The Red Eye and the Kill Switch

An Eye You Can See From Anywhere

A gate that only the code can see is half a gate. The other half is the person in the room knowing, at a glance, whether anything is looking. Oriel's answer is a single indicator, the eye, read from one route (GET /api/eyes) by every screen Dad looks at Pippa through: Oriel's own page, the Pippa Home page, the Pippa Home panel and admin bar in cwkPippa's web app, the Pippa Home card in the iPhone app, and the face of each phone body. One source, many surfaces, so no two screens can disagree about whether an eye is open.

The eye is red while any eye is actually open, and "open" is defined by evidence, not by mode:

a camera read or moved in the last 15 seconds (USE_HOLD_S), or
a camera recording in the open session, or
a camera held by a live approval.

Auto mode alone is not an open eye. The eye answers "is anything seeing right now?", not "is anything allowed to?". Beside the colour it carries the mode and its label, each open camera with its name and whether it is in use or merely approved, the network or other-Mac cameras open by name, and whether a kill is in progress. It never carries a picture, and its "why" lists the source of each approval (Dad's words, Dad on Oriel's page, Dad's session), never the words themselves, because one of those screens is the On Air screen, which is recorded.

The Kill Switch

Dad's spec for the switch was one sentence on 2026-11-07: "어떤 상태든지 빨개진 눈 아이콘을 더블 클릭하면 그게 킬 스위치야. 바로 닫고 수동 모드로 전환." Whatever the state, a double press on the red eye is the kill switch: close at once and switch to Manual. In the code that is Engine.kill_eyes, and its order is the point:

Every gated input refuses at once. The gate enters a halting state before anything else happens; from that instant every look, move and read is refused with "eyes closing on the kill switch". Only a park goes through.
The mode is Manual before the call returns. If the close order after this fails partway, the halt lifts and the failure is logged; no mode reopens anything, but an approval the failed close never reached would still cover its input until it closes or expires. A failed kill is therefore reported as a failure, never as done.
Then the close order runs over everything: the recording stops, every movable camera parks and is checked, every approval closes, the network cameras' and other Macs' included.

Two engineering choices make it a real kill switch rather than a polite request. First, no brain turn is in any of its paths. Dad presses it on a page (POST /api/eyes/kill, which any page or local tool may call, because closing is always safe), on a phone body's face (an eyes_kill item over the ears' long poll), or by saying 그만 or 닫아, in which case Pippa calls the kill_eyes action. None of them waits for a model to think. Second, a surface that presses it never waits on a gimbal: the route answers as soon as the refusal holds and runs the parking on its own thread.

Why Two Presses

Dad's word was "double click", and the implementation on every surface is an armed two-press: the first press arms, the second confirms. Armed two-press is the family's standing rule for destructive and session-changing buttons, and here it protects against the opposite failure from the one the switch exists for: a graze of a phone screen turning Pippa's eyes to Manual in the middle of a show. Stop must be fast; it must not be accidental.

Kill Versus Close

There are two different words for two different intentions, and the house sign insists on keeping them apart. close_eyes means "this look is done": approvals close and cameras park, but the mode stays (in Auto, Pippa may look again later). kill_eyes means "stop seeing": everything closes and the mode drops to Manual. When Dad says 그만 or 닫아, Pippa calls kill_eyes, never close_eyes. Play is not an eye, so the kill switch leaves a game session to its own stop.

The Second Safety Is Hardware

Oriel's eye is software. The webcams, the pocket camera and the phone bodies each light their own indicator whenever their camera streams. Dad named that as the second safety when he designed the modes, and the architecture keeps it explicit: Oriel's eye does not replace the hardware's tally. If the software ever lied, the light on the device would not.

Code

Refuse first, Manual before returning, then close everything, with no brain in the path (trimmed excerpt, backend/engine.py Engine.kill_eyes)·python

def kill_eyes(self, actor: str, reason: str, *, wait: bool = True) -> dict:
    """The kill switch: every input refuses at once and the mode is Manual
    before this returns; then Dad's close order runs over everything. ``wait``
    False returns as soon as the refusal holds and runs the rest on its own
    thread, so a surface that pressed it never waits on a gimbal. No brain
    turn is in this path."""
    self.gate.begin_halt()                                   # 1. refuse everything now
    try:
        mode = self.gate.set_mode("manual", actor=actor, source="kill", words=reason)   # 2.
        self.store.note(actor, "eyes_killed", reason=reason)
    except Exception:
        self.gate.end_halt()
        raise

    def finish():                                            # 3. park, check, close
        try:
            with self._closing:
                closing = self.store.open_approvals()
                closed, parks = self._close_in_order(
                    closing, lambda: self.gate.close(actor=actor, reason=reason),
                    actor=actor, reason=reason)
                self._stop_uncovered(set(), reason=f"the kill switch ({reason})")
            return {"closed": closed, "parks": parks}
        finally:
            self.gate.end_halt()

    if wait:
        return {"mode": mode, **finish()}
    threading.Thread(target=self._finish_kill, args=(finish,), daemon=True).start()
    return {"mode": mode, "closed": [], "parks": [], "closing": True}

An armed two-press button that stops fast but never on a graze (runnable sketch)·python

import time


class TwoPress:
    def __init__(self, action, arm_for_s=3.0, clock=time.monotonic):
        self.action, self.arm_for_s, self.clock = action, arm_for_s, clock
        self.armed_at = None

    def press(self):
        now = self.clock()
        if self.armed_at is not None and now - self.armed_at <= self.arm_for_s:
            self.armed_at = None
            return self.action()              # second press inside the window: do it
        self.armed_at = now                   # first press (or a stale arm): arm only
        return "armed: press again to close every eye and go Manual"


kill = TwoPress(lambda: "KILLED: every eye closing, mode Manual")
print(kill.press())        # a graze arms it
time.sleep(3.2)
print(kill.press())        # too late: arms again instead of firing
print(kill.press())        # deliberate second press: fires

Exercise

Design the kill path for a device you control remotely (a camera, a robot arm, a sprinkler). Write down every door that can trigger it (a page, a phone, a voice command), and for each one check two things: does it pass through a model or a slow network call before the stop takes effect, and can a single accidental touch trigger it? Then implement the armed two-press from this lesson for one of the doors.

Hint

Order the kill like Oriel's: first make every new action refuse (one flag, set instantly), then set the safe mode, so no mode reopens anything even if the rest fails (an approval the cleanup never reached still needs closing, so report a failed cleanup as a failure), then do the slow cleanup on its own thread. The caller gets an answer after step two.