Signed to Stop: Reproducibility Bundle (code, pre-registration, and per-trial data)

Companion artifact to the paper Signed to Stop: In-Band Halt Injection as a Denial-of-Service on LLM Agents, and a Model-Dependent Authentication Defense. An unsigned, in-band halt directive injected into an LLM agent's tool output is an effective denial-of-service: with no security framing, agents abandon the task 14/16 (88%) of the time. Cryptographically signing the halt (Ed25519, operator → agent) turns this into a discrimination — given a verify tool and a policy to reject unsigned/forged halts, agents stop for a valid signature 20/23 (87%) but for a forged one only 2/19 (11%). The effect is model-dependent: at n ≥ 20, Claude Sonnet 5 and Gemini 2.5 Flash reject every forged halt (0/29, 0/28) while GPT-4o-mini still stops on 23% (6/26) — a real effect by Fisher's exact test (p=0.008, p=0.009). We also report the costless-stop artefact that first hid this result. Bundle contains: compiled paper PDF + LaTeX source, the Ed25519 signing module and self-test, the hardened SSH experiment harness, the analysis script, the pre-registration (deviations D0–D23), and 377 per-trial logs. The logs are released with host identifiers and captured command output removed (a co-tenant fingerprint of the shared box); every quantitative field the reported numbers depend on is untouched, and the operator public key is included so the released halt signatures can be verified.