Don't log the disaster. Stop it.

# sebbi.pro enforcement receiver (Python 3, standard library only)
# Run on a machine that can reach your infrastructure:  python3 receiver.py
# Set SECRET to your loop's webhook_secret and ACTIONS to your own commands.
import hashlib, hmac, json, os, subprocess, time
from http.server import BaseHTTPRequestHandler, HTTPServer

SECRET = os.environ["SEBBI_WEBHOOK_SECRET"]
ACTIONS = [
    # Put your containment commands here, one list per command, e.g.
    # ["kubectl", "scale", "deployment/your-ai", "--replicas=0"],
    # ["aws", "iam", "update-access-key", "--user-name", "your-ai", "--access-key-id", "AKIA...", "--status", "Inactive"],
]

class H(BaseHTTPRequestHandler):
    def do_POST(self):
        body = self.rfile.read(int(self.headers.get("Content-Length", 0)))
        parts = dict(p.split("=", 1) for p in self.headers.get("X-Sebbi-Signature", "").split(",") if "=" in p)
        t = int(parts.get("t", 0))
        good = hmac.new(SECRET.encode(), f"{t}.".encode() + body, hashlib.sha256).hexdigest()
        if not hmac.compare_digest(good, parts.get("v1", "")) or abs(time.time() - t) > 300:
            self.send_response(401); self.end_headers(); return
        event = json.loads(body)
        self.send_response(200); self.end_headers()
        if event.get("test") or event.get("watch_only"):
            return
        for cmd in ACTIONS:
            subprocess.run(cmd, timeout=20)

HTTPServer(("0.0.0.0", int(os.environ.get("PORT", 8443))), H).serve_forever()

// sebbi.pro enforcement receiver (Node 18+, no packages)
// SEBBI_WEBHOOK_SECRET=whsec_... node receiver.js
const http = require("http"), crypto = require("crypto"), { execFile } = require("child_process");
const SECRET = process.env.SEBBI_WEBHOOK_SECRET;
const ACTIONS = [
  // ["kubectl", ["scale", "deployment/your-ai", "--replicas=0"]],
];
http.createServer((req, res) => {
  let chunks = [];
  req.on("data", c => chunks.push(c));
  req.on("end", () => {
    const body = Buffer.concat(chunks);
    const parts = Object.fromEntries((req.headers["x-sebbi-signature"] || "").split(",").map(p => p.split("=")));
    const t = Number(parts.t || 0);
    const good = crypto.createHmac("sha256", SECRET).update(`${t}.`).update(body).digest("hex");
    const ok = parts.v1 && good.length === parts.v1.length &&
      crypto.timingSafeEqual(Buffer.from(good), Buffer.from(parts.v1)) && Math.abs(Date.now() / 1000 - t) < 300;
    if (!ok) { res.writeHead(401).end(); return; }
    res.writeHead(200).end();
    const ev = JSON.parse(body);
    if (ev.test || ev.watch_only) return;
    for (const [cmd, args] of ACTIONS) execFile(cmd, args);
  });
}).listen(process.env.PORT || 8443);

# AWS Lambda (Python) behind a Function URL: verify, then switch the AI's access key off
import base64, boto3, hashlib, hmac, json, os, time

SECRET = os.environ["SEBBI_WEBHOOK_SECRET"]
IAM_USER = os.environ["AI_IAM_USER"]          # the IAM user your AI runs as
iam = boto3.client("iam")

def handler(event, context):
    body = event.get("body") or ""
    raw = base64.b64decode(body) if event.get("isBase64Encoded") else body.encode()
    headers = {k.lower(): v for k, v in (event.get("headers") or {}).items()}
    parts = dict(p.split("=", 1) for p in headers.get("x-sebbi-signature", "").split(",") if "=" in p)
    t = int(parts.get("t", 0))
    good = hmac.new(SECRET.encode(), f"{t}.".encode() + raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(good, parts.get("v1", "")) or abs(time.time() - t) > 300:
        return {"statusCode": 401}
    ev = json.loads(raw)
    if not (ev.get("test") or ev.get("watch_only")):
        for k in iam.list_access_keys(UserName=IAM_USER)["AccessKeyMetadata"]:
            iam.update_access_key(UserName=IAM_USER, AccessKeyId=k["AccessKeyId"], Status="Inactive")
    return {"statusCode": 200}