Juicebox Prod ChecklistSAFE

Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: juicebox-prod-checklist
description: 'Execute Juicebox production checklist.

  Trigger: "juicebox production", "deploy juicebox".

  '
allowed-tools: Read, Bash(curl:*), Grep
version: 1.16.0
license: MIT
author: Jeremy Longshore <[email protected]>
tags:
- saas
- recruiting
- juicebox
compatibility: Designed for Claude Code
---
# Juicebox Production Checklist

## Overview

Juicebox provides AI-powered people search and analysis, enabling dataset creation, candidate discovery, and structured analysis across professional profiles. A production integration queries datasets, retrieves analysis results, and powers talent intelligence workflows. Failures mean missed candidates, stale analysis data, or quota exhaustion that blocks time-sensitive searches.

## Authentication & Secrets

- [ ] `JUICEBOX_API_KEY` stored in secrets manager (not config files)
- [ ] API key scoped to production workspace only
- [ ] Key rotation schedule documented (90-day cycle)
- [ ] Separate credentials for dev/staging/prod environments
- [ ] Candidate data access restricted to authorized roles

## API Integration

- [ ] Production base URL configured (`https://api.juicebox.ai/v1`)
- [ ] Rate limiting configured per plan tier
- [ ] Dataset creation and query endpoints tested end-to-end
- [ ] Analysis result pagination implemented for large datasets
- [ ] Search query optimization validated (precision vs recall tradeoffs)
- [ ] Bulk analysis requests batched to avoid rate limits
- [ ] Result caching configured for repeated queries

## Error Handling & Resilience

- [ ] Circuit breaker configured for Juicebox API outages
- [ ] Retry with exponential backoff for 429/5xx responses
- [ ] Candidate data encrypted at rest in downstream storage
- [ ] GDPR/CCPA retention policy enforced on stored profiles
- [ ] Empty result sets handled gracefully (no silent failures)
- [ ] Quota exhaustion detected before critical searches fail

## Monitoring & Alerting

- [ ] API latency tracked per endpoint (search, analysis, datasets)
- [ ] Error rate alerts set (threshold: >5% over 5 minutes)
- [ ] Quota usage monitored with alert at 80% consumption
- [ ] Analysis completion rate tracked for reliability metrics
- [ ] Daily digest of search volumes and result quality

## Validation Script

```typescript
async function checkJuiceboxReadiness(): Promise<void> {
  const checks: { name: string; pass: boolean; detail: string }[] = [];
  // API connectivity
  try {
    const res = await fetch('https://api.juicebox.ai/v1/search', {
      method: 'POST',
      headers: { Authorization: `Bearer ${process.env.JUICEBOX_API_KEY}`, 'Content-Type': 'application/json' },
      body: JSON.stringify({ query: 'test', limit: 1 }),
    });
    checks.push({ name: 'Juicebox API', pass: res.ok, detail: res.ok ? 'Connected' : `HTTP ${res.status}` });
  } catch (e: any) { checks.push({ name: 'Juicebox API', pass: false, detail: e.message }); }
  // Credentials present
  checks.push({ name: 'API Key Set', pass: !!process.env.JUICEBOX_API_KEY, detail: process.env.JUICEBOX_API_KEY ? 'Present' : 'MISSING' });
  // Quota check
  try {
    const res = await fetch('https://api.juicebox.ai/v1/usage', {
      headers: { Authorization: `Bearer ${process.env.JUICEBOX_API_KEY}` },
    });
    const data = await res.json();
    const pct = data?.usagePercent || 0;
    checks.push({ name: 'Quota Headroom', pass: pct < 80, detail: `${pct}% used` });
  } catch (e: any) { checks.push({ name: 'Quota Headroom', pass: false, detail: e.message }); }
  for (const c of checks) console.log(`[${c.pass ? 'PASS' : 'FAIL'}] ${c.name}: ${c.detail}`);
}
checkJuiceboxReadiness();
```

## Error Handling

| Check | Risk if Skipped | Priority |
|-------|----------------|----------|
| API key rotation | Expired key blocks all searches | P1 |
| GDPR/CCPA retention | Regulatory violation on candidate data | P1 |
| Quota monitoring | Exhaustion blocks time-sensitive searches | P2 |
| Rate limit handling | Bulk analysis requests rejected | P2 |
| Data encryption at rest | Candidate PII exposure risk | P3 |

## Prerequisites

- A protected production change approval, named data/incident/rollback owners, and a pinned configuration revision proven with synthetic lead fixtures.
- Source authority, lawful/consented-use policy, suppression policy, destination allowlist, and an explicit stop condition for scope or privacy drift.

## Instructions

1. Confirm environment, secret reference, source authority, enrichment scope, destination, suppression policy, and approval before any production action.
2. Run a bounded synthetic canary and verify source/destination scope, data minimization, suppression, and aggregate output assertions.
3. Monitor error, quota, freshness, and policy probes through the observation window; halt on an unauthorized source, recipient, or destination.
4. Promote in stages or restore the prior revision and delete staged artifacts according to the retention policy.
5. Close only after owner acceptance of the redacted receipt and revocation of temporary access.

## Output

Create a readiness receipt with revision, synthetic canary, source/destination checks, suppression result, aggregate assertions, approvals, outcome, retention, and rollback reference. Exclude identities, contact details, enrichment values, and secrets.

## Examples

`revision=r44; canary=synthetic-prospects; source=approved; destination=approved; suppression=pass; contacts_exported=0; outcome=hold-for-owner; rollback=r43` is a complete canary decision.

## Resources

- [Juicebox Platform](https://juicebox.ai)
- Juicebox Status

## Next Steps

See `juicebox-security-basics` for candidate data protection and compliance.

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.