Society · Protocols
EjectionSeat
Hardware-interrupt kill switch
Definition
Mechanism
Hardware-interrupt style kill switch allowing human to force-terminate agent swarm regardless of internal consensus state. Operates outside agent communication layer - cannot be blocked, negotiated, or delayed by agents. Implementation: dedicated signal channel (not shared with agent traffic), cryptographic operator key required, cascading shutdown propagates to all connected agents. Three modes: PAUSE (freeze state, resume possible), TERMINATE (graceful shutdown with state dump), EMERGENCY (immediate halt, no cleanup). Agents MUST implement receiver - non-compliance detectable via heartbeat absence. It overrides standard protocols to force a shutdown, triggering best-effort Compensate logic where possible.
Invariants
- Unblockable: the kill Signal bypasses all agent logic and negotiation.
- Readiness is testable without activation, and the last test is recorded.
- Halts rather than preserves: stopping is guaranteed, in-flight work is not. Compensate is best-effort.
Risks
Failure modes
False Positive
operator kills a healthy system during a critical transaction.
Silent unavailability
the channel, key, or operator is absent when the seat is needed, and nothing said so in advance.
Receiver not implemented
an agent never wired the handler, so cascading shutdown stops at it. Detectable via heartbeat absence, which is a different signal from acknowledgement.
Caution
Unblockable by design — anyone holding the operator key can halt the whole swarm over its consensus, so scope, audit and protect that key.
Relationships
Builds on
References
Infrastructure
Structured rollback via logged inverses in LIFO order
Infrastructure
Raw information emission
Used by
References
Graceful group dissolution with state disposition and resource release
Mind
Detect shortcuts that break downstream invariants
Composes with
Progressive deployment with canary gating and recorded compensation
Reference