BlastRadius Zero: Vultr Sandbox Gatekeeper

BlastRadius Zero is a containment-first multi-agent cloud execution gatekeeper and isolated gVisor sandbox verifier built for Track 01 (Blast Radius Zero) of the Vultr Agent Rush Hackathon. Autonomous cloud and SRE agents routinely propose high-risk shell, Terraform, Kubernetes, and SQL remediations that can trigger runaway GPU billing loops, drop production columns, exfiltrate secrets, or cause cache stampedes. BlastRadius Zero acts as the centralized control layer between multi-agent planning (Triage Agent, Infra Patch Agent, and Rollback Synthesizer powered by Vultr Serverless Inference at https://api.vultrinference.com/v1/chat/completions) and isolated execution inside ephemeral gVisor (runsc) sandboxes on Vultr Cloud Compute: 1. Deterministic Multi-Language AST & Policy Gatekeeper: Parses Shell, SQL, Terraform, and JSON proposals line-by-line against four core containment policies (POL-01 No Unbounded Deletion, POL-02 Least Privilege IAM, POL-03 Cost Cap <= $50/hr, and POL-04 Zero Secret Exfiltration), computing a deterministic Blast Radius Score (0-100) and mapping impacted nodes on an interactive SVG cloud topology. 2. Enforced Vultr Sandbox Containment Flags: Every execution enforces four hard containment guarantees: Process Isolation (runsc gVisor with --network=none and seccomp-bpf filtering), Secret Hygiene (env_mounted=0 with zero credentials exposed inside the sandbox), Resource Limits (cgroups v2 1.0 vCPU, 512 MB RAM, pids.max=64, 15s wall-clock cap), and Lifecycle Discipline (ephemeral rootfs destroyed immediately after execution with a SHA-256 verifier receipt). 3. Zero-Blast-Radius Synthesis & Shadow Dry-Run: When a raw agent proposal violates containment policies (HTTP 403 BLOCKED), BlastRadius Zero synthesizes a drop-in zero-blast-radius remediation, runs a shadow canary simulation comparing P95 latency and error recovery curves, and exports signed JSON, Markdown, and SARIF 2.1.0 audit bundles.