How should artifact management be designed for production?

For production, use unique versions or digests, sign or verify artifacts where appropriate, scan dependencies, control retention, restrict publication permissions, and promote rather than rebuild artifacts. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.