V1 Launch Timeline — Phased Rollout Skeleton

Status: planning baseline, created 2026-06-12 to close V1_V7_PLAN_SET_AUDIT_2026-06-12.md §6.1(4) (no calendar/sequencing anywhere). Calendar dates are TBD; the structure, relative durations, cohort sizes, promotion criteria, and decision owners below are the commitments. T0 = the day Gate G0 passes. The launch phases instantiate the readiness ladder already named in the spec — internal dogfood → safety review → quality review → private beta → go/no-go → GA with canary analysis (V1/features.md:6206-6209) — and the canary percentages reuse the spec's own ramp schedule for workflow classes (1 % → 5 % → 25 % → 50 % → 100 %, V1/features.md:3576).

Cohort sizes and durations are planning assumptions adopted 2026-06-12; each carries its derivation inline.

Decision roles#

A gate decision is a recorded artifact (decision, evidence links, dissents) in the launch-readiness review — the pattern the spec already requires (V1/features.md:5014, :6206-6209).

Gate G0 — Code-complete / readiness baseline (opens Phase 1)#

Entry evidence, all required:

1. V1 Exit Criteria verified per the TODOS one-task-one-verification rule (V1/features.md:6211-6254; checkbox state is the only source of truth).
2. Workflow-class release gates green for all five Living Scenes templates: continuity, determinism, watermark, cue policy, crisis, accessibility (V1/features.md:4483-4486).
3. Tenant-isolation suite green (tests/security/tenant-isolation/, launch-gating per V1/ARCHITECTURE.md:1237-1239).
4. C2PA SDK gap closed (V1/DEPENDENCIES.md §19; RISK_REGISTER R-09).
5. Per-domain DB provisioning resolved (RISK_REGISTER R-17).
6. DR-1 restore drill passed (SLO_AND_DR §6).
7. Payments end-to-end on test substrate: regtest/testnet invoice → confirm → entitlement → refund → sweep for every rail, including induced reorgs (V1/DEPENDENCIES.md:435).
8. Capacity load tests LT-1..LT-6 defined and runnable (passing required at G2, not here).

Decision owner: Launch Director, with QA Lead and SRE Lead co-sign.

Phase 1 — Internal dogfood (T0 → T0+30, minimum 30 days — hard floor)#

• Cohort: all staff + ~50 friends-and-family accounts (≈ 150–250 users — planning assumption: large enough to exercise every template, locale spot-checks, and both mobile platforms daily; small enough that incidents are conversations, not tickets).
• Scope: full product including crypto checkout on testnet-priced internal invoices; no school tenants, no real-money GA pricing.
• Mandatory usage: every product/eng lead completes each of the five Living Scenes templates, one voice tutoring session, and one crypto payment per week — dogfood that nobody is forced to do does not happen.
• Exit criteria (Gate G1):
  • ≥ 30 days elapsed, zero Sev-1 safety incidents, all dogfood Sev-2s closed.
  • Crash-free sessions ≥ 99.5 % both mobile platforms.
  • Safety review passed: crisis-frame, cue-policy, and PSE fixture suites re-run on the dogfood build (Safety Lead veto point).
  • Voice p95 and first-frame p95 within spec budgets at dogfood load.
  • Dogfood exit survey: ≥ 70 % of staff answer "ready for outsiders" (planning assumption: a deliberately blunt, low-tech leading indicator).
• Decision owner: Launch Director; Safety Lead veto.

Phase 2 — Private beta (T0+30 → ≈ T0+90, three waves)#

• Real payments switch on in W2 for regions whose crypto go/no-go gate has passed (CRYPTO_REGULATORY_REVIEW §7); unpassed regions see entitlement trials only.
• Wave-promotion criteria (each wave): previous wave ≥ 14 days; activation (completed first Living Scene or tutoring session within 48 h of signup) ≥ 40 %; D7 retention ≥ 25 % (planning assumptions: mid-range consumer-subscription benchmarks — these are tripwires for investigation, not vanity targets; Product Lead may promote with a written rationale if a metric misses but diagnosis is benign); support contact rate < 8 tickets / 100 WAU; no SLO over error budget (SLO_AND_DR §2).
• Exit criteria (Gate G2):
  • Load tests LT-1..LT-6 passed against the beta-validated capacity model (CAPACITY_MODEL §7), with observed beta attach rates folded into the re-forecast (§8).
  • DR-2 region-loss game day passed (SLO_AND_DR §6).
  • Beta metrics accepted by Product Lead; blocking-issue list empty (V1/features.md:6206-6207).
  • Locale decision recorded per locale: launch or launch-dark (RISK_REGISTER R-15).
  • Payments: ≥ 500 real settled invoices across ≥ 5 rails with confirmation success ≥ 99.5 % and zero entitlement-grant errors; refund drill executed on mainnet (Payments Lead sign-off).
  • App Store / Play approvals in hand (or the no-paywall iOS contingency invoked, R-11).
• Decision owners: Launch Director; Safety Lead veto; SRE, Payments, QA co-sign; General Counsel for each payments region; Education Compliance Officer for the school wave.

Phase 3 — Canary GA ramp (≈ T0+90 → T0+120)#

Signup throttle opens to the public in steps using the spec's ramp schedule (V1/features.md:3576). "Percentage" = fraction of the public waitlist/signup inflow admitted; existing beta users are unaffected.

• Rollback triggers (any step, automatic halt + Launch Director page): SLO burn ≥ 6× over 6 h on any 99.9-tier surface; any Sev-1 safety incident; any crisis-path failure (Sev-1 by definition, SLO_AND_DR §1); sanctions screening hit mishandled; queue BLACK state > 30 min. Halt = freeze admission at current step; rollback = re-throttle to previous step (the product itself rolls back by workflow-class version per V1/features.md:4487-4490).
• Decision owner per promotion: Launch Director with SRE Lead co-sign; Safety Lead veto standing.

Gate G3 — GA declaration#

All of: C4 soak clean; every RED risk in RISK_REGISTER has its mitigation verified in place (not merely written); public status page, store listings, deep links live (V1/features.md:6242-6243); runbook inventory complete (V1/features.md:6200-6202); operator training done (:6203-6205); region payment-gate map final (CRYPTO_REGULATORY_REVIEW §7 table); SLO dashboard public-internal with 30 days of history.

Decision owner: Launch Director — sole authority, recorded go/no-go with every co-signer's evidence attached (V1/features.md:6207).

Phase 4 — Hypercare (GA → GA+30)#

• War-room staffing: SRE + Safety + Payments on-call rotations doubled; daily launch-health review against the SLO dashboard.
• Canary analysis continues on every deploy (the spec's post-deploy monitoring + canary analysis requirement, V1/features.md:6208-6209).
• Weekly capacity re-forecast (CAPACITY_MODEL §8) and risk-register re-score with observed data (RISK_REGISTER maintenance section).
• Exit (Gate G4, GA+30): hand off from launch governance to steady-state ops; postmortem of the launch itself; risk register L/I re-scored; this document archived with actuals annotated next to every assumption. Decision owner: Launch Director.

Decoupled tracks (deliberately not on the GA critical path)#