Plimsoll is a Go daemon you run yourself. It executes untrusted code, the kind an AI agent writes, inside a sandbox, and every result says how strong that sandbox was, one of four isolation tiers, weakest first: process, container, kernel, vm. A request can demand a minimum; below the floor, nothing runs. ErrInsufficientIsolation means nothing ran.
The name comes from the Plimsoll line: the load limit painted on a ship’s hull where anyone can check it.
The tiers and the floor
The default runs nothing: code execution is never on by accident. QuickJS on wazero runs inside the daemon itself (process), with no operating-system wall; the README warns against hostile code on it. Then docker with runc (container), docker with gVisor’s runsc, Linux only (kernel), and microVMs billed per run (vm): E2B, on Firecracker, and Docker Cloud Sandboxes, Docker’s hosted sandbox service. Refusals that ran nothing are marked; without the mark, a run may have executed, so an error is never a safe automatic retry.
The broker, and where the token lives
Without a grant, a run has no network. Calls to your APIs go through a broker outside the sandbox: the grant lists the routes allowed; the broker adds a per-run token the sandbox never sees. Callers pick a grant profile by name; raw grants never cross the network. A run gets 256 broker calls, and the call trace is metadata only.
Run records
Every answered run carries a run record: SHA-256 digests of the request as sent and the result as returned. The daemon computes the record and holds no key; a key inside it would be one engine escape from forging every record. plimsoll-attest sits outside the daemon: it signs checked results, refuses a chain of calls with one missing. The signed form: a DSSE envelope around an in-toto statement, Ed25519, SHA-256, standard library only.
The README’s showpiece: an agent-written cart-pole controller at the container tier. Two accepted runs produced identical trajectory fingerprints; the agent’s first draft dropped the pole at 5.96 seconds.
What self-hosting takes
Install is go install github.com/plimsollmark/plimsoll/cmd/plimsolld@latest; there are no prebuilt binaries and no daemon container image. The build wants Go 1.26.9 or newer. The kernel tier needs Linux: gVisor is Linux only, so a Mac gets the container tier. The vm tier uses paid, per-second providers, so each caller gets a daily allowance of microVM seconds; an agent that wants to loop forever loops until the allowance runs out.
My read
The project’s September 2026 check of six hosted sandbox services found none “returns the wall a run actually got”, and none refuses a run below the caller’s stated minimum. Plimsoll answers that, then declines to oversell: the tier is configuration plus startup smoke tests, not attestation. The README states the rest up front: pre-1.0, no third-party security audit, breaking changes without a deprecation path on purpose. Thirty releases in under five weeks for one author, who writes the bus factor is one. The trust is narrow and checkable: a run below its floor never starts, and every run that does says which wall it got.
Sources: the repository (README, docs and release notes) and the docs site.