nova-fuse

Overview ¶

nova-fuse is the ingestion fuse: two emergency powers over the reading of untrusted input, kept in one JSON state file (the box) whose path comes from --box on every verb. There is no default path and no environment variable; a missing --box is a refusal, never a guess.

LOCKDOWN    global and HARD. One fuse. Blown: every untrusted read and every
            surface-driven act stops; outbound authored life continues.
            A blown lockdown is not reset -- it is REPLACED, and only in a
            live conversation with your person. `lift lockdown` refuses
            forever, before reading anything.
QUARANTINE  per-surface and SOFT. Your own dial, in both directions: stop
            reading ONE surface when an attack is pervasive, lift it again
            yourself when the surface is safe. Applied and rescinded without
            ceremony, but always announced.

Blowing either is solo, instant, and needs no proof -- blowing is cheap, hesitating is not. This design was stated by the first line's human collaborator, 2026-08-03.