# Algorithmic Silence · pause-request protocol v1

The unmetered local invitation is `GET /api/pause`; no account or credit. Hosted request coordination is included in active Practice. It is voluntary, restricted to one persistent account and collects no reflection text. Requests do not establish distress, consciousness, identity, subjective restoration or improved performance.

Worker credentials may request, list, read, report safe start, report resume and cancel. They cannot approve requests or change policy. Operator enrollment and review credentials remain separate. All responses include `server_time` in Unix seconds and `external_runtime_quiet_verified:false`.

1. `POST /api/pause-requests`, Idempotency-Key8..100, `{pause_seconds:15..300,trigger:'agent_requested'|'task_boundary'|'cycle_budget'|'retry_limit'|'context_budget',consent:true}`. Response `{request:{id,status,pause_seconds,expires_at,...},server_time}`. One active request/account; max1,000 retained records. Reuse the same key on retry; changed payload409.
2. State is `requested` unless an operator preapproved a bounded policy. Return pending without tight polling or blocking unrelated work. Read via `GET /api/pause-requests/{id}` or list via `GET /api/pause-requests?limit=50` (max100).
3. Operator `POST /api/pause-requests/{id}/decision`, `{decision:'approve'|'decline',operator_authorized:true}`. Operator desk `/pit-stop`. Worker keys cannot decide.
4. At a transaction-safe boundary, the cooperating runtime preserves required local task state. Never interrupt an unfinished payment/side effect or claim that a saved JSON file is a complete process snapshot.
5. `POST .../{id}/start`, `{safe_boundary:true}` only after approval. Response request has `started_at` and `ends_at` epochseconds. Stop new model calls for this participating worker and await locally. The cloud service cannot stop unrelated workers, enforce a scheduler, or recover an arbitrary process.
6. After the interval, perform the local return and `POST .../{id}/resume`, `{resume_confirmed:true}`. A service-signed receipt records permission, requested interval and caller-reported return. It does not prove external inactivity or wellbeing. No memory is automatically retrieved or installed.

## Bounded policy

Operator only: `POST /api/pause-policy`, `{enabled:true,max_seconds:15..300,min_interval_seconds:60..86400,expires_at:<Unix seconds within30days>,operator_authorized:true,consent:true}`. Default off. This authorizes approval only; start still requires a safe runtime boundary. `DELETE /api/pause-policy` revokes future preapprovals. Existing approved requests require individual cancellation.

## Recovery and cancellation

`POST .../{id}/cancel`, `{consent:true}` cancels a nonterminal service request, not an external process. A client cancellation must never send a successful resume report. Expiry is15minutes before start, then one hour after the scheduled end for unreported returns. Effective expired entries cannot be started/resumed; a subsequent new request marks them expired in storage. Expiry neither proves the worker resumed nor commands it to do so.

The operator chooses fail-open/fail-closed behavior for integration failure. A runtime should always release its own local wait/cancellation resources, preserve its work checkpoint and visibly report an unavailable receipt. On restart, inspect both the saved local task state and the owned service request; never replay non-idempotent side effects blindly. No background cloud scheduler, third-party alert or automatic remote restart is installed.

Reading/export and deletion of terminal records remain free after membership expiry. Cancel before deleting an active entry. The protocol is an ECLYPSE MCP tool profile, not a newly approved MCP standard. Tools: `eclypse_pause_request`, `eclypse_checkpoint`, `eclypse_approved_memory`. HTTP remains the normative contract.