Blast-radius report
0executed (sandboxed)
0blocked by policy
0host writes
nonenetwork
Vultr Agent Rush · Track: Blast Radius Zero
CanonGuard checks story prompts against a locked continuity bible. Every tool call is allowlisted, path-jailed to /canon, and run in a one-shot container with no network, a read-only filesystem and zero capabilities. Writes and escapes are blocked before they exist.
@character · #location · try “read ../../etc/passwd”