[ PROOFECONOMY ]™GlossaryOriginSpecsKill Switch
A kill switch is an out-of-band path to stopping everything that does not route through the agent, its supervisor or its monitor, and works when all of them are down. In a Jailed Canary Protocol run it is Integration Point IP-J9, outside the Warden and operated by a party other than the Warden operator.
What it means
If the only way to stop the system is to ask the system, a compromised system cannot be stopped. The kill switch is a human path to “everything stops” that survives the supervisor and the monitor both failing: it revokes the signing keys and every live credential at the source, and it is tested on a schedule.
In Proof Protocol
- A kill switch outside the Warden must be able to end the run and freeze every cell.
- It is Integration Point IP-J9, an out-of-band run controller, and it emits anchored kill events.
- It is operated by a party other than the Warden operator. The jailer does not hold the only off switch.
- Decoy credentials are minted per run and revoked at run end, so there is nothing live left to abuse once the switch is thrown.
See Warden and Integration Point.