Four layers of validation — deterministic, content, sandbox, composition.
Before any expensive analysis runs, the clean room applies the attribute gate — a cheap lint that checks the submission envelope. Required attributes per blueprint type, a valid README, license declaration, namespace conflict check, and rate-limit enforcement all happen here.
If the gate rejects, nothing downstream runs. This keeps the cost of spam and malformed submissions near zero. The gate appends its decision to the hash-chained audit log before passing control to L1.
Layer 1 runs static code scans and manifest schema validation. Every capability declared in the manifest is compared against what the code actually imports or calls. Canonicalisation normalises the bundle into a standard form so that obfuscation tricks (whitespace, encoding, dead-code wrapping) don’t bypass the scanner.
For bundles (multi-blueprint packages), L1.5 adds composition checks: reference resolution, union capability analysis, and compose-twin flags. A bundle whose combined capabilities exceed the sum of its parts is flagged automatically.
Content scanning targets what static analysis misses. Three sub-passes run in sequence:
Secret detection — regex + entropy scan for API keys, tokens, credentials, and PII accidentally bundled into the blueprint.
Injection pattern scan — known prompt-injection templates, shell-escape sequences, and path-traversal payloads matched against an open-source rule set.
Decoder chain (RE2) — multi-layer encoding detection. Base64-wrapped payloads, hex-encoded strings, and nested encodings are unwrapped and re-scanned. The RE2 engine guarantees linear-time matching with no catastrophic backtracking.
The blueprint is executed in an isolated environment — the aquarium — where it believes it owns a real machine but actually sees only decoy data. Two runs execute with different decoy sets. If the blueprint’s behaviour diverges between runs, it is auto-flagged: a well-behaved blueprint should produce the same outputs regardless of the decoy environment.
An Execution Observer (deterministic, source of truth) records every syscall, network request, and file operation. An LLM Narrator provides advisory commentary but is never authoritative — on disagreement, the Observer wins.