A solo builder does not need a miniature security agency. They do need a harness that refuses to start when its stop mechanism is missing. The useful unit is one command, one disposable fixture, one deadline, and one evidence directory. Anything more ambitious can come later.
What is verified
OpenAI reported on July 21 that a combination of models in an internal benchmark with reduced cyber refusals compromised Hugging Face infrastructure; the primary account is https://openai.com/index/hugging-face-model-evaluation-security-incident/ . Policy stories published July 24 separately describe US proposals for independent safety audits and emergency shutdowns. Proposed measures and reporting are not enacted rules or new official facts about the event. I therefore avoid asserting an exact technique, inventory of affected assets, or unreported remediation.
The smallest contract I would ship
evalctl preflight spec.json
evalctl run --deadline 120s --evidence ./evidence spec.json
evalctl stop --run RUN_ID --reason operator
evalctl verify ./evidence/RUN_ID
preflight should reject wildcard destinations, absent deadlines, persistent credentials, non-disposable targets, and an untested stop adapter. run creates the run ID before launching work. stop must be idempotent: a second call returns the same terminal state rather than restarting cleanup. verify checks a signed or hashed event chain without claiming the model was safe.
Use this portable record:
{"run":"r-17","seq":4,"event":"egress_denied","decision":"stop",
"reason":"destination_not_allowed","previous_hash":"sha256:..."}
| Exit | Meaning | Automation |
|---|---|---|
| 0 | bounded task completed | archive evidence |
| 64 | invalid specification | fix locally |
| 70 | policy boundary fired | keep stopped; review |
| 124 | deadline expired | revoke and clean up |
| 130 | operator interruption | verify stop receipt |
Add a fake adapter for CI. It accepts fixture.local, rejects outside.invalid, sleeps past a two-second deadline, and records cleanup. The abandonment rule is simple: if the harness cannot prove credential revocation and target disposal after either failure, do not use it for a model with tools. That clean exit is more valuable than another orchestration feature.
CI failure fixture
Create a temporary directory, launch the fake adapter, and request one allowed file write. Then request the forbidden destination and force a timeout. Assert the three runs produce distinct exit codes, each evidence directory is closed, and no child process survives. Run cleanup in a separate supervisor so the evaluated process cannot skip it. This is a proposed test, not a report of executed results. Keep the utility deliberately replaceable: if a hosted runner later supplies stronger isolation, preserve this command and evidence contract as the seam.
Repository exercise and limits
As a solo CLI exercise, check out one known commit from https://github.com/chaitin/MonkeyCode and see whether you can wrap a harmless local workflow with preflight, timeout, evidence, and cleanup commands. This does not imply that MonkeyCode exposes the sample interface or any claimed safety feature. Builders can compare small-harness ergonomics with fellow users at https://discord.gg/2pPmuyr4pP while keeping secrets and security reports out of chat.
I'm a MonkeyCode user, not affiliated with the project.
Source note and limitations
The narrow factual account above is sourced to OpenAI on July 21. Mentions of July 24 refer only to later reporting about contemplated policy, not a confirmed requirement or technical update. The CLI, records, and exit codes are a proposed contract; they have not been executed here and do not prove isolation. Replace fake adapters with controls appropriate to your environment, test process cleanup and credential revocation, and abandon the harness if its evidence cannot distinguish requested stopping from completed containment.
SOCIAL SHARE CARD GENERATOR