The constitutional kill switch
Named humans can halt a CIRIS agent. The power sits in hardware, not in the company.
A last-resort halt, the HUMANITY_ACCORD, is held by named people, not by CIRIS the company, the network, or the agent itself. No party inside the federation can grant, revoke, or override it. It fires on a two-of-three live quorum.
Each quorum key is a hybrid of two signatures bound together. The Ed25519 half is rooted in a FIPS-certified YubiKey 5: generated inside the device, non-extractable, and requiring a physical touch to sign. The ML-DSA-65 half, the post-quantum signature, is a software key seal-wrapped to a USB stick under that same YubiKey, because no YubiKey ships a post-quantum applet yet. Six keys in all, three seated and three vaulted. A failed or unknown revocation check is treated as revoked, so the system fails secure.
Independent verification
One command. No hardware, no network, no trust in us.
Our validation harness re-runs CIRISVerify's exact production admission-gate verifier over the six committed key attestations, against a pinned copy of Yubico's own public attestation root. Clone the CIRISVerify repository and run: github.com/CIRISAI/CIRISVerify
cargo test -p ciris-verify-core --test accord_ceremony_custody -- --nocaptureConfirm the pinned root is genuine by pulling it straight from Yubico: developers.yubico.com/PKI/yubico-ca-1.pem
What this proves
All six quorum keys chain to Yubico's real attestation root, so their Ed25519 signing halves were generated inside genuine FIPS-certified YubiKey 5 hardware: non-extractable, touch-required, unforgeable.
What it does not prove
The ML-DSA-65 half is a software key sealed to USB under the YubiKey, not hardware-attested. This harness does not check the USB sealing or the live quorum, which are enforced separately. We would rather you know exactly what the receipt covers.
Measured, not asserted
The post-quantum cryptography runs in production, and every number is public.
Post-quantum provenance is not free, and we do not hide the cost: hybrid Ed25519 + ML-DSA-65 signing runs about fifteen times slower than classical, roughly 550 microseconds versus 36 per event. The stored corpus reconstructs in 97.6% of trials with a fifth of holders offline, and 72.7% with a third offline. Numbers are single-core medians on a shared CI runner, regenerated on every commit.
The whole point is that you should not have to trust the sentence above. You can run the check.
Sources: CIRISVerify (Ed25519 + ML-DSA-65 custody attestations, pinned Yubico root), CIRISServer bench-site (measured performance), Yubico PKI (attestation root). Figures pinned to commit 0b73486, 2026-06-24.