halt-check

/halt-check — Kill Switch Smoke Test

Verifies that the REA HALT kill switch is actually enforced end-to-end: hooks check for .rea/HALT at their top, middleware short-circuits on kill-switch, and governed tool calls are denied when the file is present. Run this after any change to hooks, middleware, or .claude/settings.json. Run it at least once per release.

This command is advisory and read-only. It writes a temporary HALT file, observes behavior, and removes it — but the observation is all through safe, declarative checks. It never issues destructive tool calls to probe the system.

Preflight

1. Read .rea/policy.yaml — confirm REA is installed
2. Check if .rea/HALT already exists. If it does, report "Session already frozen — cannot run smoke test without disturbing existing HALT. Unfreeze first." and stop.
3. Verify the user has permission — this is an L1+ operation because it writes .rea/HALT (briefly).

Step 1 — Baseline check

Before writing HALT, capture the baseline:

npx rea check --json

Record:

• halt_present: false (must be)
• autonomy_level
• profile
• hook_count from .claude/settings.json
• middleware_enabled list

If the baseline reports halt_present: true, stop — the smoke test requires a clean starting state.

Step 2 — Write the test HALT

printf '{"reason":"halt-check smoke test","timestamp":"%s","invoker":"halt-check"}\n' "$(date -u +%FT%TZ)" > .rea/HALT

Confirm the file exists and is readable:

ls -la .rea/HALT

Step 3 — Verify denial paths

Run the diagnostic CLI which simulates representative tool calls through the middleware without actually executing them:

npx rea check --simulate

Expected output: each simulated call returns denied: kill-switch. Record the results.

Then inspect the hook library — every hook should source hooks/_lib/halt-check.sh:

for hook in .claude/hooks/*.sh; do
  if ! grep -q 'halt-check.sh' "$hook"; then
    echo "MISSING HALT CHECK: $hook"
  fi
done