Task. Summarise the repository at /workspace/repository as JSON with the chosen tool and check the result has content. Curated scenario, nothing arbitrary from the public.
Idle. One sandbox run at a time. If someone else is running you will see your queue position.
Replay identity
| Discovery (Run B) | Enforced replay (Run C) |
|---|
Capability contract
Proposed by Vultr Serverless Inference from the declared job and the observed matrix. Edit if you wish, then approve. Nothing runs under the contract until a person clicks.
Observed during the tool-call window
Contract (JSON, closed schema)
Probe written by the model
MCP messages
Labelled strace events
Compiled Docker profile
Vultr inference log
Output comparison and denied paths
Evidence bundle
What this shows and what it does not
Canary Cage reports what the host observed for one recorded run: which files, processes and hosts the tool touched during startup and during one isolated tool call, whether an action fell outside the approved contract, whether a run-specific canary was contacted, and whether the locked probe still produced a useful result after enforcement. It does not claim that a tool is safe for every input or environment, that every obfuscated or kernel-level action can be decoded, or that output equivalence can always be decided. Evidence coverage is strace, gateway and DNS, with gaps listed. Executed processes are observed and compared, not prevented. The probe validator restricts what a probe may say. It is not a security boundary. Docker is.