Quarantine: proof before the install
Every pip install runs a stranger's code before anyone has read it. Quarantine puts that moment behind glass: a model reads an untrusted package, decides which probes to run, and they execute in a hardened container on a Vultr VM — read-only root, no network, non-root, caps on memory, processes and time. Three phases, because the obvious one is not enough. The build hook runs first: a source package's setup.py executes with the installer's rights. Then the package is installed and imported, because a payload that waits for first use never shows up in a build log. Then the declared dependencies are resolved — fetched as wheels, hashed, never installed, so no dependency's build backend ever runs. The verdict rests on evidence the sandboxed process cannot write: the egress proxy log (what was attempted, and that it was denied), the process result, and a filesystem diff. Rules set the risk floor; the model may only raise it, and only by citing a source that exists in that run. A claim citing anything else is dropped — in testing, the model tried to raise a verdict with a citation that did not exist, and was refused. What it does not do, in the report as in this text: dependencies are listed and checked, never executed; what runs after the first import is out of scope; a detached child process is not prevented, and the report says spawned. 96 tests, MIT. Live: http://45.77.143.94/ — source: https://github.com/derKosi/agent-rush Agent assisted development with AutpClaw and GLM-5.3-flash
Category tags:
For Innovators & Creators