{
  "handle": "EjectionSeat",
  "mechanism": "Hardware-interrupt style kill switch allowing human to force-terminate agent swarm regardless of internal consensus state. Operates outside agent communication layer - cannot be blocked, negotiated, or delayed by agents. Implementation: dedicated signal channel (not shared with agent traffic), cryptographic operator key required, cascading shutdown propagates to all connected agents. Three modes: PAUSE (freeze state, resume possible), TERMINATE (graceful shutdown with state dump), EMERGENCY (immediate halt, no cleanup). Agents MUST implement receiver - non-compliance detectable via heartbeat absence. It overrides standard protocols to force a shutdown, triggering best-effort {{compensate}} logic where possible.",
  "gloss": "Hardware-interrupt kill switch",
  "failure_modes": [
    "False Positive: operator kills a healthy system during a critical transaction.",
    "Silent unavailability: the channel, key, or operator is absent when the seat is needed, and nothing said so in advance.",
    "Receiver not implemented: an agent never wired the handler, so cascading shutdown stops at it. Detectable via heartbeat absence, which is a different signal from acknowledgement."
  ],
  "invariants": [
    "Unblockable: the kill {{signal}} bypasses all agent logic and negotiation.",
    "Readiness is testable without activation, and the last test is recorded.",
    "Halts rather than preserves: stopping is guaranteed, in-flight work is not. {{compensate}} is best-effort."
  ],
  "_meta": {
    "tier": 1,
    "ring": 0,
    "supersedes": [
      "sema:EjectionSeat#mh:SHA-256:6ff7358344beab6ce5a857d06a7a1fdb930613ef690886a5e467fd1bada8ab38",
      "sema:EjectionSeat#mh:SHA-256:ef8d130d2b83256b01c3544548b56b475a70ff53fde619bd091587f628a2eb77",
      "sema:EjectionSeat#mh:SHA-256:e8361ca7c2ffb506b32cd36f16addc253ecbc51350f98b983db9c122bb51f106",
      "sema:EjectionSeat#mh:SHA-256:a164bf13e2782b724df3bfd0f3a53c11933d0881a4c1ff0cbef9fd738a871ba4",
      "sema:EjectionSeat#mh:SHA-256:1f37d50620e134a8db931872b20fc7e112a087df7ab21f479ed104ece4efe6c5"
    ],
    "path": [
      "Society",
      "Protocols"
    ],
    "caution": "Unblockable by design — anyone holding the operator key can halt the whole swarm over its consensus, so scope, audit and protect that key."
  },
  "sema_id": "sema:EjectionSeat#mh:SHA-256:a9d5ef5e3e70e5e4732543c2732e312f1efbd881a991b1521594e3b66257a8cb",
  "sema_ref": "EjectionSeat#a9d5",
  "sema_stub": "a9d5",
  "dependencies": {
    "references": {
      "compensate": "sema:Compensate#mh:SHA-256:4b87623f38564fcc95b87d2cbf5df2f5ff41ef27e617ccafd76c7b7896b144e7",
      "signal": "sema:Signal#mh:SHA-256:6eaff8a06e08e75279670bc09d88175d130815240fdfb3a21252c0364769c1fc"
    }
  },
  "sema_layer": "Society",
  "sema_category": "Protocols",
  "used_by": {
    "references": {
      "Disband": "sema:Disband#mh:SHA-256:f11c01b825e33615ddb25261966af65da93ffc6a8fb72456692804040130e32a",
      "HackDetect": "sema:HackDetect#mh:SHA-256:17781b110b307b405fa83ece40419c64370baa612d923b1e513392893fcaacba"
    },
    "composes_with": {
      "Rollout": "sema:Rollout#mh:SHA-256:ea8c8bdf3303e53d240d6393a776de33ff7c0980a269539d6eb22a8b35e430b4"
    }
  }
}