Break-glass & recovery

ORBIT governs at your agent’s tool boundary through a local hook wired into ~/.claude/settings.json. Recovery is entirely local — removing or disabling that hook stops ORBIT immediately, with no call to the service and no account required. Recovery never depends on ORBIT being reachable.

Set the connector to shadow / fail-open. It keeps recording but never asks or blocks — your agent runs normally while you investigate. Edit ~/.orbit/claude-code-orbit.json:

# ~/.orbit/claude-code-orbit.json
{ "mode": "shadow", "failOpen": true, ... }

Restart Claude Code. Flip mode back to enforce when you’re ready.

The installer saved your original Claude Code settings before adding the hook. Restoring that backup removes ORBIT’s hook cleanly:

cp ~/.claude/settings.json.pre-orbit-backup ~/.claude/settings.json

No backup? Open ~/.claude/settings.json and delete the PreToolUse entry whose command runs orbit-claude-code-hook.mjs. Restart Claude Code.

Remove the hook wiring (above), then delete ORBIT’s local files:

rm -rf ~/.orbit   # connector, config, API key, agent id

That leaves no ORBIT footprint on the machine. Your account, receipts, and policy remain in the dashboard until you delete them there.

In shadow / fail-open (the default install), a service outage never blocks your agent — actions proceed and are recorded when possible. In enforce mode ORBIT is deliberately fail-closed for governed actions, so if you need to keep working during an outage, pause ORBIT (shadow) or restore your settings using the local steps above — none of which contact the service.

Reinstall any time with the Quickstart, or re-enable by flipping mode back to enforce. If an outage or a wrong policy caused this, the dashboard’s Activity shows exactly what happened, and How ORBIT works explains the model.