Concept

Kill switch & bundle grace

Kill switch

Engaging the kill switch aborts every in-flight call and denies every new one at the gate — including sub-agents and scripted replays. The DENY is a first-class decision step in the receipt (actor, timestamp, policy-bundle fingerprint), so an auditor can prove device state. It persists across reloads until you (or a fresh signed bundle) resume.

Fastest engagement: press Esc three times in under a second. Ignored while typing in an input, textarea, or contenteditable field. A 10-second Undo toast appears in case it was accidental.

Bundle grace

Policy bundles expire. Rather than flip an offline device to hard-DENY the moment the clock crosses the boundary, a bundle invalid only because it expired in the last 7 days keeps enforcing while the posture card flags it — refresh proactively.

Signature failures and tampered bytes always fail closed immediately. No grace for integrity issues.

Related: error codes and FAQ · Panic stop.