing emails | Required (CAN-SPAM) | Template editor |

### 4. Campaign Readiness

- [ ] All campaigns tested with test sends
- [ ] Liquid templates render correctly (preview with real data)
- [ ] Segment conditions verified with known test users
- [ ] Transactional templates have all required `message_data` fields
- [ ] Broadcast triggers tested end-to-end
- [ ] Unsubscribe flow tested (click unsubscribe link, verify suppression)

### 5. Monitoring & Alerting

```typescript
// Set up these alerts in your monitoring system:
const ALERT_THRESHOLDS = {
  // API health
  api_error_rate: 0.01,       // Alert if > 1% of API calls fail
  api_p99_latency_ms: 5000,   // Alert if p99 > 5 seconds

  // Delivery health
  bounce_rate: 0.05,          // Alert if > 5% bounce rate
  complaint_rate: 0.001,      // Alert if > 0.1% spam complaints
  delivery_rate: 0.95,        // Alert if < 95% delivery rate

  // Operational health
  queue_depth: 10000,         // Alert if event queue > 10K pending
  webhook_error_rate: 0.05,   // Alert if > 5% webhook processing failures
};
```

### 6. Smoke Test Script

```bash
#!/usr/bin/env bash
set -euo pipefail

echo "=== Customer.io Production Smoke Test ==="

# Test 1: Track API

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.