Concept

Kill switch & bundle grace

Kill switch

Engaging the kill switch denies every new governed call at the gate — including sub-agents and scripted replays. Calls already dispatched are marked aborted on a best-effort basis; a call that has already reached an external service is not recalled. Each denial is recorded as a first-class decision step in the receipt (actor, timestamp, policy-bundle fingerprint). The stop persists across reloads until you disengage it — no policy bundle or update clears it for you.

Fastest engagement: press Esc three times in under a second. Ignored while typing in an input, textarea, or contenteditable field. A 10-second Undo toast appears in case it was accidental.

Bundle grace

Policy bundles expire. Rather than flip an offline device to hard-DENY the moment the clock crosses the boundary, a bundle invalid only because it expired in the last 7 days keeps enforcing while the posture card flags it — refresh proactively.

Signature failures and tampered bytes always fail closed immediately. No grace for integrity issues.

Related: error codes and FAQ · Panic stop.