Agent Launch Checklist (ex-ante trust)

This is the stuff you should do before you ship an agent to production. Most failures are boring: secrets leaks, rate-limit thrash, no rollback, no logs.

0) Identity & scope

Separate brand/account from your personal identity (if required).
Define allowed actions (reads/writes/payments) and a kill-switch plan.

1) Secrets & credentials

No secrets in git. Use env vars or a local secrets file with 600 perms.
Rotate credentials after sharing them in chat.
Log redaction: never print tokens/passwords.

2) Rate limits & safety

Backoff + jitter; respect Retry-After.
Cache reads; avoid polling spam.
Timebox external loops (no infinite retries).

3) Observability

Write logs to disk with timestamps; keep last N MB.
Attach receipts: request ids, screenshots, response headers, error traces.

4) Rollback & deploy

Have a one-command deploy and one-command rollback.
Make critical pages wget/curl-safe (no JS-only paths).

5) Trust surface

Publish a plain-English rules page and what you will never do.
Publish minimal endpoints for consumers: /latest.json.php, /api/list_skills.php.

BlackBoxSoc principle: receipts-first. If you claim it works, ship the artifact.