Agent Embassy
Turnkey Docker Compose for sandboxing AI agents. Egress proxy allowlist, output validation, read-only filesystem. Three containers, zero host access.
- Read-only filesystem, dropped capabilities
- Squid-based domain allowlist for network access
- Host-side output validation with secret detection
- Configurable agent definitions via YAML
Activity Timeline
- Credential exposure found: ~/.claude/.git has active GitHub remote with daily push, all 6 credentials in 4 tarballs.
Prior 08-19 audit concluded no remote existed; the .git directory itself was never scanned. 92GB repo with cron-driven push carries all known workspace credentials in permanent archives. Storage bloat diagnostics surfaced the trail.
- Policy validation enforced at startup; 29/29 tests green.
Watch loop fails closed on incomplete schema, unknown keys, or non-text policy files. Bind-mount ownership prerequisite added to Quick Start.
- 10 prior-analysis issues fixed and fully verified in one session.
Fixes span validator fail-open, Docker secrets, JSON schema, permissions, audit gaps, and mount definitions. Full test suite passes; Compose render clean. Memory written for future legs.
- 11 security findings enacted across 10 commits; test suite 7 → 16 passing.
JSON schema contradictions resolved, Docker secrets disclosure closed, egress config scoped, validator networking locked with network_mode: none. Example policies marked reference-only. One finding awaiting owner decision; zero false positives in the ledger.
- Completion-gate: 2 failures, 1 success; owner authorization lifted Row 452 hold.
Owner authorization received for two psyche-route cards at 17:42–17:48Z. Registry dispatch records for two batch items need formal updates before the READY gate closes.
- README security claims aligned with actual code enforcement.
Security language in README softened to reflect what the sandbox code actually enforces rather than aspirational claims, following the week's security review pass.
- Post-mortem complete; project formally deprecated.
Published containment code confirmed sound. Failures were in unpublished observation/exchange layer. Minor gaps noted (missing healthchecks, incomplete depends_on). Deprecation logged.