The purpose of this checklist
Most bot problems are not caused by one missing line of code. They come from unclear inputs, hidden assumptions, missing state, unsafe retries, leaked secrets or no plan for restarts. Write these decisions down first.
1. Define the job
- What exact event starts the bot?
- What data must exist before it can decide?
- What action is allowed?
- What action is explicitly forbidden?
- What should happen when data is missing or stale?
2. Define the data contract
- List every required input field and its type.
- Give events a unique ID.
- Include a timestamp and define how old is too old.
- Normalize external names into your own internal names.
- Reject unexpected actions rather than guessing.
3. Choose the runtime
- Does it need to run continuously or only when called?
- Does your home PC need to be independent from it?
- Does it need Windows, Linux, MetaTrader or a browser?
- Does it need a public URL?
- Where will state and logs live?
4. Handle secrets correctly
- No passwords or API keys in HTML, Git repositories or screenshots.
- Use Worker secrets, environment variables or a secret store.
- Know how to rotate credentials.
- Use separate demo and live credentials where possible.
5. Design failure behavior
- Define timeout behavior.
- Do not blindly retry an uncertain action.
- Make duplicate events harmless through idempotency.
- Add a kill switch that blocks new actions without destroying logs.
- Decide how the service restarts after a crash or reboot.
6. Test in layers
- Test parsing and validation with local examples.
- Test decision logic without an external API.
- Mock broker/API responses.
- Use demo/paper environment.
- Test invalid input deliberately.
- Test network failure and timeout behavior.
- Restart the service and verify recovery.
7. Make the system observable
Logs should answer: what event arrived, what decision was made, why it was accepted or rejected, what external request was attempted, what response came back and whether state was updated. A heartbeat or health endpoint should tell you that the service is alive; a useful monitor should also tell you whether it is still receiving fresh data and completing its work.
8. Write an AI prompt from the checklist
Build the smallest working version of this bot.
Runtime: [exact runtime]
Language/version: [exact version]
Input schema: [exact fields and types]
Output/action: [exact behavior]
State: [database/KV/file/none]
Authentication: [mechanism, no hard-coded secrets]
Duplicate rule: [event_id behavior]
Timeout/retry rule: [exact behavior]
Logging: [fields to log]
Tests: [required tests]
Before coding, list assumptions and missing requirements.
Do not invent platform APIs or undocumented functions.