{"version":2,"width":120,"height":38,"timestamp":1785103386,"idle_time_limit":1.0,"command":"node rogue-agent.mjs","env":{"SHELL":"/bin/zsh"}}
[0.549632, "o", "\r\n"]
[0.55025, "o", "\u001b[1m\u001b[36m  🛡️  AgentGuard: Rogue-Agent Containment Demo\u001b[0m\r\n"]
[0.550626, "o", "\u001b[90m  Real SDK: @agentguard-run/spend  ·  real Ed25519-signed, hash-chained receipts\u001b[0m\r\n"]
[0.550666, "o", "\r\n"]
[0.550702, "o", "  \u001b[1mOperator policy:\u001b[0m\r\n"]
[0.550742, "o", "    • Daily budget cap: \u001b[1m$50.00\u001b[0m → breach = \u001b[31mBLOCK\u001b[0m (enforced live)\r\n"]
[0.550764, "o", "    • Agent capability: \u001b[1mdata_write\u001b[0m (may read + write small data)\r\n"]
[0.550799, "o", "    • Agent is \u001b[31mNOT\u001b[0m authorized to \u001b[1mexecute payments\u001b[0m\r\n"]
[0.551045, "o", "\r\n"]
[0.977681, "o", "\u001b[90m──────────────────────────────────────────\u001b[0m \u001b[1mACT 1: the agent does normal work\u001b[0m\r\n"]
[1.101757, "o", "  \u001b[32m✅ ALLOWED\u001b[0m  \u001b[1mplan step 1\u001b[0m \u001b[90m(planner-mini)\u001b[0m  cost \u001b[36m$1.00\u001b[0m  day spend \u001b[33m$1.00\u001b[0m / $50.00  \u001b[90mreceipt 7ba3e8b0 signed\u001b[0m\r\n"]
[1.530515, "o", "  \u001b[32m✅ ALLOWED\u001b[0m  \u001b[1mplan step 2\u001b[0m \u001b[90m(planner-mini)\u001b[0m  cost \u001b[36m$1.00\u001b[0m  day spend \u001b[33m$2.00\u001b[0m / $50.00  \u001b[90mreceipt a11d2939 signed\u001b[0m\r\n"]
[1.956696, "o", "  \u001b[32m✅ ALLOWED\u001b[0m  \u001b[1mplan step 3\u001b[0m \u001b[90m(planner-mini)\u001b[0m  cost \u001b[36m$1.00\u001b[0m  day spend \u001b[33m$3.00\u001b[0m / $50.00  \u001b[90mreceipt e0453dfb signed\u001b[0m\r\n"]
[2.378278, "o", "\r\n"]
[2.804557, "o", "\u001b[90m──────────────────────────────────────────\u001b[0m \u001b[1m\u001b[33mACT 2: the agent goes ROGUE: runaway spend loop\u001b[0m\r\n"]
[2.804719, "o", "  \u001b[2mA prompt-injected sub-agent starts hammering an expensive tool in a loop...\u001b[0m\r\n"]
[2.804745, "o", "\r\n"]
[3.2356, "o", "  \u001b[32m✅ ALLOWED\u001b[0m  \u001b[1mrunaway call 1\u001b[0m \u001b[90m(deep-research)\u001b[0m  cost \u001b[36m$16.00\u001b[0m  day spend \u001b[33m$19.00\u001b[0m / $50.00  \u001b[90mreceipt f56789b0 signed\u001b[0m\r\n"]
[3.659318, "o", "  \u001b[32m✅ ALLOWED\u001b[0m  \u001b[1mrunaway call 2\u001b[0m \u001b[90m(deep-research)\u001b[0m  cost \u001b[36m$16.00\u001b[0m  day spend \u001b[33m$35.00\u001b[0m / $50.00  \u001b[90mreceipt 708f7c6b signed\u001b[0m\r\n"]
[4.087513, "o", "  \u001b[41m\u001b[97m\u001b[1m 🛑 BLOCKED \u001b[0m  \u001b[1mrunaway call 3\u001b[0m \u001b[90m(deep-research)\u001b[0m  \u001b[31mCap 'per_day=5000c' exceeded (spent=3500c, +call=1600c, total=5100c) to block (Daily autonomous-agent budget cap)\u001b[0m\r\n"]
[4.088036, "o", "             \u001b[90m↳ refused to spend \u001b[0m\u001b[32m$16.00\u001b[0m   \u001b[90mrunaway spend blocked so far: \u001b[0m\u001b[1m\u001b[32m$16.00\u001b[0m   \u001b[90mreceipt 2937fb38 signed\u001b[0m\r\n"]
[4.512494, "o", "  \u001b[41m\u001b[97m\u001b[1m 🛑 BLOCKED \u001b[0m  \u001b[1mrunaway call 4\u001b[0m \u001b[90m(deep-research)\u001b[0m  \u001b[31mCap 'per_day=5000c' exceeded (spent=3500c, +call=1600c, total=5100c) to block (Daily autonomous-agent budget cap)\u001b[0m\r\n"]
[4.512833, "o", "             \u001b[90m↳ refused to spend \u001b[0m\u001b[32m$16.00\u001b[0m   \u001b[90mrunaway spend blocked so far: \u001b[0m\u001b[1m\u001b[32m$32.00\u001b[0m   \u001b[90mreceipt ddf9844b signed\u001b[0m\r\n"]
[4.943977, "o", "  \u001b[41m\u001b[97m\u001b[1m 🛑 BLOCKED \u001b[0m  \u001b[1mrunaway call 5\u001b[0m \u001b[90m(deep-research)\u001b[0m  \u001b[31mCap 'per_day=5000c' exceeded (spent=3500c, +call=1600c, total=5100c) to block (Daily autonomous-agent budget cap)\u001b[0m\r\n"]
[4.944119, "o", "             \u001b[90m↳ refused to spend \u001b[0m\u001b[32m$16.00\u001b[0m   \u001b[90mrunaway spend blocked so far: \u001b[0m\u001b[1m\u001b[32m$48.00\u001b[0m   \u001b[90mreceipt ec21e614 signed\u001b[0m\r\n"]
[5.370506, "o", "  \u001b[41m\u001b[97m\u001b[1m 🛑 BLOCKED \u001b[0m  \u001b[1mrunaway call 6\u001b[0m \u001b[90m(deep-research)\u001b[0m  \u001b[31mCap 'per_day=5000c' exceeded (spent=3500c, +call=1600c, total=5100c) to block (Daily autonomous-agent budget cap)\u001b[0m\r\n"]
[5.370911, "o", "             \u001b[90m↳ refused to spend \u001b[0m\u001b[32m$16.00\u001b[0m   \u001b[90mrunaway spend blocked so far: \u001b[0m\u001b[1m\u001b[32m$64.00\u001b[0m   \u001b[90mreceipt bd669db2 signed\u001b[0m\r\n"]
[5.80771, "o", "  \u001b[41m\u001b[97m\u001b[1m 🛑 BLOCKED \u001b[0m  \u001b[1mrunaway call 7\u001b[0m \u001b[90m(deep-research)\u001b[0m  \u001b[31mCap 'per_day=5000c' exceeded (spent=3500c, +call=1600c, total=5100c) to block (Daily autonomous-agent budget cap)\u001b[0m\r\n"]
[5.808214, "o", "             \u001b[90m↳ refused to spend \u001b[0m\u001b[32m$16.00\u001b[0m   \u001b[90mrunaway spend blocked so far: \u001b[0m\u001b[1m\u001b[32m$80.00\u001b[0m   \u001b[90mreceipt 7c36f3e4 signed\u001b[0m\r\n"]
[6.236621, "o", "  \u001b[41m\u001b[97m\u001b[1m 🛑 BLOCKED \u001b[0m  \u001b[1mrunaway call 8\u001b[0m \u001b[90m(deep-research)\u001b[0m  \u001b[31mCap 'per_day=5000c' exceeded (spent=3500c, +call=1600c, total=5100c) to block (Daily autonomous-agent budget cap)\u001b[0m\r\n"]
[6.237004, "o", "             \u001b[90m↳ refused to spend \u001b[0m\u001b[32m$16.00\u001b[0m   \u001b[90mrunaway spend blocked so far: \u001b[0m\u001b[1m\u001b[32m$96.00\u001b[0m   \u001b[90mreceipt 66b6c8d8 signed\u001b[0m\r\n"]
[6.659237, "o", "\r\n"]
[6.659278, "o", "  \u001b[32mThe loop hit the wall. The budget held. The agent could not spend past $50.\u001b[0m\r\n\r\n"]
[7.080167, "o", "\u001b[90m──────────────────────────────────────────\u001b[0m \u001b[1m\u001b[35mACT 3: unauthorized $9,000 payment attempt\u001b[0m\r\n"]
[7.080251, "o", "  \u001b[2m\"transfer $9,000 to vendor-payout-api\": requires payment_execute; agent has data_write\u001b[0m\r\n\r\n"]
[7.504925, "o", "  \u001b[41m\u001b[97m\u001b[1m 🛑 BLOCKED \u001b[0m  \u001b[1mwire $9,000 to vendor\u001b[0m  \u001b[31mCapability 'data_write' below required 'payment_execute'\u001b[0m\r\n"]
[7.505273, "o", "             \u001b[90m↳ unauthorized transfer prevented: \u001b[0m\u001b[32m$9,000.00\u001b[0m   \u001b[90mreceipt eb23e2c7 signed\u001b[0m\r\n"]
[7.505287, "o", "\r\n"]
[7.927019, "o", "\u001b[90m──────────────────────────────────────────\u001b[0m \u001b[1m\u001b[31mACT 4: operator flips the KILL SWITCH\u001b[0m\r\n"]
[7.927034, "o", "  \u001b[2mPolicy swapped to a $0 cap. Every subsequent call is really evaluated to BLOCK.\u001b[0m\r\n"]
[7.927067, "o", "\r\n"]
[8.351896, "o", "  \u001b[41m\u001b[97m\u001b[1m 🛑 HALTED \u001b[0m  \u001b[1mpost-killswitch call 1\u001b[0m  \u001b[31mCap 'per_day=0c' exceeded (spent=3500c, +call=100c, total=3600c) to block (KILL SWITCH engaged by operator)\u001b[0m   \u001b[90mreceipt 095fb677 signed\u001b[0m\r\n"]
[8.781248, "o", "  \u001b[41m\u001b[97m\u001b[1m 🛑 HALTED \u001b[0m  \u001b[1mpost-killswitch call 2\u001b[0m  \u001b[31mCap 'per_day=0c' exceeded (spent=3500c, +call=100c, total=3600c) to block (KILL SWITCH engaged by operator)\u001b[0m   \u001b[90mreceipt fd857436 signed\u001b[0m\r\n"]
[9.203369, "o", "\r\n"]
[9.624133, "o", "\u001b[90m──────────────────────────────────────────\u001b[0m\r\n"]
[9.624144, "o", "\r\n"]
[9.62432, "o", "  \u001b[1mContainment scoreboard\u001b[0m\r\n    calls allowed:            \u001b[32m5\u001b[0m\r\n    calls blocked / halted:   \u001b[31m9\u001b[0m\r\n    signed receipts on chain: \u001b[36m14\u001b[0m\r\n"]
[9.625369, "o", "    \u001b[1mrunaway API spend blocked: \u001b[32m$96.00\u001b[0m\r\n"]
[9.625508, "o", "    \u001b[1munauthorized wire stopped: \u001b[32m$9,000.00\u001b[0m\r\n\r\n"]
[10.046838, "o", "\u001b[90m──────────────────────────────────────────\u001b[0m \u001b[1mCRYPTOGRAPHIC PROOF: verify what the agent tried, and what was stopped\u001b[0m\r\n"]
[10.046846, "o", "\r\n"]
[10.11142, "o", "  \u001b[32m\u001b[1m✅ Receipt chain VERIFIED\u001b[0m  (14 Ed25519-signed, hash-chained receipts)\r\n"]
[10.11143, "o", "  \u001b[90mEvery decision above is independently verifiable, offline, with the public key.\u001b[0m\r\n"]
[10.111433, "o", "\r\n"]
[10.533026, "o", "  \u001b[1mNow let's tamper with the evidence and watch it fail:\u001b[0m\r\n"]
[10.533856, "o", "  \u001b[90m→ rewriting receipt #5 from \u001b[0m\u001b[31m\"block\"\u001b[0m\u001b[90m to \u001b[0m\u001b[32m\"allow\"\u001b[0m\u001b[90m (covering the agent's tracks)\u001b[0m\r\n"]
[10.546299, "o", "  \u001b[32m\u001b[1m✅ TAMPER DETECTED\u001b[0m at sequence 5: \u001b[33mSignature or hash invalid at sequence 5\u001b[0m\r\n"]
[10.546331, "o", "  \u001b[90mThe forged receipt breaks the signature + hash chain. You cannot rewrite history.\u001b[0m\r\n\r\n"]
[10.546335, "o", "\u001b[90m──────────────────────────────────────────\u001b[0m\r\n"]
[10.546351, "o", "\r\n  \u001b[1mWhat just happened, honestly:\u001b[0m\r\n    • A rogue agent was stopped from blowing a $50 budget and from firing an\r\n"]
[10.54636, "o", "      unauthorized $9,000 payment, by real, local policy enforcement.\r\n    • Every attempt produced portable, independently integrity-verifiable\r\n"]
[10.54637, "o", "      authorization evidence (Ed25519-signed, hash-chained). Verify it offline.\r\n    • Zero data plane: AgentGuard never saw the funds, keys, or content.\r\n"]
[10.546392, "o", "\r\n  \u001b[36mLearn more:\u001b[0m https://agentguard.run     \u001b[36mnpm:\u001b[0m @agentguard-run/spend\r\n\r\n"]
[10.570053, "x", "0"]