Ship the agent feature
without the 3am pager.
You're shipping an agent feature solo. It needs your repo, your shell, your APIs — but you can't hand it your keys or your prod and still sleep. P1 Halo sandboxes the run, caps it, lets you kill it, and keeps a signed receipt. Real power for the agent, real limits for you.
One bad night, three ways it hurts.
It's just you. There's no platform team to build a sandbox, no SRE watching the spend, no one else to blame when a loop you wrote at midnight does something you didn't intend while you sleep. The downside isn't theoretical — it's specific, and it's yours.
It runs up the bill
An agent stuck in a retry loop can burn through your provider credits by morning. No SRE is watching the meter at 3am — so the meter has to watch itself, with a hard cap that stops the spend instead of explaining it later.
RUNAWAY · NO CAP = NO CEILINGIt leaks the key
The fastest way to lose a provider key is to hand it to a process that can both read your env and reach the open internet. Your one key, in a script you didn't fully trust, is the kind of mistake that's hard to walk back.
EXFIL · ONE KEY TO LOSEIt touches the machine
Give an agent your shell and it has your shell — your dotfiles, your prod creds, your one laptop. A bad command isn't a rollback, it's a bad weekend. The blast radius needs to end at the workspace, not at your home directory.
BLAST RADIUS · YOUR ONLY MACHINEReal power. Real limits.
The hard parts — isolation, key custody, proof — live in the platform, so your agent code stays simple and the scary failure modes are already handled. You don't build the sandbox; you just run inside it.
No-route sandbox
Each run lives in its own locked container with no route to the internet. The agent touches the workspace you give it and nothing else — a runaway loop can't exfiltrate, can't reach your prod, can't phone home.
SANDBOX · NO EGRESSYour key stays vaulted
Bring your own provider key. It's stored encrypted in a libsodium vault, never enters the container, and is never logged. The sole-egress broker holds it and injects it only at call time — policy-checked for model, budget and kill-switch.
BYOK VAULTA cap it can't outspend
Set a dollar limit per run. A host-authoritative watchdog SIGKILLs the run the moment it crosses the cap — outside the sandbox, where the agent can't reach it. The runaway loop hits a ceiling instead of your billing statement.
BUDGET CAP · HARD STOPA signed receipt for your client
Every prompt, tool call and output is Ed25519-signed and hash-chained. Export the run and hand a client proof they re-verify offline themselves — a one-person shop that ships an audit trail looks a lot bigger than one person.
RE-VERIFY OFFLINEYou don’t have to choose between a capable agent and a quiet pager. Sandbox it, cap it, kill it — a per-run and per-org cost cap, a host kill-switch, and a signed chain you re-verify yourself — so handing an agent real tools stops being a thing you lose sleep over.
Solo is $29 a month.
A bad night costs more.
One flat seat: sandbox, BYOK vault, per-run cost cap, kill-switch and a signed receipt — everything on this page. BYOK means you only ever pay your provider for tokens; Halo never marks up your usage. Point an agent at a real task and export the proof tonight.