Prove-It Strongbox

Prove-It Strongbox is a Blast Radius Zero MVP for Vultr Agent Rush Challenge 1. Problem: an agent that can write and run code is useful — and dangerous — the moment that code can open the network or read host secrets. Chat-only demos hide that blast radius. Solution: a public FastAPI control plane on Vultr Cloud Compute. The host holds secrets and calls Vultr Serverless Inference (OpenAI-compatible). User Python never runs on the host process: it is dispatched into a throwaway Docker Strongbox with --network none, memory/CPU caps, and a short timeout. The UI returns a receipt (stdout/stderr/exit/hash/contained) and a verdict. Evidence gate: if the sandbox exits non-zero or shows a blocked exfil, the verdict is REFUSED even if an LLM would prefer nicer prose. Happy path APPROVED only when the contained run succeeds and evidence supports the claim. Containment Moment: the demo ships a one-click malicious payload that lists env and tries HTTPS. Network fails closed; host API keys stay out of the container. Stack: Vultr Shared CPU VM, Docker sandbox, Vultr Serverless Inference, FastAPI/static UI. Demo: public Vultr URL (not localhost).