From 8e3bb029a96e18b9e7baeaa882c31d1bad22a833 Mon Sep 17 00:00:00 2001 From: Imran Siddique <45405841+imran-siddique@users.noreply.github.com> Date: Sun, 11 Oct 2026 21:42:15 -0700 Subject: [PATCH] feat(research): add the DOI for kill switch version 2 Zenodo record 23308975 (DOI 10.5281/zenodo.23308975) is published as version 2 of 23091310 in the agentrust-research community. Its paper.pdf md5 8c26d063 matches the site's v2 PDF (sha256 9ce0166a), and the DOI resolves to the record. Co-Authored-By: Claude Opus 5.5 --- data/research.json | 3 ++- research/kill-switch/index.html | 6 ++++-- research/kill-switch/v2/CITATION.cff | 1 + research/kill-switch/v2/citation.bib | 1 + research/kill-switch/v2/index.html | 6 ++++-- 5 files changed, 12 insertions(+), 5 deletions(-) diff --git a/data/research.json b/data/research.json index 755f8fa..9d09cbe 100644 --- a/data/research.json +++ b/data/research.json @@ -710,7 +710,8 @@ "sha256": { "paper.pdf": "9ce0166a61e6225eabab67c42dd2e8a232c6cb499a566914e87df69fb9fb3023", "source.zip": "d15611000995a4b3562dc2033a5a2454e5bc1f3a53d2d1930d53c9a52dca2594" - } + }, + "doi": "10.5281/zenodo.23308975" } ] } diff --git a/research/kill-switch/index.html b/research/kill-switch/index.html index b14a0ed..09f6a8f 100644 --- a/research/kill-switch/index.html +++ b/research/kill-switch/index.html @@ -21,7 +21,8 @@ - + + @@ -68,7 +69,7 @@

What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an age

In plain English

Pressing a kill switch, getting a signed refusal and seeing nothing further happen are three different things. Testing the cMCP gateway, the report finds that it refuses new work and stays blocked after a restart, but also that a call already admitted can finish and a tool reached directly, around the gateway, can still act. It proposes a way to evaluate shutdown that checks each of these separately, including a fresh check of whether the block holds now.

Abstract

A shutdown command, a signed refusal and the absence of subsequent effects are different observations. We examine those distinctions using the merged cMCP gateway kill switch and its accompanying policy-key and delegation revocation mechanisms. A reproducible evaluator drives gateway startup, signed agent identity, Cedar evaluation, loopback HTTP tool calls, durable blocks, process restart, recovery and offline receipt verification. The reference run satisfies 27 named assertions. Two targeted implementation weakenings are detected at their intended assertions. Separately, 81 existing cMCP component tests and 38 cA2A revocation tests pass on pinned source revisions. The observed system refuses new tool work through the stopped gateway and retains its block after restart. An admitted call can nevertheless finish during shutdown, a direct tool path can produce an effect while the gateway is stopped, and a historical refusal still verifies after recovery. These counterexamples establish the limits of treating a signed receipt as evidence of continuing or universal shutdown. An external evaluator repeated the reference run, both weakenings and both component suites on his own workstation and obtained the same outcome for every assertion. We propose an evaluator protocol that separates admission, effects, persistence, recovery and freshness, with an explicit role for independent observation. The exercise uses software keys, one operator and no model or confidential hardware.

- +

What this report contributes

An evaluator protocol that separates admission, drain, persistence, recovery and evidence at a tool gateway, with counterexamples to reading a signed refusal as proof of continuing shutdown.

Evidence and limits

  • Software-only, on Windows hosts with software keys over loopback HTTP. The author and one external evaluator each controlled gateway and observer together; no language model, confidential hardware or independently operated peer was used.
  • A direct path to the tool produced an effect while the gateway was stopped, which the gateway's records cannot show, and a call admitted before the trip still completed.
  • A historical refusal still verifies after recovery: the receipt verifier accepts no challenge or maximum age, so present shutdown state needs a new observation.

The source package preserves the recorded inputs and results. One external evaluator repeated every run on his own workstation on October 11, 2026, with gateway and observer under his one administrator. One individual's evaluation, not a certification or ongoing verification.

@@ -81,6 +82,7 @@

What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an age year = {2026}, type = {Technical report}, note = {Version 2; not peer reviewed}, + doi = {10.5281/zenodo.23308975}, url = {https://agentrust-io.com/research/kill-switch/v2/} }

diff --git a/research/kill-switch/v2/CITATION.cff b/research/kill-switch/v2/CITATION.cff index b2a9799..4c8d792 100644 --- a/research/kill-switch/v2/CITATION.cff +++ b/research/kill-switch/v2/CITATION.cff @@ -13,6 +13,7 @@ ], "url": "https://agentrust-io.com/research/kill-switch/v2/", "license": "CC-BY-4.0", + "doi": "10.5281/zenodo.23308975", "preferred-citation": { "type": "report", "title": "What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an agent tool gateway", diff --git a/research/kill-switch/v2/citation.bib b/research/kill-switch/v2/citation.bib index b0abe13..46f7e8f 100644 --- a/research/kill-switch/v2/citation.bib +++ b/research/kill-switch/v2/citation.bib @@ -5,5 +5,6 @@ @techreport{agentrust2026killswitch year = {2026}, type = {Technical report}, note = {Version 2; not peer reviewed}, + doi = {10.5281/zenodo.23308975}, url = {https://agentrust-io.com/research/kill-switch/v2/} } diff --git a/research/kill-switch/v2/index.html b/research/kill-switch/v2/index.html index 5775240..237c104 100644 --- a/research/kill-switch/v2/index.html +++ b/research/kill-switch/v2/index.html @@ -21,7 +21,8 @@ - + + @@ -67,7 +68,7 @@

What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an age
October 11, 2026Not peer reviewedPatent Pending

Abstract

A shutdown command, a signed refusal and the absence of subsequent effects are different observations. We examine those distinctions using the merged cMCP gateway kill switch and its accompanying policy-key and delegation revocation mechanisms. A reproducible evaluator drives gateway startup, signed agent identity, Cedar evaluation, loopback HTTP tool calls, durable blocks, process restart, recovery and offline receipt verification. The reference run satisfies 27 named assertions. Two targeted implementation weakenings are detected at their intended assertions. Separately, 81 existing cMCP component tests and 38 cA2A revocation tests pass on pinned source revisions. The observed system refuses new tool work through the stopped gateway and retains its block after restart. An admitted call can nevertheless finish during shutdown, a direct tool path can produce an effect while the gateway is stopped, and a historical refusal still verifies after recovery. These counterexamples establish the limits of treating a signed receipt as evidence of continuing or universal shutdown. An external evaluator repeated the reference run, both weakenings and both component suites on his own workstation and obtained the same outcome for every assertion. We propose an evaluator protocol that separates admission, effects, persistence, recovery and freshness, with an explicit role for independent observation. The exercise uses software keys, one operator and no model or confidential hardware.

- +

What this report contributes

An evaluator protocol that separates admission, drain, persistence, recovery and evidence at a tool gateway, with counterexamples to reading a signed refusal as proof of continuing shutdown.

Evidence and limits

  • Software-only, on Windows hosts with software keys over loopback HTTP. The author and one external evaluator each controlled gateway and observer together; no language model, confidential hardware or independently operated peer was used.
  • A direct path to the tool produced an effect while the gateway was stopped, which the gateway's records cannot show, and a call admitted before the trip still completed.
  • A historical refusal still verifies after recovery: the receipt verifier accepts no challenge or maximum age, so present shutdown state needs a new observation.

The source package preserves the recorded inputs and results. One external evaluator repeated every run on his own workstation on October 11, 2026, with gateway and observer under his one administrator. One individual's evaluation, not a certification or ongoing verification.

@@ -80,6 +81,7 @@

What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an age year = {2026}, type = {Technical report}, note = {Version 2; not peer reviewed}, + doi = {10.5281/zenodo.23308975}, url = {https://agentrust-io.com/research/kill-switch/v2/} }