plimsoll trainer · 07 / cookbook

Customer examples

Five jobs customers actually bring, each as a recipe with four ingredients: the code the agent writes; the profile, a grant (permission for a run's code to call listed routes of one API) stored under a name, exactly as the daemon's grants file spells it; the floor, the weakest isolation tier (how strong the wall around a run is) the run accepts; and the provider that fits, the backend that runs the code. Every recipe ends with three calls it must refuse, because a recipe is defined as much by what it turns away as by its happy path.

Pick a job

Each card's profile is in the format PLIMSOLL_GRANTS_FILE loads. The caller sends only the profile's name; nothing in these files can be changed by a request. The first recipe is code mode: instead of calling one tool per step, the agent writes a short program that calls the API, and that program runs in a sandbox.

The same gate for every recipe

The ingredients differ; what has to be proved before launch does not. Check it against the customer's deployment, not a local demo.

Identity is mapped, not pretended.One plimsoll client (a caller credential) per tenant, meaning per customer organisation, when the downstream API's policy must tell tenants apart. A shared gateway token gives every request the same subject and carries the original customer's identity nowhere.
The profile is chosen in trusted configuration.Never an argument the model controls, and the calling principal, the authenticated identity the request comes from, is in its allowed_callers.
A route not on the list and an encoded path traversal were tried.Both were refused by the broker, the part of plimsoll that makes the sandbox's API calls, on every provider the recipe uses, before the customer's API saw either. An encoded traversal hides ../ in a path, for example as %2e%2e/.
The floor is enforced at three layers.SANDBOX_MIN_ISOLATION on the daemon, MinimumIsolation on each request, and the returned tier read before any output is used.
Every outcome has the same shape.Size-capped stdout and stderr, exit code, timed out, duration, sandbox, isolation; a failure of the guest, the code running in the sandbox, is a result, not a transport error.
Quotas are set, and work past them is shed, refused at once, not queued.Count, rate, memory, time and output, keyed to the caller, with bounded retry documented for capacity only.
The token is nowhere the guest can look.Code, preamble (the helper JavaScript loaded before the code), environment, stdout, stderr, errors, traces, logs. It lives in Go.
The audit line names identifiers, never contents.Caller, profile, provider, isolation, sizes, exit, duration; no code, no token, no customer data.

Customer examples

Pick a job

The same gate for every recipe

Keep reading