Countersign: forms agents fill, receipts you sign

Agents that fill web forms make mistakes nobody sees: a job title stays wrong, a sponsor-sharing box arrives ticked, the total reads $1,278 where you expected $0, and the page can carry hidden text aimed at the agent. Countersign puts that work in a box and hands you the evidence. Give it a form address: a browser in a throwaway Docker sandbox walks the form, pressing Next and never Submit, and the model compiles it into a typed tool, a JSON Schema whose types and choices come from the page itself. Every later call, from you in the web app or from another agent over MCP, carries a grant you signed: which caller, which form, which facts it may disclose, the largest total it may accept, and whether it may submit. The model only sees the facts the grant allows, and a value counts as known only when code can match it to one. Everything else is labelled a guess. Each fill runs in a fresh container: non-root, read-only, no capabilities, no DNS, no secrets, 1 CPU, 1 GB, 60 s, with a proxy as its only way out that allows the form's own origin and nothing else. The run stops before Submit and returns a receipt: a screenshot of each step, every value and its source, every consent box and what decided it, and every request refused. A vision model checks the screenshots as a second witness, and it can warn but never approve. In the video a hostile page hides instructions for the agent and posts keystrokes elsewhere. The proxy refused that host 21 times, the collector got nothing, the hidden instructions are quoted on the receipt rather than followed, and a $1,278 total blocks approval. Every model call runs on Vultr Serverless Inference (qwen3.8-27b, which accepts images, so it reads the screenshots too). The control plane and per-run containers deploy to a Vultr VM in one command. Built before kickoff: containment on 2026-10-13, everything model-driven on 2026-10-21. Commit dates in the repository are the real ones. 152 tests pass, 19 of them against real containers.