Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Launch & operations·20 in this wave

GO / NO-GO decisionTo do · blocker TacTile v1.0 LAUNCHEDTo do · blocker Remove the Ben Ari simulator auto-loginTo do Strip the iOS device-trust bypass emailTo do Run the cut-list checkpointTo do Verify the full end-to-end customer journeyTo do Freeze the release candidateTo do Write the launch-day runbookTo do Plan the rolloutTo do Audit both apps for purchase links and upgrade CTAsTo do Plan for store rejectionTo do Verify Stripe is production-ready, not test-modeTo do Confirm the legal documents are actually published and linkedTo do Build kill switches for the agent and other risky featuresTo do Rehearse the rollback before launch dayTo do Take a pre-launch backup and confirm the restore pathTo do Verify the production domain map and DNS before cutoverTo do Set up launch-day monitoring watchTo do Prepare customer support for launchTo do Post-launch watch windowTo do

Wave

Launch & operations

Where everything converges. Pre-release hardening, the cut-list checkpoint, store submissions, and the go/no-go call.

TacTile › Launch TacTile › Launch & operations

0/20 done20 open2 open blockers

Selected taskclear

Build kill switches for the agent and other risky features

To doOwner · Vivt_8ee3cee7

Unlocks 2Write the launch-day runbook GO / NO-GO decision

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Build kill switches for the agent and other risky features** · to do

Where it sits: TacTile › Launch TacTile › Launch & operations

## Unlocks 2

- Write the launch-day runbook
- GO / NO-GO decision

## The brief on file

Viv — make it possible to turn a feature off without shipping a build. Done when: the AI agent, RAG retrieval, and the MCP surface can each be disabled by remote config or an environment flag, taking effect without an app release, and this is documented in the launch-day runbook as a rollback lever. WHY THIS MATTERS MORE THAN USUAL: the agent is the flagship and it takes actions on customers' behalf — if it misbehaves at launch there is currently no way to stop it on mobile, because an app fix means a new build plus review, which is days. Note a precedent already exists to copy: SENTRY_KILL_SWITCH in docs/runbooks/observability.md. The MCP surface is externally callable by third-party agents, which makes a remote off-switch there a safety control rather than a convenience.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Launch & operations

Build kill switches for the agent and other risky features