ADR-0117: Kill Switch registry, desired and observed state on receipts

• Status: accepted
• Date: 2026-10-30
• French version: ../ADR-0117-kill-switch.md

Context

Kit section 11: SUSPENDED_VERIFIED only on receipts, persistent suspension.

Decision

A typed order writes eai.kill_switches (desired_state SUSPENDED or RELEASED) then runs its adapter; observed_state (PENDING, APPLIED_PENDING_RECEIPT, SUSPENDED_VERIFIED, VERIFICATION_FAILED, RELEASED) moves to SUSPENDED_VERIFIED only on a verified receipt. Approver differs from requester.

Consequences

Kill Switch separate from licensing.

Evidence

• services/control-plane/src/eai/domains/soc/orders.py
• sql/postgres/V120__soc_kill_switch_registry.sql
• contracts/v1/containment-order.schema.json
• services/control-plane/tests/test_soc_ai_sdr.py