Release safety

Status: Accepted · Version: 0.1

Release is the highest-risk workflow in Titip. Safety rules override convenience.

Gates

1. Evidence complete for the frozen policy version (TITIP-007).
2. Case created as CANDIDATE, not as DELIVERED.
3. Per-vault decision is RELEASABLE or HOLD. Holds are not overridden by a case-level approval.
4. manual_review_approved before any real token (ADR-005).
5. Recipient verification flow complete (TITIP-009).
6. Global hold is off.

If any gate fails, do not deliver.

Global release hold

release.disable=true

• Stops new approvals from issuing tokens.
• Revokes unexpired recipient tokens if the hold reason is compromise or a delivery bug.
• Does not block owner sign-in, editing, or life-check confirmation.
• Is itself an audit event (release.hold.enabled / release.hold.disabled).
• May be cleared only by a reviewer action that records a reason.

The prototype does not need a production switch wired to infrastructure, but the simulation must show a hold state so the control is part of the product story.

Manual hold on one case

A reviewer may move IN_REVIEW to HELD without a global switch. Example: suspected coercion, or a trusted-contact dispute.

What never happens

• Vault text inside email, SMS, push, or WhatsApp.
• Automatic release because a timer fired.
• Delivery to “all contacts.”
• Support staff marking a person dead.

Simulation

Simulation is a safety tool, not a toy mode that uses different rules. Same policy, same states, no external delivery, no live token. The UI must show the word simulation.