feat(sre): wire AGT SRE kill switch into cmcp session manager#347
Merged
Conversation
…341) Rolling-window deny-rate evaluator tracks policy decisions per agent identity (SPIFFE URI from Agent Manifest). When deny rate exceeds the configured threshold over the rolling window, the closing TRACE claim carries `gateway.kill_switch_triggered: true` — hardware-attested evidence of automated enforcement — and subsequent create_session() calls for that identity raise KillSwitchTripped (403). Changes: - src/cmcp_runtime/kill_switch.py: new KillSwitchEvaluator - src/cmcp_runtime/config.py: KillSwitchConfig dataclass + load_config() parsing - src/cmcp_runtime/errors.py: KillSwitchTripped error (KILL_SWITCH_TRIPPED / 403) - src/cmcp_runtime/session/state.py: kill_switch_triggered flag - src/cmcp_runtime/audit/trace_claim.py: kill_switch_triggered in GatewayAddenda - src/cmcp_runtime/session/manager.py: KillSwitchEvaluator wired at create/close - schemas/trace-claim.schema.json: kill_switch_triggered field - docs/tutorials/kill-switch.md: new tutorial - mkdocs.yml: tutorial added to nav - tests/unit/test_kill_switch.py: 21 unit tests (all passing) Anonymous sessions (no Agent Manifest bound) are never evaluated or blocked. advisory_deny counts as a deny. The kill switch is disabled by default — set kill_switch.enabled: true in cmcp-config.yaml to activate. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…orts - kill_switch.py: remove quotes from KillSwitchConfig annotation (UP037) - config.py: use int | float union syntax in isinstance (UP038) - test_kill_switch.py: remove unused AuditChain and SessionState imports (F401) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
KillSwitchEvaluator) that tracks policy decisions per agent identity (SPIFFE URI from the bound Agent Manifest)min_callssamples, the closing TRACE claim carriesgateway.kill_switch_triggered: true— hardware-attested evidence of automated enforcement, verifiable offline by any regulatorcreate_session()calls for the flagged identity raiseKillSwitchTripped (403)until the gateway restarts or an operator calls the unblock endpointkill_switch.enabled: false); opt in viacmcp-config.yamlCloses #341
What changes
src/cmcp_runtime/kill_switch.pyKillSwitchEvaluatorwith rolling windowsrc/cmcp_runtime/config.pyKillSwitchConfigdataclass,Config.kill_switch,load_config()parsingsrc/cmcp_runtime/errors.pyKillSwitchTrippederror (KILL_SWITCH_TRIPPED / 403)src/cmcp_runtime/session/state.pykill_switch_triggered: boolflagsrc/cmcp_runtime/audit/trace_claim.pykill_switch_triggeredinGatewayAddendasrc/cmcp_runtime/session/manager.pycreate_session()andclose_session()schemas/trace-claim.schema.jsonkill_switch_triggeredfield addeddocs/tutorials/kill-switch.mdmkdocs.ymltests/unit/test_kill_switch.pyBehavior notes
advisory_denycounts as a deny — matches the existingclose_session()deny counting logicbreak_glass_usedaudit chain entry records the trigger event with agent identity and window config_make_ctx()test helpers that use a rawMagicMockfor config get a disabledKillSwitchConfig()by defaultTest plan
pytest tests/unit/test_kill_switch.py— 21 tests, all passingpytest tests/unit/— 725 tests, 0 failurestest_window_expired_events_ignored) uses 1s window + 1.1s sleepadvisory_denytest confirms it counts toward kill switch threshold🤖 Generated with Claude Code