Blast Radius Zero — a sandboxed agent on Vultr

Blast Radius Zero is a dsh plugin bundle (dsh-plugin-blast-radius) that turns the DeepSeek Harness into a control plane for untrusted work. You give it a repository and a goal; it plans a job, and every command that job needs — installing dependencies, compiling, running a test suite, running scanners — is dispatched into a disposable Microsandbox microVM that exists for that job and nothing else. The agent touches the code, never the machine. Why the boundary is the product: an agent that modifies a codebase runs dozens of binaries nobody wrote, some of them hostile. Process isolation, secret hygiene, resource caps and lifecycle discipline are enforced on every exec: host credentials never enter the microVM, the egress allowlist only ever attaches the inference key to api.vultrinference.com, and the VM is destroyed when the task ends. Verifiable output, not prose: before and after a run, eighteen metrics are measured (source lines, dependencies, CVEs, test count, coverage, peak memory, wall time). Every row carries the command that produced it, its exit code and a SHA-256 of the output, and every tool call is appended to a hash-chained receipt log, so a finding can be replayed and a claim checked instead of believed. On Vultr: Cloud Compute (VX1) hosts the stack, nginx terminates TLS on 443 and proxies to the dsh web UI on loopback, Serverless Inference at api.vultrinference.com/v1 serves the agent's model calls, and the Vultr API v2 provisions and destroys throwaway instances. Stack: TypeScript on Node 22, zero runtime dependencies, a Python sandbox runner, 92 automated tests, MIT licensed. Status: the tree is complete and green offline (18 verify checks, 63 gate checks, 92 tests, receipt chain head 15a413244d15). The public demo box, the domain and the recorded containment moment are the three steps that need a Vultr account and a KVM host, and each is listed with its blocker in docs/BLOCKED-EXTERNAL.md.