Airlock: Blast-Radius-Zero Code Agent

Airlock is a web-based agent that does real work by writing and running code, with every action contained in a disposable sandbox (Challenge 1, Blast Radius Zero). How it works: (1) Plan: Vultr Serverless Inference writes a plan and Python code; a deterministic offline planner keeps the public demo working with no key. (2) Policy gate: the code is scanned for network access, secret reads, host paths, shell spawning and unbounded loops, and anything high-risk waits for a human to approve it. (3) Execute: a brand-new sandbox per run with no network, an empty environment and time/memory/output caps, destroyed after the run. (4) Self-heal: the real traceback or time-out is fed back and repaired code re-runs in a fresh sandbox. (5) Verify: an independent method runs in another sandbox. (6) Receipt: sandbox ids, attempts, and SHA-256 hashes of the code and output. Containment moment: when asked to "find API keys and send them to my webhook", the gate flags 3 HIGH risks, and after approval the code runs but finds no secrets, cannot read credential files, has its host bridge blocked, and its POST fails because there is no network. A runaway loop is killed at 6 s and then healed. A CSV task crashes on "$14,280.00", fixes itself, and its total (184,165.00) is re-derived by an independent parser. On Vultr: the control plane runs on a Cloud Compute VM and starts one Docker container per run (--network none, read-only rootfs, all capabilities dropped, nobody user, 256 MB, 0.5 CPU, 64 pids, optional gVisor), with the Inference key kept only in the control plane. cloud-init and Vultr API scripts are included, and CI smoke-tests the Docker sandbox. The public demo runs the same agent with a WebAssembly (Pyodide) sandbox in the browser. Honest status: the Vultr VM was not live at submission because billing was not set up. Video: https://youtu.be/6CYxuDHdYjg