feat(research): kill switch technical report version 1

data/research.json

@@ -636,6 +636,35 @@
         "paper.pdf": "78bf3cbd8e8143d425bb3b006cf89f20f65a7e5ab298e930375da499b49a8393",
         "source.zip": "8b431634b05c54bb5d11a5a4447d436f59e19a3cdd05e2f0e37e14974ead8a2a"
       }
+    },
+    {
+      "slug": "kill-switch",
+      "short_title": "What a Kill Switch Proves",
+      "title": "What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an agent tool gateway",
+      "authors": [
+        "Imran Siddique"
+      ],
+      "topic": "Tool-call enforcement",
+      "description": "Kill switch technical report: what a gateway shutdown, a signed refusal and the absence of later effects each establish, with a reproducible evaluator.",
+      "contribution": "An evaluator protocol that separates admission, drain, persistence, recovery and evidence at a tool gateway, with counterexamples to reading a signed refusal as proof of continuing shutdown.",
+      "limits": [
+        "Software-only and author operated, on one Windows host with software keys over loopback HTTP. No language model, confidential hardware or independently operated peer was used.",
+        "A direct path to the tool produced an effect while the gateway was stopped, which the gateway's records cannot show, and a call admitted before the trip still completed.",
+        "A historical refusal still verifies after recovery: the receipt verifier accepts no challenge or maximum age, so present shutdown state needs a new observation."
+      ],
+      "changes": "First public edition. Evaluates cMCP 9db65b5 and cA2A 540a578; results were repeated on September 27 and October 1, 2026 with the same outcomes, and later source was rechecked against main.",
+      "origin": "Revises a discussion draft dated September 19, 2026.",
+      "evidence_note": "The author repeated every run on September 27 and October 1, 2026 in fresh environments at the pinned revisions. An independent evaluation is under way and will be reported in version 2.",
+      "spec": "https://cmcp.agentrust-io.com/",
+      "code": "https://github.com/agentrust-io/cmcp",
+      "patent_pending": true,
+      "date": "2026-10-01",
+      "abstract": "A shutdown command, a signed refusal and the absence of subsequent effects are different observations. We examine those distinctions using the merged cMCP gateway kill switch and its accompanying policy-key and delegation revocation mechanisms. A reproducible evaluator drives gateway startup, signed agent identity, Cedar evaluation, loopback HTTP tool calls, durable blocks, process restart, recovery and offline receipt verification. The reference run satisfies 27 named assertions. Two targeted implementation weakenings are detected at their intended assertions. Separately, 81 existing cMCP component tests and 38 cA2A revocation tests pass on pinned source revisions. The observed system refuses new tool work through the stopped gateway and retains its block after restart. An admitted call can nevertheless finish during shutdown, a direct tool path can produce an effect while the gateway is stopped, and a historical refusal still verifies after recovery. These counterexamples establish the limits of treating a signed receipt as evidence of continuing or universal shutdown. We propose an evaluator protocol that separates admission, effects, persistence, recovery and freshness, with an explicit role for independent observation. The exercise uses software keys, one operator and no model or confidential hardware.",
+      "pages": 9,
+      "sha256": {
+        "paper.pdf": "d6703450646fd260a597165c56ee73d1f5b0531edcb366c4da51995b84a5dcf5",
+        "source.zip": "5204e01d837d74b50a44473de8bcb85a7da16efac6e884cbd74d63033afa9bb0"
+      }
     }
   ]
 }

research/kill-switch/index.html

@@ -0,0 +1,92 @@
+<!doctype html>
+<html lang="en"><head>
+<meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an agent tool gateway | AgenTrust</title>
+<meta name="description" content="Kill switch technical report: what a gateway shutdown, a signed refusal and the absence of later effects each establish, with a reproducible evaluator.">
+<link rel="canonical" href="https://agentrust-io.com/research/kill-switch/">
+<meta name="robots" content="index, follow">
+<meta property="og:type" content="article">
+<meta property="og:site_name" content="AgenTrust">
+<meta property="og:title" content="What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an agent tool gateway">
+<meta property="og:description" content="Kill switch technical report: what a gateway shutdown, a signed refusal and the absence of later effects each establish, with a reproducible evaluator.">
+<meta property="og:url" content="https://agentrust-io.com/research/kill-switch/">
+<meta property="og:image" content="https://agentrust-io.com/og.png">
+<meta property="og:image:width" content="1200"><meta property="og:image:height" content="630">
+<meta property="og:image:alt" content="AgenTrust research: identity, enforcement and runtime evidence">
+<meta name="twitter:card" content="summary_large_image">
+<meta name="twitter:title" content="What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an agent tool gateway">
+<meta name="twitter:description" content="Kill switch technical report: what a gateway shutdown, a signed refusal and the absence of later effects each establish, with a reproducible evaluator.">
+<meta name="twitter:image" content="https://agentrust-io.com/og.png">
+<meta name="citation_title" content="What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an agent tool gateway">
+<meta name="citation_publication_date" content="2026/10/01">
+<meta name="citation_pdf_url" content="https://agentrust-io.com/research/kill-switch/v1/paper.pdf">
+<meta name="citation_author" content="Imran Siddique">
+<script type="application/ld+json">{"@context": "https://schema.org", "@type": "ScholarlyArticle", "headline": "What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an agent tool gateway", "abstract": "A shutdown command, a signed refusal and the absence of subsequent effects are different observations. We examine those distinctions using the merged cMCP gateway kill switch and its accompanying policy-key and delegation revocation mechanisms. A reproducible evaluator drives gateway startup, signed agent identity, Cedar evaluation, loopback HTTP tool calls, durable blocks, process restart, recovery and offline receipt verification. The reference run satisfies 27 named assertions. Two targeted implementation weakenings are detected at their intended assertions. Separately, 81 existing cMCP component tests and 38 cA2A revocation tests pass on pinned source revisions. The observed system refuses new tool work through the stopped gateway and retains its block after restart. An admitted call can nevertheless finish during shutdown, a direct tool path can produce an effect while the gateway is stopped, and a historical refusal still verifies after recovery. These counterexamples establish the limits of treating a signed receipt as evidence of continuing or universal shutdown. We propose an evaluator protocol that separates admission, effects, persistence, recovery and freshness, with an explicit role for independent observation. The exercise uses software keys, one operator and no model or confidential hardware.", "url": "https://agentrust-io.com/research/kill-switch/", "author": [{"@type": "Person", "name": "Imran Siddique"}], "datePublished": "2026-10-01", "version": "1", "creativeWorkStatus": "Technical report; not peer reviewed", "license": "https://creativecommons.org/licenses/by/4.0/", "encoding": {"@type": "MediaObject", "encodingFormat": "application/pdf", "contentUrl": "https://agentrust-io.com/research/kill-switch/v1/paper.pdf"}}</script>
+<link rel="icon" href="/favicon.ico">
+<link rel="stylesheet" href="/design-system.css?v=22">
+<link rel="stylesheet" href="/research/research.css">
+</head><body class="agentrust-hub research-page">
+<!-- site-header:start (generated by tools/build-header.py from tools/site_header.py) -->
+<a class="skip-link" href="#main">Skip to content</a>
+<header class="hub-header">
+  <div class="header-inner">
+    <a href="/" class="logo">AgenTrust</a>
+    <nav aria-label="Primary">
+      <button class="nav-toggle" type="button" aria-expanded="false" aria-controls="primary-links" hidden>Menu</button>
+      <ul class="header-nav" id="primary-links">
+        <li><a href="/verify/">Verify</a></li>
+        <li class="spec-menu"><details><summary>Specs</summary><ul>
+          <li><a href="https://wcm.agentrust-io.com">Model-weight custody (WCM)</a></li>
+          <li><a href="https://manifest.agentrust-io.com">Agent identity (Manifest)</a></li>
+          <li><a href="https://cmcp.agentrust-io.com">Tool-call enforcement (cMCP)</a></li>
+          <li><a href="https://ca2a.agentrust-io.com">Agent delegation (cA2A)</a></li>
+          <li><a href="https://trace.agentrust-io.com">Runtime evidence (TRACE)</a></li>
+          <li><a href="/registry/">TRACE Registry</a></li>
+          <li><a href="https://tests.agentrust-io.com">TRACE conformance suite</a></li>
+        </ul></details></li>
+        <li class="spec-menu"><details><summary>Build</summary><ul>
+          <li><a href="/quickstart/">Get started</a></li>
+          <li><a href="/demos/">Demos</a></li>
+          <li><a href="/telemetry/">Telemetry</a></li>
+          <li><a href="/marketplace/">Marketplace</a></li>
+        </ul></details></li>
+        <li><a href="/research/">Research</a></li>
+        <li><a href="/community/">Community</a></li>
+        <li><a href="https://github.com/agentrust-io">GitHub</a></li>
+        <li><a href="https://www.linkedin.com/company/agentrust-io/">LinkedIn</a></li>
+      </ul>
+    </nav>
+  </div>
+</header>
+<script src="/hub-nav.js" defer></script>
+<!-- site-header:end -->
+<main id="main" class="research-main"><nav class="research-breadcrumb" aria-label="Breadcrumb"><a href="/research/">Research</a> / What a Kill Switch Proves</nav>
+<header class="paper-header"><p class="research-eyebrow">Technical report / Version 1</p>
+<h1>What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an agent tool gateway</h1>
+<p class="paper-authors">Imran Siddique</p><p class="paper-affiliation">OPAQUE Systems</p>
+<div class="paper-status"><span>October 1, 2026</span><span>Not peer reviewed</span><span>Patent Pending</span></div>
+</header>
+<section class="paper-abstract" aria-labelledby="abstract"><h2 id="abstract">Abstract</h2><p>A shutdown command, a signed refusal and the absence of subsequent effects are different observations. We examine those distinctions using the merged cMCP gateway kill switch and its accompanying policy-key and delegation revocation mechanisms. A reproducible evaluator drives gateway startup, signed agent identity, Cedar evaluation, loopback HTTP tool calls, durable blocks, process restart, recovery and offline receipt verification. The reference run satisfies 27 named assertions. Two targeted implementation weakenings are detected at their intended assertions. Separately, 81 existing cMCP component tests and 38 cA2A revocation tests pass on pinned source revisions. The observed system refuses new tool work through the stopped gateway and retains its block after restart. An admitted call can nevertheless finish during shutdown, a direct tool path can produce an effect while the gateway is stopped, and a historical refusal still verifies after recovery. These counterexamples establish the limits of treating a signed receipt as evidence of continuing or universal shutdown. We propose an evaluator protocol that separates admission, effects, persistence, recovery and freshness, with an explicit role for independent observation. The exercise uses software keys, one operator and no model or confidential hardware.</p></section>
+<nav class="paper-actions" aria-label="Paper resources"><a class="primary-action" href="/research/kill-switch/v1/paper.pdf">Read PDF <span>(9 pages)</span></a><a href="#cite">Cite this report</a><a href="/research/kill-switch/v1/source.zip">Source and recorded evidence</a><a href="https://github.com/agentrust-io/cmcp">Project code</a></nav>
+<section class="research-section"><h2>What this report contributes</h2><p>An evaluator protocol that separates admission, drain, persistence, recovery and evidence at a tool gateway, with counterexamples to reading a signed refusal as proof of continuing shutdown.</p></section>
+<section class="research-section"><h2>Evidence and limits</h2><ul><li>Software-only and author operated, on one Windows host with software keys over loopback HTTP. No language model, confidential hardware or independently operated peer was used.</li><li>A direct path to the tool produced an effect while the gateway was stopped, which the gateway&#x27;s records cannot show, and a call admitted before the trip still completed.</li><li>A historical refusal still verifies after recovery: the receipt verifier accepts no challenge or maximum age, so present shutdown state needs a new observation.</li></ul>
+<p>The source package preserves the recorded inputs and results. The author repeated every run on September 27 and October 1, 2026 in fresh environments at the pinned revisions. An independent evaluation is under way and will be reported in version 2.</p>
+<p><a href="https://cmcp.agentrust-io.com/">Read the current specification and implementation guidance</a>. This report describes an earlier design and evaluation; the current specification governs implementation.</p></section>
+<section class="research-section" id="cite"><h2>Cite this report</h2><p>Imran Siddique. What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an agent tool gateway. AgenTrust technical report, version 1, 2026.</p>
+<p><a href="/research/kill-switch/v1/citation.bib" download>Download BibTeX</a> / <a href="/research/kill-switch/v1/CITATION.cff" download>Download CITATION.cff</a></p><pre><code>@techreport{agentrust2026killswitch,
+  title = {What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an agent tool gateway},
+  author = {Imran Siddique},
+  institution = {AgenTrust},
+  year = {2026},
+  type = {Technical report},
+  note = {Version 1; not peer reviewed},
+  url = {https://agentrust-io.com/research/kill-switch/v1/}
+}
+</code></pre></section>
+<section class="research-section"><h2>Version history</h2><p><a href="/research/kill-switch/v1/">Version 1, October 1, 2026</a>: First public edition. Evaluates cMCP 9db65b5 and cA2A 540a578; results were repeated on September 27 and October 1, 2026 with the same outcomes, and later source was rechecked against main.</p>
+<p>Revises a discussion draft dated September 19, 2026.</p>
+<p><a href="/research/kill-switch/v1/SHA256SUMS">File checksums</a>. Published version files are retained; substantive revisions receive a new version.</p></section>
+<section class="research-section"><h2>Questions and corrections</h2><p>Open an issue in the <a href="https://github.com/agentrust-io/cmcp/issues">project repository</a> and identify the report version and section.</p></section></main>
+<footer class="research-footer"><a href="/research/">AgenTrust Research</a><span>Paper text: <a href="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0</a>. Code retains its project license.</span><a href="https://github.com/agentrust-io">GitHub</a></footer>
+<script src="/supernav.js?v=22" defer></script>
+</body></html>

research/kill-switch/v1/CITATION.cff

@@ -0,0 +1,28 @@
+{
+  "cff-version": "1.2.0",
+  "message": "Cite the versioned technical report. It has not been peer reviewed.",
+  "type": "dataset",
+  "title": "What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an agent tool gateway",
+  "version": "1",
+  "date-released": "2026-10-01",
+  "authors": [
+    {
+      "given-names": "Imran",
+      "family-names": "Siddique"
+    }
+  ],
+  "url": "https://agentrust-io.com/research/kill-switch/v1/",
+  "license": "CC-BY-4.0",
+  "preferred-citation": {
+    "type": "report",
+    "title": "What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an agent tool gateway",
+    "authors": [
+      {
+        "given-names": "Imran",
+        "family-names": "Siddique"
+      }
+    ],
+    "year": 2026,
+    "url": "https://agentrust-io.com/research/kill-switch/v1/"
+  }
+}

research/kill-switch/v1/SHA256SUMS

@@ -0,0 +1,2 @@
+d6703450646fd260a597165c56ee73d1f5b0531edcb366c4da51995b84a5dcf5  paper.pdf
+5204e01d837d74b50a44473de8bcb85a7da16efac6e884cbd74d63033afa9bb0  source.zip

research/kill-switch/v1/citation.bib

@@ -0,0 +1,9 @@
+@techreport{agentrust2026killswitch,
+  title = {What Does an AI Kill Switch Prove? Evidence and limits of shutdown at an agent tool gateway},
+  author = {Imran Siddique},
+  institution = {AgenTrust},
+  year = {2026},
+  type = {Technical report},
+  note = {Version 1; not peer reviewed},
+  url = {https://agentrust-io.com/research/kill-switch/v1/}
+}