AgenTrust Research
Technical reports with open source, recorded experiments, and explicit limits. Read the work, inspect the evidence, and cite a specific version.
Runtime evidence
A portable format for runtime claims, with recorded measurements of signing, verification, record size, and conformance fixtures.
Read the reportTool-call enforcement
A gateway design combining policy evaluation, session sensitivity, tool-catalog pinning, and signed tool-call records.
Read the reportAgent identity
A signed baseline for agent artifacts, with recorded Ed25519 benchmarks, delegation checks, and tamper probes.
Read the reportModel weight custody
A portable custody contract binding exact weights, measured workload, fresh channel-bound release, renewable authority, terminal evidence and derivative lineage.
Read the reportDelegation evidence
A trust profile on A2A composing narrowing delegation credentials, peer attestation appraisal, sealed payloads and linked per-hop provenance records.
Read the reportGovernance telemetry
A backend-neutral contract for six governance event families that keeps lossy operational telemetry separate from evidence whose completeness is stated.
Read the reportConfidential handoffs
A conditional composition argument and proposed handoff contract for when tool calls and delegations preserve an authorized plaintext-holder boundary.
Read the reportGovernance telemetry
A source-side contract that accepts each governance event into a run-scoped cryptographic prefix before operational export, keeping export failures separate from evidence failures.
Read the reportModel weight custody
A supplementary key-release predicate: a challenge-bound, signed write/read sweep of a declared memory range, accepted only when fresh, mismatch-free and signed by a pinned key.
Read the reportHuman oversight
A two-domain signing boundary: the issuer signs the oversight requirement with approvals normalized to empty, and each human signs an approval bound to a manifest and scope.
Read the reportDisclosure control
A release gate that ties owner-signed exact output bytes to a scoped, persistent, single-attempt decision and reports an uncertain delivery as unknown instead of repeating it.
Read the reportModel weight custody
An owner-side provisioning protocol that appraises the broker as a recipient, binding its configuration, fresh receiving key, model identity and policy epoch before the model key leaves.
Read the reportTool-call enforcement
A tested account of what a tool-gateway kill switch establishes: a durable block, signed refusals that name the closing claim, explicit recovery, and the fate of work already admitted.
Read the reportDelegation evidence
A strict response-authentication mode that binds the appraised peer key, the complete request and a fresh occurrence into a single-use key, and reports unknown outcomes instead of guessing.
Read the reportModel serving
A routing gate for confidential model hosts: the Kubernetes Service exists only from a verified first admission receipt for one session, and a durable per-session ledger keeps revoked sessions unroutable.
Read the reportRuntime evidence
A portable format for runtime claims, with recorded measurements of signing, verification, record size, and conformance fixtures.
Read the reportTool-call enforcement
A gateway design combining policy evaluation, session sensitivity, tool-catalog pinning, and signed tool-call records.
Read the reportAgent identity
A signed baseline for agent artifacts, with recorded Ed25519 benchmarks, delegation checks, and tamper probes.
Read the reportModel weight custody
A portable custody contract binding exact weights, measured workload, fresh channel-bound release, renewable authority, terminal evidence and derivative lineage.
Read the reportDelegation evidence
A trust profile on A2A composing narrowing delegation credentials, peer attestation appraisal, sealed payloads and linked per-hop provenance records.
Read the reportGovernance telemetry
A backend-neutral contract for six governance event families that keeps lossy operational telemetry separate from evidence whose completeness is stated.
Read the reportConfidential handoffs
A conditional composition argument and proposed handoff contract for when tool calls and delegations preserve an authorized plaintext-holder boundary.
Read the reportGovernance telemetry
A source-side contract that accepts each governance event into a run-scoped cryptographic prefix before operational export, keeping export failures separate from evidence failures.
Read the reportModel weight custody
A supplementary key-release predicate: a challenge-bound, signed write/read sweep of a declared memory range, accepted only when fresh, mismatch-free and signed by a pinned key.
Read the reportHuman oversight
A two-domain signing boundary: the issuer signs the oversight requirement with approvals normalized to empty, and each human signs an approval bound to a manifest and scope.
Read the reportDisclosure control
A release gate that ties owner-signed exact output bytes to a scoped, persistent, single-attempt decision and reports an uncertain delivery as unknown instead of repeating it.
Read the reportModel weight custody
An owner-side provisioning protocol that appraises the broker as a recipient, binding its configuration, fresh receiving key, model identity and policy epoch before the model key leaves.
Read the reportTool-call enforcement
A tested account of what a tool-gateway kill switch establishes: a durable block, signed refusals that name the closing claim, explicit recovery, and the fate of work already admitted.
Read the reportDelegation evidence
A strict response-authentication mode that binds the appraised peer key, the complete request and a fresh occurrence into a single-use key, and reports unknown outcomes instead of guessing.
Read the reportModel serving
A routing gate for confidential model hosts: the Kubernetes Service exists only from a verified first admission receipt for one session, and a durable per-session ledger keeps revoked sessions unroutable.
Read the reportTool-call enforcement
An evaluator protocol that separates admission, drain, persistence, recovery and evidence at a tool gateway, with counterexamples to reading a signed refusal as proof of continuing shutdown.
Read the reportThese reports preserve historical designs and software evaluations. A signature, an attestation result, and an execution-completeness claim establish different properties. Each paper page identifies the evidence evaluated and the limits that remain.
For implementation, follow the current project specifications linked from each report. Paper text is available under CC BY 4.0; code retains its project license.
Technical report / Version 1
+OPAQUE Systems
+A shutdown command, a signed refusal and the absence of subsequent effects are different observations. We examine those distinctions using the merged cMCP gateway kill switch and its accompanying policy-key and delegation revocation mechanisms. A reproducible evaluator drives gateway startup, signed agent identity, Cedar evaluation, loopback HTTP tool calls, durable blocks, process restart, recovery and offline receipt verification. The reference run satisfies 27 named assertions. Two targeted implementation weakenings are detected at their intended assertions. Separately, 81 existing cMCP component tests and 38 cA2A revocation tests pass on pinned source revisions. The observed system refuses new tool work through the stopped gateway and retains its block after restart. An admitted call can nevertheless finish during shutdown, a direct tool path can produce an effect while the gateway is stopped, and a historical refusal still verifies after recovery. These counterexamples establish the limits of treating a signed receipt as evidence of continuing or universal shutdown. We propose an evaluator protocol that separates admission, effects, persistence, recovery and freshness, with an explicit role for independent observation. The exercise uses software keys, one operator and no model or confidential hardware.
An evaluator protocol that separates admission, drain, persistence, recovery and evidence at a tool gateway, with counterexamples to reading a signed refusal as proof of continuing shutdown.
The source package preserves the recorded inputs and results. The author repeated every run on September 27 and October 1, 2026 in fresh environments at the pinned revisions. An independent evaluation is under way and will be reported in version 2.
+Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Imran Siddique. What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an agent tool gateway. AgenTrust technical report, version 1, 2026.
+Download BibTeX / Download CITATION.cff
@techreport{agentrust2026killswitch,
+ title = {What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an agent tool gateway},
+ author = {Imran Siddique},
+ institution = {AgenTrust},
+ year = {2026},
+ type = {Technical report},
+ note = {Version 1; not peer reviewed},
+ url = {https://agentrust-io.com/research/kill-switch/v1/}
+}
+Version 1, October 1, 2026: First public edition. Evaluates cMCP 9db65b5 and cA2A 540a578; results were repeated on September 27 and October 1, 2026 with the same outcomes, and later source was rechecked against main.
+Revises a discussion draft dated September 19, 2026.
+File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
Technical report / Version 1
+OPAQUE Systems
+A shutdown command, a signed refusal and the absence of subsequent effects are different observations. We examine those distinctions using the merged cMCP gateway kill switch and its accompanying policy-key and delegation revocation mechanisms. A reproducible evaluator drives gateway startup, signed agent identity, Cedar evaluation, loopback HTTP tool calls, durable blocks, process restart, recovery and offline receipt verification. The reference run satisfies 27 named assertions. Two targeted implementation weakenings are detected at their intended assertions. Separately, 81 existing cMCP component tests and 38 cA2A revocation tests pass on pinned source revisions. The observed system refuses new tool work through the stopped gateway and retains its block after restart. An admitted call can nevertheless finish during shutdown, a direct tool path can produce an effect while the gateway is stopped, and a historical refusal still verifies after recovery. These counterexamples establish the limits of treating a signed receipt as evidence of continuing or universal shutdown. We propose an evaluator protocol that separates admission, effects, persistence, recovery and freshness, with an explicit role for independent observation. The exercise uses software keys, one operator and no model or confidential hardware.
An evaluator protocol that separates admission, drain, persistence, recovery and evidence at a tool gateway, with counterexamples to reading a signed refusal as proof of continuing shutdown.
The source package preserves the recorded inputs and results. The author repeated every run on September 27 and October 1, 2026 in fresh environments at the pinned revisions. An independent evaluation is under way and will be reported in version 2.
+Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Imran Siddique. What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an agent tool gateway. AgenTrust technical report, version 1, 2026.
+Download BibTeX / Download CITATION.cff
@techreport{agentrust2026killswitch,
+ title = {What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an agent tool gateway},
+ author = {Imran Siddique},
+ institution = {AgenTrust},
+ year = {2026},
+ type = {Technical report},
+ note = {Version 1; not peer reviewed},
+ url = {https://agentrust-io.com/research/kill-switch/v1/}
+}
+Version 1, October 1, 2026: First public edition. Evaluates cMCP 9db65b5 and cA2A 540a578; results were repeated on September 27 and October 1, 2026 with the same outcomes, and later source was rechecked against main.
+Revises a discussion draft dated September 19, 2026.
+File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.