Project Info

plsbro

Inspiration

Most AI-agent products start with a request like “please do this,” then ask us to trust whatever happens next. As agents gain access to files, APIs, money, and production systems, prompt quality is no longer enough. Users need to know what an agent is allowed to do, what data it can access, how much it can spend, what evidence proves the work was completed, who verified the result, and whether the execution environment was destroyed afterward. PLSBRO turns those questions into an explicit, enforceable task contract before execution begins.

What it does

Our demonstration runs a platform-owned CSV-cleanup agent. Before execution, the user sees and approves: The fixed synthetic input Permitted operations Declared output artifacts Deterministic success criteria A deny-all network policy A one-model-call ceiling A $0.00220000 budget reservation The agent runs inside an isolated Vercel Sandbox using a two-stage Python runner: Inspect the task and request one structured column-mapping decision. Execute the approved transformation and produce the declared artifacts. The sandbox has no OpenAI key, no secrets, and no external network access. The model request is handled by the trusted control plane, which sends only CSV headers and platform-owned metadata—not private row values—to the OpenAI Responses API. The agent produces: cleaned.csv reconciliation.json A separate TypeScript verifier then checks that: Required columns are present Status values are normalized Duplicate rows were removed Input and output counts reconcile The files are valid UTF-8 Only declared artifacts were created The output matches the task contract The result is accepted only after those checks pass. How I built it PLSBRO combines: Next.js and TypeScript for the control plane and interface Python 3.13 for the sandbox runner Vercel Sandbox for isolated execution OpenAI Responses API with strict structured output JSON Schema and versioned contracts Integer-based budget accounting Independent artifact verification Hash-linked platform audit evidence Docker-backed runtime and protocol tests GitHub Actions for Linux integration and end-to-end validation The wider foundation also includes transactional lifecycle auditing, leased work execution, retry recovery, stale-worker rejection, idempotency, artifact checksums, and restricted runtime images. The demo intentionally uses a fixed synthetic CSV instead of arbitrary uploads. This makes the workflow safe, repeatable, and objectively verifiable while demonstrating the underlying execution architecture. Live result The successful browser-based execution produced: One actual model call Zero simulated model calls 106 input tokens 32 output tokens A verified cleaned CSV Confirmed sandbox deletion A complete audit timeline At published rates of $1 per million input tokens and $6 per million output tokens: Input cost: 106 × $1 ÷ 1,000,000 = $0.000106 Output cost: 32 × $6 ÷ 1,000,000 = $0.000192 Total measured cost: $0.000298 This stayed well below the reserved maximum of $0.00220000. Challenges The hardest part was not getting the model to clean a CSV. The difficult part was proving that the surrounding system behaved correctly. I had to separate: Agent-generated artifacts from platform-generated evidence Model generation from deterministic verification Sandbox permissions from control-plane permissions Simulated results from live results Budget reservation from actual cost reconciliation Sandbox cleanup also had to occur on success, failure, malformed evidence, timeout, and interruption paths. Another major challenge was maintaining parity across macOS development, Linux containers, and GitHub-hosted CI. Differences in filesystem permissions, process reaping, command behavior, runtime environment variables, and Node installation layouts exposed assumptions that local tests did not initially reveal. Deployment introduced additional lessons around secret handling, access-code protection, disabled-first releases, restricted API keys, and kill-switch restoration. PLSBRO defaults to live execution being disabled and enables it only during controlled demonstration windows. What I learned The largest lesson was that trustworthy agents require more than a capable model. A useful trust layer needs: A specification before execution Least-privilege isolation during execution Bounded spending and provider access Independent verification after execution Auditable evidence for every important transition Fail-safe cleanup on every terminal path I also learned that “the tests are green” is not the same as “the boundary is proven.” Adversarial review repeatedly found cases where evidence could be ambiguous, cleanup could fail, or one operating system behaved differently. Treating those findings as part of the design process made the final system materially stronger.

What's next

The CSV workflow is a focused demonstration of a broader idea. The next step is to generalize the contract, execution, verification, and audit layers so developers can safely define additional workflows. Arbitrary uploads, external tools, and marketplace distribution would come only after the corresponding privacy, permission, and verification boundaries are proven. PLSBRO turns autonomous work from a black box into a bounded, verifiable process—from an explicit contract, to isolated execution, to an audit-ready result. See every boundary. Trust every result.

PLSBRO — Trusted Agent Execution Demo

PLSBRO is a managed operating layer for agent-completed work. This standalone OpenAI Build Week demo proves a narrow developer-tools flow:

synthetic CSV
→ visible task contract
→ human approval
→ deny-all Vercel Sandbox
→ platform-owned Python runner
→ one managed GPT-5.6 Luna mapping decision
→ deterministic transformation and verification
→ artifacts, measured usage, and an audit receipt

This repository is a hackathon demonstration, not production sandbox certification or a complete marketplace.

Our demo

A polished /demo contract-review and approval experience
One bounded sandbox and a two-stage Python runner
A privacy-validated column_mapping_v1 model request
Deterministic success and budget-blocked modes
Independent verification, usage accounting, and an audit timeline
Synthetic input and expected output fixtures

The sandbox has deny-all networking and never receives an OpenAI API key. The trusted server performs the model call and writes the validated response back to the sandbox. The agent produces cleaned.csv and reconciliation.json; PLSBRO independently produces verification, usage evidence, and audit-receipt.json.

How Codex and GPT-5.6 were used

Codex

Codex served as the engineering collaborator. It helped translate the product specification into the architecture and implementation, build the interface and trusted control-plane flow, develop the two-stage Python runner, create security and replay tests, document the system, and remediate independent review findings. Product decisions, external-service authorization, and acceptance remained human-controlled. Codex is not the runtime agent and does not approve its own output.

GPT-5.6 Luna

GPT-5.6 Luna provides one bounded semantic decision in an enabled live-success run: mapping an ambiguous source header such as Cust. Co. to company_name. The trusted control plane makes at most one Responses API call with:

Structured column_mapping_v1 output
store: false
At most 1,000 input tokens and 200 output tokens
A maximum pre-call reservation of $0.00220000
Headers and platform-owned schema metadata only—never CSV row values

Deterministic platform verification remains authoritative. A model response cannot declare its own output verified.

Architecture

Browser
  │ contract approval + private access code
  ▼
Next.js trusted control plane
  ├─ validates permissions, privacy, and budget
  ├─ creates one deny-all Vercel Sandbox
  ├─ runs: python runner.py request
  ├─ validates mapping-request.json
  ├─ calls GPT-5.6 Luna once through Responses API
  ├─ writes mapping-response.json
  ├─ runs: python runner.py execute
  ├─ independently verifies declared artifacts
  └─ returns result, usage, cost, and audit receipt

The Vercel Sandbox uses its built-in Python 3.13 runtime, one vCPU, a maximum 60-second duration, and no network access. Only synthetic fixture data is supported.

Run locally without external services

Requirements: Node.js 24.18.0, pnpm 11.13.1, and Python 3.13.

corepack enable pnpm
pnpm install --frozen-lockfile
cp .env.example .env.local

Set these private local values in .env.local:

H1_DEMO_ENABLED=true
H1_DEMO_ADAPTER=fake
H1_DEMO_ACCESS_CODE=<a long private value>

Then run:

pnpm dev

Open http://localhost:3000/demo. Fake results are explicitly labeled simulated; they report zero actual calls and zero actual cost and cannot be presented as live evidence.

Validate

pnpm check

This runs formatting, lint, TypeScript checks, unit and route tests, the Python runner tests, and a production build. No provider credentials or external calls are required.

Synthetic fixture

Deployment safety

Live execution is intentionally fail-closed. A production deployment requires H1_DEMO_ADAPTER=live, an explicit server-side enable switch, a long private access code, an OpenAI project restricted to gpt-5.6-luna, and Vercel runtime OIDC supplied by Vercel. Never commit credentials, .env.local, .vercel, live access instructions, or provider evidence.

The public repository contains no live credential or access code. Live execution should remain disabled outside a supervised judging window.

Explicit exclusions

No external agent publishing, custom OCI images, VCR, Stripe, marketplace listings, payouts, stored balances, customer data, multi-agent delegation, or production conformance claims are included.

License

MIT — see LICENSE.

Analysis

Compare with all teams

View

Metric

Jayden Kim
5

Figures cover GitHub contributors during the hackathon window. A co-authored commit counts in full for each author, so per-member totals add up to more than the whole-team figures.

Technology

Found in codeClaimed only

CSSIn code
Next.jsIn code
OpenAIIn code
PythonIn code
ReactIn code
TypeScriptIn code
DockerClaimed
VercelClaimed

6 of 8 appear in the indexed code. 2 claimed on Devpost could not be matched to code, which may simply mean the tool leaves no trace in the repository.

AI coding agents

No AI coding agent signals were found in this repository.

Detected from committed agent config files and commit authorship. Absence of a signal is not proof an agent was unused.

Codebase size

Source size

257 KB

Source files

Counts recognized source files only; vendored directories, binaries and lockfiles are excluded, so this is smaller than the repository on disk.