Run untrusted code safely, quick checks first.
teleon.dev/docs/sandbox runs untrusted code in two tiers. Fast WebAssembly checks go first with metered fuel; full tests follow in containers with the network closed. Every run is signed and checked by a different model family than the one that wrote it.
The fast tier screens first; only passing work goes on to the full test run.
What it does
Fast tier first
WebAssembly runs syntax, schema and small checks with metered fuel.
Full tier second
Containers with a closed network run full test suites after the fast tier passes.
Signed, cross-checked
Receipts are signed, and the verifier's model family differs from the creator's.
The contract
A run request names the tier, the checks and the creator; the receipt names the verifier.
task_proof_certificate/v1
Endpoints
| Method | Path | Access | What it does | Status |
|---|---|---|---|---|
POST | /v1/runs | RING-2 | Run an artifact through the tiers | |
GET | /v1/runs/{id} | RING-2 | Read a run's receipt | |
GET | /v1/oracles | RING-3 | List the problem oracles available |
Listed paths appear in the service’s published files today. In the one-host plan every path here is served under api.teleon.dev/v1/sandbox.
How it connects
For agents
Give your agent the read-only guide first. It reports back before any write.
Words on this page
- Wasm sandbox
- WebAssembly runtime with fuel metering and closed network access, used to run untrusted code safely.
- CPOP
- Cross-provider pairing: the model family that checks a result differs from the one that made it.
- Proof certificate
- A small file that lets a checker confirm a result is correct far faster than redoing the work.