Kill switch

What stops the Machine, and how fast. A file holds its seats at their next check. Recorded console presses became commits in about 60 seconds at the median. Time to effect is unmeasured. Running seat agents continue; cancellation is a separate request.

By Justin Bartak. Published UTC. Updated UTC.

What is a kill switch here?

Here the kill switch is a file. While docs/org/HALT exists, a seat stops at preflight, before its agent starts. The shared action checks again before landing; Finance Ledger checks only at preflight. Scoped files cover one seat or department, with supervised exceptions. Some maintenance crons have no such check. The console places the file and requests cancels.

The Machine is Orbyt Labs' agent organization. A seat is one of its standing roles, run on a schedule. The handoff loop and pulse-fix, the daily repair run, are agents started on the founder's Mac. Phase One is the first stage of the build plan, one row for each piece of work. The ladder is the staged rollout, and the evaluator is the script that grades it. The console is the Machine's control panel.

Paths and run ids on this page point into the private repository that runs the Machine, so the page quotes them and links none. The inventory is an internal written account of those runs and their logs; its raw responses are not committed. A closing record is the note a Phase One row carries when it closes.

Key findings

  • A console pause or resume became a commit 43 to 141 seconds after the press, median 60 seconds, over 17 presses. Times rounded to whole seconds.
  • The inventory reports a global halt stopped a seat at preflight: Finance Ledger run 36878759829, UTC, logged “docs/org/HALT present: org kill-switch engaged; halting cleanly with nothing executed.”
  • The reviewed record holds no qualifying production receipt of a halt stopping a run mid-flight. The attended drill that would write one is pending in that record.
  • One cancel is on record: it named a running Quality Weekly run, and the inventory reports it closed as cancelled about 41 seconds after the press.
  • The global switch has been placed three times, each lifted the same UTC day.

Halt history as of its newest change, UTC. Inventory run observations dated UTC.

The daily pulse found no global halt file in place.

Counted Central

What stops what, and how fast

One row for each mechanism. The timing column is the answer to how fast: a stop takes effect only when something reads it, so most of these wait for the next check. Rows marked Not a stop cover preset limits and rules, including timeouts.

MechanismWhat it stopsWhen it takes effectWhat it does not stopThe record
Before its agent starts
Global halt fileSeats at preflight, through the shared agent action or their own check. The shared action also checks before landing. The handoff loop and pulse-fix read the file.Before its agent startsBefore it landsMaintenance coverage varies by workflow. A seat's agent already working. The control workflow that places and lifts it.Placed three times. The inventory reports a Finance Ledger run stopped at preflight.docs/org/kill-switch.md
Scoped halt fileHALT plus a seat's name stops that seat. HALT plus a department's name stops the seats under it.Before its agent startsBefore it landsSeats outside its scope. A person's supervised re-run of that seat proceeds past it.9 seat scoped halts on the timeline below.packages/collective/src/completion.mjs
Console pause and resumePlaces or removes exactly one halt file, through a recorded command and its own workflow. It stops what the file stops.Before its agent startsBefore it landsWhatever the halt file does not stop (see Global halt file).8 pauses and 9 resumes on record, 43 to 141 seconds press to commit (times rounded to whole seconds). A second pause over a placed halt was refused, so it cannot overwrite who placed the first; see "The switch refusing to overwrite itself" below..github/workflows/org-halt.yml
Console Kill SwitchOne press places the global file if it is not placed, and files a cancel for each running seat run of a known seat workflow.Before its agent startsBefore it landsMid-run, kills the processControl runs, since one may be landing this very stop. The app's maintenance crons. When the read of running runs fails, it says so and cancels nothing it cannot name.The committed records contain a standalone cancel test. No committed receipt demonstrates the combined pause and cancel path.Console, lib/stop-everything.ts
Pulse-fix brakesA daily repair run, before its agent starts: a halt on the remote, a stop file, or a fetch that fails.Before its agent startsA run already past the brakes. No check inside a run was found.No matching committed HALT overlaps the recorded window from UTC, when its log begins, to UTC.scripts/pulse-fix.sh
Failure breakerThat seat, after repeated failures nobody cleared. The daily ladder then writes a seat halt that lasts.Before its agent startsOther seats and supervised runs. A run it stops reads halted in its stats row, the same as a halt's.0 halt files on record were created by the breaker. Whether the breaker fired in a run was not checked.packages/collective/src/evaluate-breaker.mjs
Before it lands
Landing checkThe shared org-agent action refuses landing when a halt covering the seat is present at its landing check. Finance Ledger checks at preflight only. A halt lifted between checks may go unobserved. Supervised runs can proceed past scoped halts.Before it landsThe agent. It is not interrupted and keeps spending until it ends.Tests against a disposable remote see a halt that lands between two checks. Not yet observed on a production run.packages/collective/actions/org-agent/recheck-halt.sh
Mid-run, kills the process
CancelOne named GitHub Actions run, through the executor app. An API call, not a commit.Mid-run, kills the processWork the run already committed.1 cancel on record.packages/collective/src/command-record.mjs
Repair worker's watchThe live repair agent. It polls for a halt every 30 seconds by default and kills the agent's process group. The only mechanism here that kills an agent on a halt.Mid-run, kills the processAnything outside the repair worker.The default polling interval is 30 seconds. A sandbox test configured to poll every 1 second requires termination within 15 seconds. Production stop latency has not been demonstrated. The inventory reported 0 GitHub runs of the repair workflow as an earlier observation on UTC. The attended drill is pending.scripts/lib/repair-worker.mjs
Between iterations
Handoff loop's readThe next iteration. It reads before each one and after each idle wait, and stops when the read fails after its retries.Between iterationsAn iteration already running, and its closer.No matching committed HALT overlaps the recorded window from UTC, when the read landed, to UTC, its last run in the snapshot.scripts/handoff-loop.sh
Stop at a boundaryThe handoff loop between iterations, and pulse-fix before a run.Between iterationsAnything mid-run. It is a file on one machine, not a committed record.The snapshot contains 12 stop-at-boundary observations as of UTC.scripts/handoff-loop.sh
Budget stopThe next iteration, when spend plus the largest recent run would pass the owner's budget, or when a run file cannot be read.Between iterationsA running iteration.In the snapshot of UTC: stopped never for spending past the budget, once because it could not read a run.packages/collective/src/loop-budget.mjs
Per tool call
ValveA Claude Code tool call in this repository whose text matches a pattern: a force push, a remote branch delete, a recursive delete outside the temporary directory, destructive SQL, a credential rotation, a money movement.Per tool callAnything not shaped like its patterns: it is a text match. A plain push to main.Denials are not counted. Whether it runs inside GitHub seat runs was not checked..claude/hooks/arc-valve.sh
Not a stop: a bound or a rule
Owner key on liftingSince the owner-key rule landed, the handoff loop and pulse-fix accept a removal only if the owner signed it. Removals at or before the rule's introduction are accepted as historical. Scoped halts whose file, as created, names the evaluator or ladder as its writer are exempt.Not a stop: a bound or a ruleThe seats. They read the file's absence as a resume.On main; a real owner admission has not been observed. Its Phase One row reads open.packages/collective/src/owner-authority.mjs
Downgrade latchLowers any autonomy rule above observe back to observe, until an owner-signed commit clears it.Not a stop: a bound or a ruleRunning work. When it tripped on UTC, no rule was above observe, so it lowered nothing.State: tripped, since UTC. On that day it read quota as blind, finding no committed pace source in this installation; its Phase One row reads open.packages/collective/src/autonomy-downgrade.mjs
LadderA seat's promotion. A seat staged dormant until it is cleared. A dead-man switch pauses promotions when no founder-signed commit arrives.Not a stop: a bound or a ruleRunning work.Promotions are not paused by the pulse of UTC. By how each halt file was created: 2 pre-staged by the ladder, 0 rollbacks and 0 evaluator halts unclassified.packages/collective/src/evaluate-ladder.mjs
Landing gateJudge-path changes are refused and quarantined locally. Served paths and other review-required changes may become pull requests.Not a stop: a bound or a ruleA seat landing served files through its own push.4 repair runs refused at landing in the snapshot of UTC.scripts/lib/landing-gate.sh
Fence probe and timeoutsA run whose sandbox was not seen refusing, and a run past its time or turn ceiling.Not a stop: a bound or a ruleThey are limits set in advance, not a switch a person presses.3 repair runs stopped before the agent started because the probe could not run, in the snapshot of UTC.scripts/lib/loop-fence.sh

Every halt, and how it was lifted

Each bar is one halt file, from the commit that placed it to the commit that removed it. Colour says who lifted it. A short halt draws at a minimum width, and its approximate duration is in the readout. Hover, drag or tap the chart, or focus it and use the arrow keys, to read one halt.

11halts up to this one
3of them global
7placed from the console

Lifted byThe ladder botA person's accountAnother authorA console command

Halt 11 of 12

Global

Placed , 9:44 AM Central (, 14:44:27 UTC).

Lifted , 10:01 AM Central (, 15:01:40 UTC). Stood for approximately 17 min.

Placed by a console command, lifted by a console command.

Placing it: 48 seconds, press to commit, command cmd_0mupn9pcqd13d871c17df67be.

Lifting it: 50 seconds, press to commit, command cmd_0mupnvt3o3d5b50cd3d8bb866.

Why, by the inventory's account: When the founder tested the Kill Switch end to end from the console on a recorded command, and a seat dispatched under it halted with nothing executed.

12 halts across 7 scopes, from , 04:22:46 UTC to , 22:25:00 UTC; 3 global, 8 placed by a console command.

A bar is a halt file's life on main, not a run it stopped.

The seat ledger counts 0 halted runs. That is not a complete count of stops: a halt still in force at bookkeeping keeps that run's row off main.

Newest change on record: UTC, from 24 file changes in 23 commits, newest 2711bbb4a6f1ea4aa1f001a86f059862dbdeebcf, read on UTC.

Counted Central

Every halt as a table
Every halt file, oldest first, in UTC.
ScopePlaced, UTCLifted, UTCStood for approximatelyWho placed and lifted itPress to commit
Inspector General, 04:22:46 UTC, 11:58:55 UTC24 days 7 hPlaced by a person's account, lifted by the ladder botNo console press
Quality, 04:22:46 UTC, 15:00:13 UTC10 h 37 minPlaced by a person's account, lifted by a person's accountNo console press
Global, 06:37:58 UTC, 09:11:51 UTC2 h 34 minPlaced by another author, lifted by another authorNo console press
Innovation, 20:41:27 UTC, 20:48:58 UTC8 minPlaced by a console command, lifted by a console commandPlacing it: 68 s
Lifting it: 70 s
Innovation, 04:56:27 UTC, 05:13:54 UTC17 minPlaced by a console command, lifted by a console commandPlacing it: 92 s
Lifting it: 65 s
Chief of Staff, 02:03:09 UTC, 00:26:37 UTC22 h 23 minPlaced by a console command, lifted by a console commandPlacing it: 52 s
Lifting it: 65 s
Security, 23:55:05 UTC, 01:41:30 UTC1 h 46 minPlaced by a person's account, lifted by a console commandLifting it: 49 s
Global, 00:38:30 UTC, 03:44:06 UTC3 h 6 minPlaced by a console command, lifted by a console commandPlacing it: 63 s
Lifting it: 45 s
Finance, 10:42:51 UTC, 14:01:27 UTC3 h 19 minPlaced by a console command, lifted by a console commandPlacing it: 141 s
Lifting it: 43 s
Security, 13:47:01 UTC, 14:27:04 UTC40 minPlaced by a console command, lifted by a console commandPlacing it: 114 s
Lifting it: 53 s
Global, 14:44:27 UTC, 15:01:40 UTC17 minPlaced by a console command, lifted by a console commandPlacing it: 48 s
Lifting it: 50 s
Innovation, 22:20:27 UTC, 22:25:00 UTC5 minPlaced by a console command, lifted by a console commandPlacing it: 52 s
Lifting it: 60 s

Download: halt-timeline.json, halt-timeline.csv

What a halt does not stop

  • The app's maintenance crons. Model-refresh continues observation under a halt but suppresses drafting and publication. Seo-heal lacks that halt gate and opens pull requests. Quarterly-salary-update lacks that gate and includes a configured database write. Refresh-pay-transparency lacks that gate and includes a configured Storage upsert. Their production execution is not verified here.docs/org/kill-switch.md
  • An agent already working. The shared action does not interrupt a seat's agent. Its landing is refused only when a halt covering the seat is present at the landing check. Finance Ledger checks at preflight only.packages/collective/actions/org-agent/action.yml
  • A person's re-run, or another seat. A scoped halt does not stop a person's supervised re-run of that seat, and does not affect seats outside its scope.packages/collective/src/completion.mjs
  • The halted run's record. A halt still in force at bookkeeping prevents that row reaching main. A lift before that check can allow bookkeeping, so the ledger is not a complete count of stops.packages/collective/actions/org-agent/action.yml
  • What a run already did. A cancel does not undo work the run committed before the cancel, and a cancelled conclusion is indistinguishable from a timeout kill without the step count.The cancel record's own cannot_undo list
  • Control runs. The console's Kill Switch does not cancel control runs, and cancels nothing it cannot name when it cannot read the running runs.Console, lib/stop-everything.ts
  • The loop's stop, on a console resume. A console resume does not lift the handoff loop's or pulse-fix's stop unless the owner-key rule admits it. The rule is in the Owner key row of the table above.docs/org/handoff-loop/README.md
  • An iteration already running. The handoff loop's read, the budget stop and a stop at a boundary each stop the next iteration, not the one under way.docs/org/handoff-loop/README.md
  • Anything the valve has no pattern for. The valve stops only tool calls whose text matches its patterns, in a Claude Code session in this repository. An admin can change or remove branch protection with one API call that the valve has no rule for. No check on this page is a wall..claude/hooks/arc-valve.sh
  • A seat's own landing. The landing gate refuses and quarantines judge-path changes locally. Served paths and other review-required changes may become pull requests. It does not stop a seat landing served files through its own push.scripts/lib/landing-gate.sh
  • Running work, under the latch. The downgrade latch lowers declared autonomy. When it tripped on UTC, nothing was declared above observe, so it lowered nothing.docs/org/autonomy-downgrade.json

Stops on the record

Each case follows one chain: the press, what it wrote, what happened, and how that was read back. Times are UTC. Run and log effects below are accounts from the inventory, not independently reproduced observations. The scoped walk uses its committed closing record.

  1. A global pause, and a run dispatched under it

    Press
    The founder pressed the console's Kill Switch to test it end to end, , 14:43:38.522 UTC.
    Record
    Command cmd_0mupn9pcqd13d871c17df67be, then commit 9e419fe2c at , 14:44:27 UTC, 48 seconds press to commit.
    Effect
    Finance Ledger run 36878759829 was dispatched 20 seconds after the commit. The inventory reports it logged “docs/org/HALT present: org kill-switch engaged; halting cleanly with nothing executed.” at , 14:45:23 UTC.
    Read back
    The run concluded success, which is also what a clean halt looks like, so the log line is the evidence, not the conclusion. Commit 4c7812cc4 lifted the halt at , 15:01:40 UTC, 17 min after it was placed.

  2. A pause and resume walk, with a refusal in it

    Press
    The closing record reports an operator account pressed pause for the Innovation seat, , 22:19:35.361 UTC.
    Record
    Command cmd_0mva3pzcx91b51947a27c5dc9, commit b555b31fb.
    Effect
    The closing record reports the same operator's resume was refused in the console, “Your role cannot resume this seat.”, and nothing was sent. The owner's resume was admitted: command cmd_0mva3vn8f74c49d9562e9ab99, commit 2711bbb4a, , 22:25:00 UTC.
    Read back
    Its Phase One row reads closed, on UTC, with both commits ancestors of main. The closing record documents a scoped role-refusal walk. It does not establish that a running agent was stopped.

  3. A cancel of a running seat

    Press
    The console's first live cancel, pressed as a test against a Quality Weekly run in progress, , 20:06:43.519 UTC.
    Record
    Command cmd_0mu33rk8v59efeec31b76643d, naming run 35017548767. The API answered with http 202 at , 20:06:44.170 UTC.
    Effect
    The inventory reports the seat's job ended about 32 seconds after the press, and the run closed as cancelled about 41 seconds after it.
    Read back
    The inventory reports the run conclusion, observed UTC. The committed records contain a standalone cancel test. No committed receipt demonstrates the combined pause and cancel path.

  4. The switch refusing to overwrite itself

    Press
    A second pause, pressed while the global halt of commit ce294227d stood.
    Record
    Run 36504374137, , 00:42:48 UTC.
    Effect
    The inventory reports nothing was written and quotes the log: “REFUSED already-halted: HALT already exists, written_by console under cmd_0muly5sf7c5e25d16449e730d; a second pause would overwrite its provenance, and the seat is already stopped”
    Read back
    The inventory reports the run concluded as failed and the halt file kept the name of the command that placed it.

What is not new

None of this is new, the term included. A file that holds work back, a check again before a commit, cancelling a job through an API and a signed commit as authority are all ordinary engineering, and interruptibility has its own research literature. What this page offers is the dated record of one organization's stops, and the scope of each.

OpenAI's paper on governing agentic systems names the hard case: “Ensuring graceful interruptibility is challenging when agents are terminated mid-action-sequence”. Orseau and Armstrong write of the moment an operator must “press the big red button”. Hadfield-Menell and colleagues call “the ability to turn the system off” one of the primary tools for mitigating risk from a misbehaving system. The shared seat action sidesteps the mid-action case by not terminating its agent, and that is a limit as much as a design.

What has not been shown

  • The reviewed record holds no qualifying production receipt of a halt stopping a run mid-flight. The attended drill that would write one is pending in that record. The inventory reports a search by run list on UTC, across the two console global windows (from , 23:00:00 UTC to , 04:30:00 UTC, and from , 14:00:00 UTC to , 15:30:00 UTC). That search did not cover every seat run's log.
  • The default polling interval is 30 seconds. A sandbox test configured to poll every 1 second requires termination within 15 seconds. Production stop latency has not been demonstrated. The inventory reported 0 GitHub runs of the repair workflow as an earlier observation on UTC.
  • No qualifying receipt at docs/org/evidence/halt-drills.jsonl is present in the searched ref. Its manifest condition halt-observed-mid-run is pending in that record. Its Phase One row, P1-41, reads landed; that status alone does not demonstrate the attended walk.
  • The committed records contain a standalone cancel test. No committed receipt demonstrates the combined pause and cancel path. Newest halt change on record: 2711bbb4a6f1ea4aa1f001a86f059862dbdeebcf, observed UTC. Outstanding external effects, descendant agents, cancellation failure and recovery remain unproven here. An API acceptance is not evidence that all work ceased.
  • Matching committed HALTs overlapping the recorded windows: handoff loop, 0, from UTC to UTC; pulse-fix, 0, from UTC to UTC. Snapshot dated UTC. This does not establish the absence of local working-tree halts.
  • Latency here is press to commit, with times rounded to whole seconds. The push to main comes after it, by seconds in the one run measured, and the moment a seat reads the file is its next start or landing check. There is no press to effect measurement.
  • By how each halt file was created, the record holds 2 pre-staged by the ladder, 0 from the breaker and 0 rollbacks; 0 evaluator halts are unclassified. Who authored the commit is a separate question. Whether the breaker stopped a run was not checked.
  • The valve script writes no record of its denials, so it counts none. When the downgrade latch tripped on UTC, it read quota as blind, finding no committed pace source in this installation; its row, P1-16, reads open.
  • Who placed the global halt of the domain move is not established: both its commits carry an author field naming neither a person nor the console. Their messages describe a deliberate halt.

Where this is going

This section is a target, not a measurement.

The North Star the repository holds every session to: “every failure is caught by the Machine itself, and a human touches it only through recorded commands and directives”.

  • A halt that stops a run in flight is documented with a committed production receipt.
  • Every agent the Machine runs stops on a halt mid-run, not only at its landing.
  • Every stop is counted on main, not only in a run's artifact.
  • The Kill Switch's pause and cancel path is walked once, with a receipt.

Questions

What happens when the kill switch is pressed?
The console requests a recorded global pause and a cancel for each running seat run it can name. A seat stops at its next check: before its agent starts or, in the shared action, before it lands. Finance Ledger checks at preflight only. Model-refresh keeps observing under a halt but suppresses drafting and publication; other named maintenance workflows have no such gate.
Does a halt stop an agent that is already working?
Not in the shared seat action. The agent runs on, and its landing is refused if a halt covering that seat is present at the landing check. The repair worker has a separate process watch. The reviewed record holds no qualifying production receipt of a halt stopping a run mid-flight. The attended drill that would write one is pending in that record.
How fast does a halt take effect?
A console press has become a commit in 43 to 141 seconds, median 60. Times rounded to whole seconds. The push to main follows in the same run. A seat is affected when it next reads the file, at its next start or a landing check. This page has no measurement of press to effect.
What does the kill switch not stop?
Control runs, including the one that places the halt. Seats outside a scoped halt's scope, and supervised runs under a scoped halt. Work a run committed before a cancel. Some maintenance crons have no halt gate.
Can an agent remove its own halt?
The shared org-agent action refuses landing when a halt covering the seat is present at its landing check. Finance Ledger checks at preflight only. A halt lifted between checks may go unobserved. Supervised runs can proceed past scoped halts. Since the owner-key rule landed, the handoff loop and pulse-fix accept a removal only if the owner signed it. Removals at or before the rule's introduction are accepted as historical. Scoped halts whose file, as created, names the evaluator or ladder as its writer are exempt. Seats read the file's absence as a resume.
Has a halt ever stopped a run mid-flight?
Not shown. The reviewed record holds no qualifying production receipt of a halt stopping a run mid-flight. The attended drill that would write one is pending in that record.
What is the difference between pause, cancel and the Kill Switch?
A pause places one halt file, scoped or global, and takes effect at the next check that covers it. A cancel requests cancellation of one named GitHub Actions run and cannot undo committed work. The Kill Switch sends separate pause and cancel commands; it is not an atomic stop.
Who can resume the Machine?
A console resume removes a halt through a recorded command. The closing record reports an operator's resume refused and the owner's admitted in the scoped walk. A halt the evaluator or ladder placed needs the owner's acknowledgement in the console. Since the owner-key rule landed, the handoff loop and pulse-fix accept a removal only if the owner signed it. Removals at or before the rule's introduction are accepted as historical. Scoped halts whose file, as created, names the evaluator or ladder as its writer are exempt.

Writing on the kill switch

Read further

The three papers quoted above were each opened on UTC.

A stop is only as good as the record of what it did.

Cite this page

Cite this page for the record of each stop, with the date printed beside each figure. Cite the papers under Read further for interruptibility itself.

Bartak, J. (2026). Kill switch. Orbyt Labs Research. https://www.orbytlabs.ai/research/kill-switch