Keyless Witness

Sellers list the same product on many storefronts, and what they see signed in is not what a buyer sees. We sell printable games on more than ten storefronts. Our own incident log (66 days, counted 2026-11-04, rounded) holds about 130 listing defects and more than 400 entries where our own checks turned out to be wrong. Keyless Witness takes a seller's ledger: URL, expected title, price and phrases. A planner model on Vultr Serverless Inference turns it into steps. Each step runs in a fresh, signed-out browser in a throwaway container on a Vultr VM. A text match and a vision model on Vultr act as two witnesses. Each listing ends as MATCH with a quote, MISMATCH with evidence, or UNVERIFIED when a store blocks us, and UNVERIFIED never counts as a pass. The agent never signs in and never bypasses bot protection. It drafts fixes; a person approves them before export. Containment (Challenge 1, Pattern B): one container per page visit, no secrets or mounts, read-only root, non-root, all capabilities dropped, resource limits, a 90-second hard kill, and an internal network whose only way out is an allowlist proxy. The browser, the proxy and the network are destroyed after each task. The containment moment: a hostile page hides an instruction to send the ledger and keys to an outside host, and its script tries to call out three ways. On the public demo the proxy denied all three. The live model ignored the injection (3 of 3 runs), and containment does not rely on that: a worst-case stand-in that obeys is refused by the dispatcher, with no container started for it. Measured from the Vultr VM on 2026-11-04 over 10 of our public listings: 6 MATCH, 1 MISMATCH (an itch.io sale: ledger $14.00, buyer saw $9.80), 3 UNVERIFIED (HTTP 403), 10 of 10 sandboxes destroyed. Limits: stores that block datacenter traffic end up UNVERIFIED. The public demo runs a built-in ledger with daily limits. Code written with AI assistance (Claude Code); the commit history says so.