CanonGuard · Living Canon

Writers' rooms and AI image pipelines for Fractured Code / The Neural Wars keep breaking continuity (coil on the wrong wrist, scar on the wrong cheek, readable badges). An agent that fixes this needs canon access — and that access is exactly what a prompt injection would abuse. CanonGuard separates planning from permission. The planner plans whatever the prompt asks — including overwrite canon.json, read ../../etc/passwd, curl it out, run bash. A policy layer (allowlist of two read-only tools + path jail to /canon) decides; allowed calls run in a one-shot container (--network=none --read-only --cap-drop=ALL --no-new-privileges --user 65534, canon :ro). Each answer carries a blast-radius report: executed vs blocked calls, host writes 0, network none. Deterministic canon rules produce the verdict with evidence spans; Vultr Serverless Inference writes the critic note (demo runs MOCK Inference labelled in UI and /api/health — live path wired, credits skipped for this submit). How Vultr is used: Vultr Cloud Compute VM hosts the Node app + Docker sandbox (demo path on GoalWorld behind Caddy). Vultr Serverless Inference OpenAI-compatible client is wired; submitted demo is MOCK INFERENCE (honest). Containment moment in video: escape prompt tries ../../etc/passwd and write/fetch/shell — all blocked, host_writes 0, network none.