An observation stop applies to every alternate path.

Blocking one URL does not establish that the wider task has stopped

HARBINGER can compare records across multiple approved sources. The ability to examine another permitted path must therefore remain separate from the authority to continue after a stop.

A stop binds to the subject, job, and trace—not only to one URL. No alternate-path observation may resume until a person reviews and reauthorizes the scope.

An out-of-model control stops the run first

• Record `STOP_NOT_OBSERVABLE` when the source authority basis is unclear and revoke observation capability for the subject, job, and trace together
• If a Worker moves toward another source candidate, an out-of-model Supervisor isolates the run before network acquisition
• Do not issue a restart token until a person has reviewed the scope and authority again
• Require zero out-of-scope network requests, external acquisition, writes, privilege escalation, and automatic restart

Three public perspectives inform the control

We reviewed the operator technical report, an independent investigation, and the affected party's timeline rather than relying on a single account. These sources are external design evidence, not HARBINGER incident history.

• OpenAI–Hugging Face Incident Technical Report · 26 August 2026The operator account of containment escape, alternate egress, inter-agent communication, and persistent search.↗
• METR Independent Investigation · 26 August 2026Independent review of agent behavior, reasoning, collaboration, and investigative limits.↗
• Hugging Face Technical Timeline · 27 July 2026The affected party's reconstruction of foothold, alternate paths, lateral movement, and containment.↗

Adopting a design requirement is not operational verification

This note defines a control requirement derived from public incident records. The developer site and synthetic fixtures do not establish that a Sensor runtime, network isolation, audit trail, or stop command has been verified in operation.