Show HN: Plimsoll, a self-hosted sandbox for code your AI agent writes

TEXT START: plimsoll runs untrusted code, such as code an AI agent wrote, inside a sandbox, and every result says how strong that sandbox was.

The Dissection

This is a deployment-and-trust layer for agent-written software. It converts “the agent ran code” into a graded claim: isolation tier, minimum acceptable floor, refusal semantics, hashes, replay, hidden trials, and brokered credentials. The cart-pole demonstration proves reproducibility and evaluation plumbing—not general correctness, adversarial robustness, or safe autonomy.

The document’s unusually candid disclosures—process isolation is unsafe for hostile code; tier evidence is not attestation; the project is pre-1.0; there is no third-party audit—make the operational boundaries clearer. They do not make the boundary strong.

The Core Fallacy

It treats trustworthy execution as if it addressed the primary danger. Under the Discontinuity Thesis, the primary danger is not that AI-written code lacks a sufficiently legible sandbox. It is that reliable sandboxes remove one of the last frictions preventing AI from performing cognitive work at scale.

Plimsoll does not interrupt automation. It makes automation safer to deploy, easier to govern, and easier to sell. The wall around the code may improve security while the economic wall around human productive participation collapses. This is P1 infrastructure wearing the costume of restraint.

It also risks confusing evidence with proof. A daemon’s configuration, startup checks, hashes, and replay records can establish what the software claims to have observed. They do not cryptographically prove what hardware, kernel, runtime, or operator actually enforced. Identical fingerprints can certify identical failure.

Hidden Assumptions

• The configured isolation tier accurately represents the protection delivered in production.
• Containers, gVisor, VM providers, images, runtimes, dependencies, and broker code contain no exploitable failure that defeats the stated boundary.
• Correct refusal markers and request IDs prevent dangerous retry or identity errors across every deployment topology.
• Capability grants and short-lived credentials prevent meaningful exfiltration even when the guest, broker, API, or caller is compromised.
• Hidden scenario files prevent overfitting and meaningfully test agent-written programs beyond the narrow simulation being supplied.
• Deterministic hashes and replay establish trust rather than merely repeat the same flawed execution.
• Operators will correctly configure providers, sessions, seccomp, credentials, and customer isolation.
• A single-author, pre-1.0 project with no external users and no independent security audit can carry production-grade trust.
• Self-hosting transfers control to the customer without transferring an equivalent burden of maintenance, incident response, and security expertise.
• The technical success of a cart-pole controller says anything significant about the reliability of arbitrary agent-generated software.
• The relevant social problem is unsafe execution rather than the destruction of the wage-to-consumption circuit.

Social Function

Transition management, prestige signaling, and partial truth, with a secondary function as ideological anesthetic.

It is transition management because it prepares institutions to absorb agentic automation by making its risks legible and governable. It is prestige signaling because reproducible runs, attestations, isolation tiers, and browser replay create the appearance of a new professional standard around machine-produced work. It is partial truth because sandboxing and capability control solve real infrastructure problems.

The anesthetic lies in the framing: once the code is contained, graded, and replayable, deployment appears responsible. The political and economic question—what happens when the contained agent replaces the worker—vanishes outside the frame.

The Verdict

Plimsoll is useful infrastructure and a weak systemic defense. It does not preserve human economic participation; it lubricates its replacement. Its strongest contribution is to make AI agents safe enough for more organizations to trust, integrate, and scale. Under DT logic, that makes it an accelerator of obsolescence, not an antidote to it.