Skip to content

FLT-75 rollback and kill-switch checklist

Use this checklist for suspected token exposure, unexpected messages, duplicate processing, incorrect handoff, or any behavior outside the approved pilot boundary.

Immediate containment

  • [ ] Set the intake service to disabled/maintenance mode. Stop consuming Slack Socket Mode and AgentMail WebSocket events; preserve logs and the local database.
  • [ ] Disable the Slack app in the pilot workspace or remove it from the intake channel. Do not delete the channel or evidence.
  • [ ] Set ProactiveDirectMessagesEnabled to false (it must already be false for the pilot), and stop scheduled reminders/clarification prompts. Honor any existing STOP requests.
  • [ ] Disable the AgentMail inbox subscription/consumer for the dedicated mailbox.
  • [ ] Set the Jira and Confluence handoff adapters to dry-run/disabled. Confirm no further issues or pages can be created or updated.
  • [ ] Confirm IFleetDispatchQueue remains disabled; no intake path may launch an agent, create a worktree, or bypass FLT-80.

Credential response

  • [ ] Revoke and rotate SLACK_APP_TOKEN and SLACK_BOT_TOKEN if Slack access may be exposed.
  • [ ] Revoke and rotate AGENTMAIL_API_KEY and any AgentMail subscription-signing secret if email access may be exposed.
  • [ ] Revoke and rotate JIRA_API_TOKEN, CONFLUENCE_API_TOKEN, and GOOGLE_SITE_PUBLISHER_CREDENTIAL if their scopes may be exposed.
  • [ ] Update secret references only after rotation; never record secret values in the incident ticket or docs.

Stabilize and recover

  • [ ] Record the incident time window, event/message IDs, affected requester IDs, configuration version, and actions taken in Jira. Minimize copied message content.
  • [ ] Identify and quarantine duplicate or partial intake records. Preserve provenance and idempotency keys for investigation.
  • [ ] Reconcile Jira/Confluence artifacts created during the incident; correct or archive only after owner approval.
  • [ ] Fix and peer-review the cause. Re-run the pilot verification in dry-run mode.
  • [ ] Re-enable one transport at a time: Slack Socket Mode, then AgentMail WebSocket, then Jira/Confluence handoff. Verify the approved channel/mailbox and allowlist before each step.
  • [ ] Obtain pilot-owner sign-off before returning to normal pilot operation.