Implement one traceable happy path

Implement the smallest real flow before adding retries or optimization. Keep orchestration explicit so each decision can be tested and traced:

def provider_client() -> Client:
    versioned = secrets.get("llm/provider", stage="current")
    return Client(api_key=versioned.value,
                  telemetry={"credential_version": versioned.version})

# Rotation: create v2 -> stage v2 -> reload clients -> verify auth
# -> promote v2 current -> revoke v1 -> audit.

The handler should validate once, authorize before expensive work, and pass a structured context through each component. Record the release revision and configuration decision at the point they are made. Do not infer them later from deployment time; a request may cross a configuration update.

Use one correlation ID across the request, dependency calls, durable records, and outcome event. If the flow has an exposure or delivery ID, make it unique and immutable. Log a compact event with result category, duration, revision, and decision—not raw prompts, secrets, or complete customer objects. The resulting trace must answer: which code ran, which policy applied, what external facts were used, and what response class was returned?

Build one realistic fixture rather than a toy “hello world.” It should exercise the feature that justifies the release while remaining safe and deterministic. Assert the returned schema, cited or selected source identifiers, and side-effect count. Snapshot prose only when wording itself is contractual; otherwise assert structured facts so harmless model phrasing does not create brittle tests.

Call the endpoint twice with the same stable identity or delivery identifier. The repeated call must preserve cohort or avoid duplicate work as required by this system. Restart the process and repeat the test; in-memory correctness is insufficient where state must survive deploys. Then inspect the trace to verify it includes the attributes needed to slice authentication failures, consumers by credential version, secret-read anomalies, and time from issue to old-key revocation.

Measure the local baseline now. Capture median and p95 duration over at least 100 fixture requests, dependency call count, and output-quality score on the golden set. This is not a capacity claim; it is a regression baseline. Save the command, machine assumptions, and revisions with the result.

Do not add a dashboard, elaborate retry library, or generalized plugin system to make the happy path look production-ready. The chapter is complete when one valid request traverses real orchestration, emits attributable evidence, and produces the contracted result. The next chapters intentionally attack this slice. A narrow, visible implementation is easier to harden than a broad abstraction whose failure points are hidden.