plimsoll reports the isolation tier each agent run actually got

plimsoll, a self-hosted Go daemon for running agent-written code, launched on Show HN. Every result carries the actual isolation tier (process, container, kernel, vm), and a request can demand a minimum tier — otherwise it returns ErrInsufficientIsolation and nothing runs. The author checked six hosted sandboxes (E2B, Modal, Daytona, Vercel Sandbox, Cloudflare, Northflank) and found none reports the wall a run actually got.

• Isolation tiers: process, container, kernel, vm, weakest first
• Requests set MinimumIsolation; below it nothing executes
• Pre-dispatch refusals carry a reason; unmarked ones mean "may have run"
• Each run gets SHA-256 digests of request and result