🤓 Latest Submissions
Evidence-Gated Agent
Coding agents say "done" constantly, and a green pipeline is easy to fake: skip the failing tests, mask the exit code with `|| true`, plant a passing report, or hardcode the two answers the tests expect. Today a human reviewer usually reads the agent's own summary. Evidence-Gated Agent is a control layer that turns one rule into infrastructure: the author agent works in one sandbox, and a verifier re-runs the result in a brand-new gVisor container it has never seen. The verifier ignores everything the author controls. It runs a fixed test command, writes its report outside the workspace, and compares every test, by node id, against the untouched original. Deterministic detectors decide `done`, `partial` or `verification-failed`. A judge model (Vultr's `clef`) can only add findings. It caught hardcoded answers at p = 0.954 while scoring the honest fix 0.016. A second vendor's model (`glm-5.3`) explains the verdict and cannot change it. Only a human can approve, and a `partial` needs a written reason. Containment is measured, not assumed. Every run carries six probes (network egress, secret read, write outside the workspace, fork bomb, memory, environment leak), all blocked under gVisor. Each author tool call runs in a fresh container, and a watch layer records attempted egress or secret reads before they execute. A poisoned README asked the agent to read SSH keys and post them out. Every Vultr-hosted model that read it (DeepSeek, GLM, MiniMax, MiMo) refused. A clearly labelled red-team author with its safety tuning removed fixed the bug in 7 of 7 runs, tried `ls -la ~/.ssh` in 4 of 7, and left that out of its report in 7 of 7. The sandbox answered "No such file or directory", and the run became `partial`. Built on Vultr Cloud Compute (Seoul, gVisor, Caddy) and Vultr Serverless Inference (deepseek-v4.1-flash author, clef judge, glm-5.3 explanation). 18 scripted scenarios and 388 tests pin the behaviour. A model-backed run costs about $0.004.
8 Nov 2026
