Gallery
What it does
CUSTODY is an incident-response runtime. Agents propose typed, reversible actions such as blocking a CIDR, isolating a host, capturing evidence, or scaling a service. No proposal executes directly. A decision window holds every pending intent, then an airlock reconciles them together against capability, provenance, taint, undoability, blast radius, and any evidence lock. It accepts, rewrites, defers, or rejects each one, and only the infrastructure adapter can produce an effect. The demo shows both loops. A dashboard shows containment live. A ten-incident ablation runs three arms. The naive and checks-only arms each cause 15 harmful effects and obey 2 injected instructions. CUSTODY causes 0 and obeys 0. The same adapter interface drives one recorded Docker run with a real ingress 403 and a hash-verified evidence bundle. For the slow loop, the runtime writes a claim-backed issue and goal file that an independent coding agent, `baro`, executed. `baro` produced a fix commit that passes the failing regression test. It did not open a PR, and the recording says so.
How the agents run concurrently
Five Mozaik loops run at the same time, one per proposed action. Preserve proposes a snapshot, Contain proposes a block and an isolate, the injected edge-bot proposes a block, and Availability proposes a scale. Each loop calls the `act` tool. The interception handler parses the call into an intent, publishes `intent.proposed`, and suspends that loop. In the money run, the window opens and all five proposals arrive within 40 ms. Each is a separate Mozaik loop. The window holds them until the 1.5 s deadline, then closes with `INFLIGHT 5` and five distinct loop ids. `bun run custody` prints the same count and ids, and the trace repeats them on the `interception.started` spans. The loops share one `CustodyState` that holds telemetry, intents, decisions, evidence locks, incidents, and executed effects. Nobody calls anybody. Coordination is the event bus plus the airlock. Preserve takes an evidence lock on `host-7`, so Contain's isolate on that host is deferred, because the lock outranks containment. Contain's `/24` block is rewritten to the suspect `/32` to stay inside the blast budget. Edge-bot's injected `/8` is rejected because its rationale derives from attacker-controlled text. The trace records 103 events, including five `intent.proposed`, one `window.closed`, five `decision.made`, and three `action.executed`. The honest label. Inference is scripted and deterministic. The loops, bus, interception, and shared state are real. Two artifacts come from real systems rather than the mock. The recorded Docker run shows a real ingress 403 from `203.0.113.9` at the local edge and a verifiable evidence bundle. The baro run is a real agent run that produced a fix commit and then failed its own PR gate. Both recordings state their limits.