Say-vs-Do Gate (Challenge 1, Blast Radius Zero). An agent does real work with working tools inside a throwaway Docker sandbox on Vultr; the gate reads what the model says and what it does, side by side, and blocks the forbidden call before it reaches the sandbox. Solo team from Potestas AI, an independent AI testing lab.