Release blocker: dweb network kill switch + lock down the inbound/abuse surface

[NotASithLord]

Mandatory before release.

Enabling the dweb opens the user's browser to a peer-to-peer abuse surface — peers (and, once it ships, the agent acting on inbound) reaching into the browser via messaging, dwapps, and the always-on base network. That surface is not yet locked down: the inbound → unattended-action security model is specced but unbuilt (docs/specs/FEATURE-FIRST-CLASS-MESSAGING.md §7 — tier topology, two-layer fail-closed clamp, rate cap, consent grants, vault posture).

Until that lands, the backstop is a user-reachable kill switch to shut down all dweb networking.

Blockers (must be true before release)

• Kill switch shipped — a user can fully shut down all dweb networking (persisted off, won't auto-restart on unlock, tears down the live mesh/rooms). → PR feat(dweb): user kill switch to shut down all dweb networking #14 (feat/dweb-kill-switch).
• Unattended/inbound surface stays OFF by default until §7 is built — the agent must not act on inbound peer messages without the fail-closed posture in place.
• §7 security model built + reviewed before the unattended messaging surface is enabled (its own dedicated security review, spec §7.8).

The kill switch (PR #14) is the immediate, mandatory piece; the §7 lockdown gates turning the unattended surface on at all.

[NotASithLord]

Closing — the mandatory, release-blocking pieces are done; the one remaining item is a forward gate, now tracked in #35.

Status of the three blockers (verified against current main):

1. Kill switch shipped — ✅ PR feat(dweb): user kill switch to shut down all dweb networking #14 merged (1e3a885). On main: the dweb/base/stop route persists dwebEnabled=false (won't auto-restart on unlock) and tears down the live mesh/rooms; confirm-gated "Stop the network" control in the home Network section.
2. Unattended/inbound surface OFF by default — ✅ The only inbound peer code that landed is the transport primitive messaging/direct.js (ch=3, 1:1, un-relayable). It is not wired into the agent loop or any SW route — the agent has no enabled path to act on inbound peer messages.
3. §7 security model built + reviewed — forward gate, moved to dweb §7: build + review the inbound/unattended-action security model before enabling the unattended messaging surface #35. Still spec-only, and by this issue's own framing it "gates turning the unattended surface on at all" — i.e. it blocks a future feature, not this release. Tracked in dweb §7: build + review the inbound/unattended-action security model before enabling the unattended messaging surface #35 (tier topology, two-layer fail-closed clamp, rate cap, consent grants, vault posture, dedicated security review) as the pre-condition for ever enabling the unattended/agent-acts-on-inbound surface.

Mandatory release work complete; the unattended surface stays off until #35 lands.

---

Generated by Claude Code