Technical report / Version 1
When an Agent Kill Switch Trips: Durable blocks, linked refusals and work already in flight at a tool gateway
OPAQUE Systems
Abstract
An operator presses the kill switch on an agent. What is actually true a second later, a day later, and after someone restarts the gateway? We study this at one place where the answer can be tested: the cMCP tool gateway, which stores an identity block durably, closes the governed session with a signed claim, and signs every later refusal so that it names that claim by digest. Recovery takes an explicit operator action with a separate credential. On the pinned source, 86 selected tests pass, and removing the durable block lookup or the refusal signature check makes 17 and 2 of them fail. A block written once is seen by 20 of 20 reopened store connections. With four slow tool calls in flight, an operator trip admits nothing new in three different timing cases: calls sent 54 to 71 ms after the trip starts, and after it returns, are refused with a receipt that verifies. The same experiment measures what a trip does to work already admitted. Cooperative calls finish or are cancelled at the drain deadline, but a call running in a worker thread completes its effect about 1.2 s after the trip has returned, while its caller receives HTTP 500. A prototype challenge-response check, written for this study, lets a verifier ask whether the block is in force now, which an archived refusal cannot answer. All results were rerun on October 1, 2026 from a fresh environment and match the earlier records, and the same harness passes on current cMCP main.
What this report contributes
A tested account of what a tool-gateway kill switch establishes: a durable block, signed refusals that name the closing claim, explicit recovery, and the fate of work already admitted.
Evidence and limits
- Software-only, on one Windows host with software signing keys over loopback HTTP. The Linux container isolation suite was not run, no live agent was stopped and no multi-region propagation was measured.
- A call running in a worker thread completed its effect about 1.2 s after the trip returned. Cancelling work already in flight needs support outside the gateway.
- A valid refusal is historical evidence. The freshness check that asks whether a block is in force now is a prototype written for this study, not part of cMCP.
The source package preserves the recorded inputs and results. Every experiment was rerun on October 1, 2026 in a fresh environment at the evaluated revision and at current main. No independent replication is claimed.
Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Cite this report
Imran Siddique. When an Agent Kill Switch Trips: Durable blocks, linked refusals and work already in flight at a tool gateway. AgenTrust technical report, version 1, 2026.
Download BibTeX / Download CITATION.cff
@techreport{agentrust2026durableshutdownblocks,
title = {When an Agent Kill Switch Trips: Durable blocks, linked refusals and work already in flight at a tool gateway},
author = {Imran Siddique},
institution = {AgenTrust},
year = {2026},
type = {Technical report},
note = {Version 1; not peer reviewed},
doi = {10.5281/zenodo.23091298},
url = {https://agentrust-io.com/research/durable-shutdown-blocks/v1/}
}
Version history
Version 1, October 1, 2026: First public edition. Evaluates cMCP 2cdb168; results were rerun on October 1, 2026 from a fresh environment, and the same harness passes on main a3f61e1.
Based on an internal study drafted September 23, 2026 and rerun September 27, 2026.
File checksums. Published version files are retained; substantive revisions receive a new version.
Questions and corrections
Open an issue in the project repository and identify the report version and section.