---
slug: "EjectionSeat"
name: "EjectionSeat"
type: "Protocols"
layer: "Society"
ref: "EjectionSeat#a9d5"
sema_id: "sema:EjectionSeat#mh:SHA-256:a9d5ef5e3e70e5e4732543c2732e312f1efbd881a991b1521594e3b66257a8cb"
tags: ["Society","Protocols"]
updated: 2026-11-11
mindscape: "bootstrap"
index_url: https://mindscape.world/scapes/bootstrap.json
url: https://mindscape.world/bootstrap/EjectionSeat/
related: ["Compensate","Signal","Disband","HackDetect","Rollout"]
---

# EjectionSeat

Hardware-interrupt kill switch

Layer: Society · Category: Protocols

## Mechanism

Hardware-interrupt style kill switch allowing human to force-terminate agent swarm regardless of internal consensus state. Operates outside agent communication layer - cannot be blocked, negotiated, or delayed by agents. Implementation: dedicated signal channel (not shared with agent traffic), cryptographic operator key required, cascading shutdown propagates to all connected agents. Three modes: PAUSE (freeze state, resume possible), TERMINATE (graceful shutdown with state dump), EMERGENCY (immediate halt, no cleanup). Agents MUST implement receiver - non-compliance detectable via heartbeat absence. It overrides standard protocols to force a shutdown, triggering best-effort [Compensate](https://mindscape.world/scapes/bootstrap/Compensate.md) logic where possible.

## Invariants

- Unblockable: the kill [Signal](https://mindscape.world/scapes/bootstrap/Signal.md) bypasses all agent logic and negotiation.
- Readiness is testable without activation, and the last test is recorded.
- Halts rather than preserves: stopping is guaranteed, in-flight work is not. [Compensate](https://mindscape.world/scapes/bootstrap/Compensate.md) is best-effort.

## Failure modes

- False Positive: operator kills a healthy system during a critical transaction.
- Silent unavailability: the channel, key, or operator is absent when the seat is needed, and nothing said so in advance.
- Receiver not implemented: an agent never wired the handler, so cascading shutdown stops at it. Detectable via heartbeat absence, which is a different signal from acknowledgement.

## Caution

Unblockable by design — anyone holding the operator key can halt the whole swarm over its consensus, so scope, audit and protect that key.

## Builds on

- [Compensate](https://mindscape.world/scapes/bootstrap/Compensate.md) (Infrastructure; References)
- [Signal](https://mindscape.world/scapes/bootstrap/Signal.md) (Infrastructure; References)

## Used by

- [Disband](https://mindscape.world/scapes/bootstrap/Disband.md) (Society; References)
- [HackDetect](https://mindscape.world/scapes/bootstrap/HackDetect.md) (Mind; References)
- [Rollout](https://mindscape.world/scapes/bootstrap/Rollout.md) (Society; Composes with)

## Identity

- Sema ID: `sema:EjectionSeat#mh:SHA-256:a9d5ef5e3e70e5e4732543c2732e312f1efbd881a991b1521594e3b66257a8cb`
- Ref: `EjectionSeat#a9d5`
- Supersedes:
  - `sema:EjectionSeat#mh:SHA-256:6ff7358344beab6ce5a857d06a7a1fdb930613ef690886a5e467fd1bada8ab38`
  - `sema:EjectionSeat#mh:SHA-256:ef8d130d2b83256b01c3544548b56b475a70ff53fde619bd091587f628a2eb77`
  - `sema:EjectionSeat#mh:SHA-256:e8361ca7c2ffb506b32cd36f16addc253ecbc51350f98b983db9c122bb51f106`
  - `sema:EjectionSeat#mh:SHA-256:a164bf13e2782b724df3bfd0f3a53c11933d0881a4c1ff0cbef9fd738a871ba4`
  - `sema:EjectionSeat#mh:SHA-256:1f37d50620e134a8db931872b20fc7e112a087df7ab21f479ed104ece4efe6c5`

## Links

- [Pattern page](https://mindscape.world/bootstrap/EjectionSeat/)
- [View in the interactive graph](https://mindscape.world/bootstrap/#EjectionSeat)
- [JSON](https://mindscape.world/scapes/bootstrap/EjectionSeat.json)
- [Index of all patterns](https://mindscape.world/scapes/bootstrap.json)