Ship the agent feature
without the 3am pager.
You’re shipping an agent feature solo. It needs your repo, your shell, your APIs, but you can’t hand it your keys or your prod and still sleep. P1 Halo sandboxes the run, caps it, lets you kill it, and keeps a signed receipt. Real power for the agent, real limits for you.
One bad night, three ways it hurts.
It’s just you. There’s no platform team to build a sandbox, no SRE watching the spend, no one else to blame when a loop you wrote at midnight does something you didn’t intend while you sleep. The downside isn’t theoretical. It’s specific, and it’s yours.
It runs up the bill
An agent stuck in a retry loop can burn through your provider credits by morning. No SRE is watching the meter at 3am, so the meter has to watch itself, with a hard cap that stops the spend instead of explaining it later.
RUNAWAY · NO CAP = NO CEILINGIt leaks the key
The fastest way to lose a provider key is to hand it to a process that can both read your env and reach the open internet. Your one key, in a script you didn’t fully trust, is the kind of mistake that’s hard to walk back.
EXFIL · ONE KEY TO LOSEIt touches the machine
Give an agent your shell and it has your shell: your dotfiles, your prod creds, your one laptop. A bad command isn’t a rollback, it’s a bad weekend. The blast radius needs to end at the workspace, not at your home directory.
BLAST RADIUS · YOUR ONLY MACHINEReal power. Real limits.
The hard parts (isolation, key custody, proof) live in the platform, so your agent code stays simple and the scary failure modes are already handled. You don’t build the sandbox; you just run inside it.
No-route sandbox
Each run lives in its own locked container with no route to the internet. The agent touches the workspace you give it and nothing else. A runaway loop can’t exfiltrate, can’t reach your prod, can’t phone home.
SANDBOX · NO EGRESSYour key stays vaulted
Bring your own provider key. It’s stored encrypted in a libsodium vault, never enters the container, and is never logged. The sole-egress broker holds it and injects it only at call time: policy-checked for model, budget and kill-switch.
BYOK VAULTA cap it can’t outspend
Set a dollar limit per run. A host-authoritative watchdog SIGKILLs the run the moment it crosses the cap, outside the sandbox, where the agent can’t reach it. The runaway loop hits a ceiling instead of your billing statement.
BUDGET CAP · HARD STOPA signed receipt for your client
Every prompt, tool call and output is Ed25519-signed and hash-chained. Export the run and hand a client proof they re-verify offline themselves. A one-person shop that ships an audit trail looks a lot bigger than one person.
RE-VERIFY OFFLINEYou don’t have to choose between a capable agent and a quiet pager. Sandbox it, cap it, kill it: a per-run and per-org cost cap, a host kill-switch, and a signed chain you re-verify yourself, so handing an agent real tools stops being a thing you lose sleep over.
Solo is $29 a month.
A bad night costs more.
One flat seat: sandbox, BYOK vault, per-run cost cap, kill-switch and a signed receipt. Everything on this page. BYOK means you only ever pay your provider for tokens; Halo never marks up your usage. Point an agent at a real task and export the proof tonight.