# ai-guard — Project brief Repository: https://github.com/Needdoliprane/ai-guard License: Apache-2.0, according to the supplied README. Target domain: https://ai-guard.ovpt.ai Documentation reference date: October 29, 2026. ## Purpose ai-guard is a local-first open source project for running a command or agent in an isolated copy of a project, reviewing decisions and events, then exporting the results. The documented binary is named `agentsandbox`. This summary distinguishes the mechanisms described in the supplied documents, the validation that still needs to be checked, and the planned capabilities that remain to be implemented. It is neither an audit of the current code nor a product test report. ## Documented local mechanisms - The Rust CLI and broker control Docker or Podman from the trusted host. No application container receives the runtime socket. No fallback to running the workload on the host is planned if the runtime is unavailable. - Each session uses a filtered copy in its own volume. The original project is not mounted; export creates a new, checked destination. - Policy decisions happen before launch. A denial or audit unavailability blocks the workflow. The `strict`, `review`, and `observe` profiles apply to the invocation submitted to the broker. - The worker is configured without privileges, with a read-only root filesystem, `none` networking by default, and resource limits. Actual enforcement of these restrictions depends on the runtime and must be observed on the target machine. - The SQLite audit remains independent of the worker. The Rust dashboard serves a TypeScript frontend and stays separate from the agent's trust domain; its role is read-only. - The local HTTP ingress relay described in the README exposes the dashboard and collector. It is separate from the planned relay for workload communication between workers. - Jev is optional and disabled by default. It cannot expand a permission denied by deterministic policy and does not provide containment. ## Documented local trial The supplied README pins Rust 1.99.1 for the CLI. Docker with the Compose plugin or Podman with a Compose provider is required. Local ports 4000 and 8787 must be free. Node 24 is used to build the images and is only needed on the host for direct frontend development. Rootless mode is required by default. The `--allow-rootful-runtime` exception, including for Docker Desktop when it does not report rootless mode, must be explicitly selected on the relevant commands; sessions record `runtime.security_downgrade`. A VM is not evidence of rootless mode. The README's first scenario runs `/usr/bin/id` with the `strict` profile and output capture. Expected results include the session UUID, volume, exit code, and number of changed files if the scan succeeds. This workflow was not run when creating the website. ## Observation and limitations Request, decision, submission to the runtime, observed start, and result are distinct. Observed, reported, or inferred provenance is separate from the Native / Observed / Generic integration level. Missing data remains unknown. The described Codex and Claude parsers process bounded stdout at the end of a session; they do not prove that every tool is checked before execution and do not reconstruct native subagents. The generic image does not contain any provider CLIs. Actual versions, accounts, images, and interfaces must be verified for each integration. When explicitly requested, `bridge` networking does not provide application-level outbound filtering. An injected secret remains readable by worker code; redaction in the audit does not change this property. The local hash chain cannot withstand a complete rewrite by the administrator. ## Current validation still to be verified The README describes local tests and points to current results, but the code and evidence for the current revision were not audited for this website. Historical results or fixture-based results do not carry over to a different platform, provider version, or release. Runtime/platform combinations, restrictions actually enforced, provider sessions, recovery, and restoration each require their own evidence. Production readiness has not been established based on the supplied documents. The website claims no certification or universal compatibility. ## Planned capabilities: relay, multi-tenant support, and cloud The correction at the top of `PRODUCTION_READINESS.md`, dated October 29, 2026, reports that the `tenancy.rs` and `control.rs` modules, registry, quotas, workload relay, and ledger previously announced as delivered were found to be absent. Those historical claims are contradicted and are not evidence of availability. The target design includes authenticated tenant identities, exclusive worker ownership, directed communication permissions, their revocation, quotas, and a usage ledger. The Kubernetes adapter, cloud transports, storage, network policies, and resilience require dedicated implementation and validation. No available hosted service, pricing, or billing mechanism is announced. The target scenario with A1/A2 belonging to tenant A and B1 belonging to tenant B is intended to verify permissions, cross-tenant denials, and revocation on real runtimes. The website's interactive scenario only simulates those decisions in the browser: it does not launch containers or prove isolation. ## Sources and next steps - [Repository and README](https://github.com/Needdoliprane/ai-guard) - [Starting with Docker or Podman](https://github.com/Needdoliprane/ai-guard#démarrer-avec-docker-ou-podman) - [Tests and the explicit runtime test](https://github.com/Needdoliprane/ai-guard#vérifier-le-logiciel) - [Documented limitations](https://github.com/Needdoliprane/ai-guard#limites-à-connaître) - [Documentation index, including current validation and acceptance](https://github.com/Needdoliprane/ai-guard#documentation) This summary is based on the supplied README, `architecture(2).md`, and the correction to `PRODUCTION_READINESS.md`. Links start from the repository root; no default branch is assumed. Connecting the target domain remains separate from publishing the website.