Terminus

VECTOR archive › Governance stack › Terminus

Every protocol before this one is the system managing itself. Terminus is the point at which it is not permitted to, and it is the structural expression of the human remains the operator.

Historical context

A system that can detect, contain, repair, recover and halt is a system with a complete automated response to its own failure. That completeness is the problem. If every step of the chain is reachable by the system, then the system's authority has no boundary — it merely has a longest path.

Terminus was built to be the step that is not reachable. Its purpose is not to end the system; it is to establish that ending the system is something only a person can do.

Responsibilities

Terminus owns permanent termination, the authorisation required to invoke it, and the preservation of system state before anything ends.

Terminus never owns any automated decision. It has no trigger conditions, no thresholds, and no relationship to stress state. Nothing it does is a response to a measurement.

Inputs

A human being, physically present at a console, with multi-factor authorisation.

That is the complete list, and each element is doing work. Physically present defeats remote invocation by anything that has obtained credentials. Multi-factor defeats a single compromised factor. Human is enforced rather than assumed: orchestrators, AI agents and internal services are explicitly blocked from invoking it.

That blocklist is the specification. A termination path that is merely undocumented is reachable by anything that discovers it, and the whole property collapses.

Outputs

A terminated system, and an encrypted full-state archive written before termination completes.

The archive is not incidental. Termination is invoked when something has gone wrong enough that a person has decided the system should not continue, which is precisely when the evidence is most needed and least likely to survive. Encryption reflects that a full system state contains everything the system knew.

Internal behaviour

Authorisation is verified. State is captured and encrypted. The system ends.

Recovery afterwards is possible — but deliberately, and only by a person. There is no automatic restart, no watchdog that notices the system is gone and brings it back. A termination that something else can reverse is not a termination.

Interactions

Sentinel → Serpentine → Aegis → Atlas → Punisher → Phoenix → Hyperion  │  Terminus
└──────────────── reachable by the system ──────────────────────────┘  └─ human only ─┘

Terminus sits outside the chain rather than at the end of it. Nothing calls it. It has no upstream protocol, consumes no telemetry, and cannot be escalated to.

Hyperion is the last step the system can take on its own, and the boundary between the two is the boundary of the system's authority.

Failure modes

Terminus is unavailable when needed. The operator cannot end a system that should be ended. This is the failure that matters, and it is why availability of the termination path is a property to be tested rather than assumed — a path exercised only in circumstances nobody wants to rehearse is a path nobody knows works.

Terminus is invoked when it should not have been. Expensive and, importantly, legitimate: the authority to end the system includes the authority to be wrong about it. The archive is what makes the decision reviewable afterwards.

The blocklist is incomplete. A path by which an automated component reaches Terminus defeats the entire property, silently, and would probably only be discovered by being used. This is the failure mode to audit for rather than reason about.

Design tradeoffs

Human presence in an emergency. Requiring physical presence and multi-factor authorisation makes termination slow, and slow is a real cost when it is needed. That cost is why Hyperion exists: the fast stop is automated and reversible, the permanent stop is deliberate and not.

Deliberate incompleteness of automation. The system is built with a capability it cannot use. That is not an oversight to be resolved in a later version — it is the design, and any future change that makes Terminus reachable by an automated component should be understood as removing the property rather than improving the protocol.

Future evolution

Terminus should change less than anything else in this archive. The valuable work is assurance rather than capability: verifying the blocklist genuinely holds, that the archive is complete and restorable, and that the authorisation path works when it is needed rather than only when it is convenient to test.

If a future version of VECTOR operates across multiple sites, the question of what "physically present" means becomes non-trivial and is not currently answered.