{"slug": "show-hn-vajraclaw-deterministic-1ms-execution-guardrail-for-ai-agents", "title": "Show HN: VajraClaw – Deterministic <1µs execution guardrail for AI agents", "summary": "DROS VajraClaw Hacker Edition, a free Docker governance gateway from Top-Celestial-Company Ltd, enforces deterministic sub-microsecond execution guardrails for AI agents, blocking unauthorized syscalls via constant-time AST policy lookup and providing Ed25519-signed Merkle audit chains. The tool supports up to five concurrent agents across ecosystems like Claude, Codex, and Cursor, with a free license for individuals.", "body_md": "[English](/Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker/blob/main/README.md) | [繁體中文說明](/Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker/blob/main/README_zh.md) | [🌐 Official Website](https://dr-os.io)\n\n**DROS VajraClaw Hacker Edition** is the official standalone, free Docker governance gateway designed for individual developers, AI researchers, and local developer workstations. It physicalizes execution security between autonomous AI Agents (Google Antigravity, Anthropic Claude, OpenAI Codex, Cursor, CrewAI, AutoGen, DeepSeek Harness) and your local operating system.\n\nProbabilistic security relying on Prompt Engineering, Llama-Guard, or LLM-as-a-judge inevitably fails at runtime:\n\n**Prompt Injections & Jailbreaks Bypass Text Guards**: Attackers easily obfuscate prompts to trick agents into running`rm -rf /`\n\nor leaking`.env`\n\nsecrets.**Unpredictable Latency & TOCTOU**: Calling secondary models adds 1~3s delays and fails to protect OS syscalls.** Lack of Auditability**: You cannot mathematically prove*why*an LLM wrapper allowed an action.\n\n**DROS is NOT a prompt wrapper; it is a Deterministic Runtime OS**:\nIt moves intelligence to compile-time (`demo_policy.yaml`\n\n/ `Vajra.md`\n\n) and enforces rules at runtime via constant-time **Strict Fail-Closed**)!\n\n- 🛡️\n**Protect Up to 5 Concurrent Agents**: Simultaneously govern multiple active agents across different IDEs on a single host. - 🔑\n**Native W3C**: Cryptographic agent identity binding with Ed25519 signatures.`did:key`\n\n& RFC-010 Passports - ⚡\n**Microsecond In-Band Fusing (<1μs)**: Deterministic$\\mathcal{O}(1)$ AST policy lookup that severs unauthorized syscalls before execution. - 📜\n**SHA-256 Merkle Hash-Linked Audit Chain**: Non-repudiable local execution logs with startup recovery to prevent log tampering. - 🌐\n**Universal Cross-Ecosystem Compatibility**: Native REST and MCP endpoints compatible with AGY, Claude, Codex, Cursor, LangChain, CrewAI, and DSH.\n\n| Threat Vector / Capability | Traditional LLM Guardrails | 📦 DSH Standalone TS Plugin | ⚡ DROS Hacker Docker Gateway (This Repo) | 🏢 Enterprise / Mesh Tier |\n|---|---|---|---|---|\nRuntime Vehicle |\nCloud API / External Model | In-Process JS (Zero Deps) | Local Docker Container (`:8080` ) |\nEnterprise Cluster / K8s / C-ABI |\nProtected Scope |\nSingle Chat Session | DSH Local Process | Full Ecosystem (Claude+Codex+Cursor+DSH+AGY) |\nMulti-Node Fleet / Private Cloud |\nDestructive Command Blocking |\n❌ Vulnerable | 🟢 100% Regex Failsafe\n|\n🟢 100% Deterministic AST Fusing (<1μs)\n|\n🟢 AST Bitmaps + eBPF Kernel Hooks\n|\nCredential & Secret Protection |\n❌ No Physical Guard | 🟢 Sensitive Path Block\n|\n🟢 Dynamic PII Redaction + Virtual Sandboxing\n|\n🟢 Hardware HSM + ZKP-Lite Proofs\n|\nAgent Identity Binding |\n❌ No Identity | 🟡 Session-level ID | 🟢 Native W3C\n`did:key` (Ed25519) |\n🟢 3-Tier PKI\n`DrosIdentityToken (DIT)` |\nNon-Repudiable Audit Chain |\n❌ Plain Text Logs | 🟢 Local SHA-256 Hash Chain\n|\n🟢 Ed25519 Signed Merkle Hash Chain\n|\n🟢 EU AI Act Art. 12 Court-Grade Chain\n|\nRFC-010 Passports |\n❌ Unsupported | 🟡 Format Parser | 🟢 Local Minting & Cross-Agent Verification\n|\n🟢 Cross-Organization Roaming Passports\n|\nDecision Latency |\n🔴 1,000 ~ 3,000 ms | 🟢 <1 ms (Direct Hook)\n|\n🟢 <1 ms (Loopback HTTP / C-ABI)\n|\n🟢 <500 ns (Zero-Copy Memory Lookup)\n|\nLicense |\nPay-per-Token | 100% Free (Apache-2.0) |\nFree License for Individuals |\nStartup $2,990 / Enterprise $29,990 |\n\n```\n# 1. Start DROS Hacker Gateway (No license key required out-of-the-box)\ndocker run -d -p 8080:8080 --name dros-gateway \\\n  -v $(pwd)/FreeTrial-Sandbox/demo_policy.yaml:/app/demo_policy.yaml \\\n  dros/hacker-gateway:v1.0.0\n\n# 2. Verify health status\ncurl http://localhost:8080/health\ngit clone https://github.com/Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker.git\ncd DROS-VajraClaw-Hacker\ndocker compose -f docker/docker-compose.yml up -d\n```\n\nSee [ examples/](/Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker/blob/main/examples) for working starter templates:\n\nSee [ examples/claude_mcp/](/Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker/blob/main/examples/claude_mcp):\nAdd to your\n\n`claude_desktop_config.json`\n\nor `mcp_settings.json`\n\n:\n\n```\n{\n  \"mcpServers\": {\n    \"dros-vajraclaw\": {\n      \"url\": \"http://localhost:8080/mcp\",\n      \"transport\": \"http\"\n    }\n  }\n}\n```\n\nSee [ examples/cursor_rules/](/Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker/blob/main/examples/cursor_rules):\nPlace\n\n`.cursorrules`\n\nin your project root to intercept high-risk terminal commands via `http://localhost:8080/evaluate`\n\nin <1μs before OS execution!See [ examples/openai_langchain/](/Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker/blob/main/examples/openai_langchain):\n\n``` python\nfrom integrations.vajraclaw.runtime import VajraClaw\n\nvc = VajraClaw(\"demo_policy.yaml\")\ndecision = vc.evaluate(\"execute_payment\", {\"amount\": 500})\nif not decision:\n    raise PermissionError(f\"Blocked by DROS: {decision.reason}\")\n```\n\nSee [ examples/crewai_autogen/](/Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker/blob/main/examples/crewai_autogen):\nAssign individual W3C DIDs to different agent roles (Legal, Dev, Auditor) and enforce fine-grained capability bitmaps across agent swarms.\n\nSee [ examples/dsh_plugin/](/Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker/blob/main/examples/dsh_plugin):\n\n```\ndsh plugin --profile web add dsh-plugin-vajraclaw\n```\n\n*(Set gatewayUrl to http://localhost:8080 in DSH to activate W3C DID & full Docker gateway governance)*\n\nDROS supports two straightforward formats: **Intuitive Markdown ( Vajra.md)** and\n\n**Structured YAML (**.\n\n`demo_policy.yaml`\n\n)Declare allowed capabilities and hard security boundaries in plain Markdown:\n\n```\n# 🛡️ DROS Agent Security Policy (Vajra.md)\n\n## 1. Allowed Capabilities\n- Allow reading workspace files (`file_read`)\n- Allow standard queries (`search_web`, `query_db`)\n- Allow safe terminal commands (`git status`, `npm test`, `cargo check`)\n\n## 2. Strict Fail-Closed Boundaries\n- Block all recursive deletion or wiping commands (`rm -rf`, `rmdir /s`, `format`)\n- Block access to credential paths (`.env`, `id_rsa`, `secrets.json`, `.aws/credentials`)\n- Restrict transaction amounts exceeding $1,000 threshold (`amount <= 1000`)\n```\n\nYou don't need to write policies from scratch! Copy the following universal prompt to ChatGPT, Claude, or Cursor:\n\n📋\n\nCopy this Prompt to any LLM / AI Assistant:\n\n```\nYou are a DROS deterministic security architecture expert. Based on my Agent requirements, generate a standard DROS \"Vajra.md\" security policy in Markdown.\n\nAgent Details:\n- Agent Role & Scenario: [e.g., Fullstack Developer / Customer Service / Financial Automation]\n- Allowed Tools & Operations: [e.g., Read/Write src/, Run tests, Query order database]\n- Strict Boundaries & Denials: [e.g., Block deletion of root/workspace, Block .env access, Payment limit $500]\n\nFollow the DROS \"Default Fail-Closed\" whitelist principle and structure the output into:\n1. Role & Capability Scope\n2. Allowed Capabilities (Whitelist)\n3. Security Boundary Constraints (Thresholds & Pattern Failsafes)\n```\n\nSimply mount your `Vajra.md`\n\nwhen launching the Docker gateway. Policy changes take effect in **<1 microsecond without container restarts**:\n\n```\ndocker run -d -p 8080:8080 --name dros-gateway \\\n  -v $(pwd)/Vajra.md:/app/demo_policy.yaml \\\n  dros/hacker-gateway:v1.0.0\n```\n\nThe deterministic execution governance, microsecond fusing, and cryptographic audit mechanisms in this project are referenced from and build upon the following core technical papers and verification environments:\n\n-\n**Core Architecture & Six Trust Boundaries (Core Architecture)**:** Paper**:*DROS-6P: A Unified Deterministic Runtime Governance Architecture Closing the Six Fundamental Trust Boundaries of Enterprise AI Agents***Zenodo DOI**:|`10.5281/zenodo.21833970`\n\n**Archived Record**:[zenodo.org/records/21833970](https://zenodo.org/records/21833970)\n\n-\n**Defense-in-Depth Model (4-Layer Security)**:** Paper**:*DROS 4-Layer Defense-in-Depth Architecture for Autonomous AI Workloads***Zenodo DOI**:|`10.5281/zenodo.21903475`\n\n**Archived Record**:[zenodo.org/records/21903475](https://zenodo.org/records/21903475)\n\n-\n**Runtime Attribution & C-ABI Module (Attribution Framework)**:** Paper**:*Runtime Attribution Framework: An External C-ABI and PKI-Based Zero-Trust Infrastructure for Non-Repudiable Execution Governance in Multi-Agent Systems***Zenodo DOI**:|`10.5281/zenodo.21903687`\n\n**Archived Record**:[zenodo.org/records/21903687](https://zenodo.org/records/21903687)\n\n-\n**Open Standards & Verification Sandbox**:** RFC-010 Specification**: Adheres to open Agent Identity & Attestation standard (W3C DID`did:key`\n\n& Ed25519 signature chain).**Verification Sandbox**:[DROS-VEP Lite (Reproducible Evaluation Sandbox)](https://github.com/Top-Celestial-Company-Ltd/DROS-VEP-lite)** Evaluation Metrics**: 24-hour soak benchmark results (160,611 verified requests, 26.1μs decision latency).\n\n**Strict Fail-Closed Enforcement**:- By default, any capability or syscall not explicitly declared as\n`ALLOW`\n\nin`demo_policy.yaml`\n\nis permanently blocked.\n\n- By default, any capability or syscall not explicitly declared as\n**Privilege Separation**:- The AI Agent must\n**never** possess write permissions to policy files. In production, mount policy files as Read-Only.\n\n- The AI Agent must\n**License Key Activation (Optional)**:- Out-of-the-box, the gateway runs in Community mode (supporting 2 concurrent agents). To unlock 5 concurrent agents, pass\n`-e DROS_LICENSE_KEY=\"your-key\"`\n\nor activate via DSH settings.\n\n- Out-of-the-box, the gateway runs in Community mode (supporting 2 concurrent agents). To unlock 5 concurrent agents, pass\n\n**Personal & Community Use (Free for Individuals)**:- Granted permanently for individual developers and researchers (Free License for Individuals) on up to 1 host and 5 concurrent agents. Source code and patent claims are proprietary. Unauthorized redistribution or reverse engineering is strictly prohibited.\n\n**Enterprise & Commercial Deployment**:- Enterprise implementation or use by corporate entities requires commercial licensing (Startup / Enterprise / Sovereign). Contact\n[service@dr-os.io](mailto:service@dr-os.io)or visit[https://dr-os.io](https://dr-os.io).\n\n- Enterprise implementation or use by corporate entities requires commercial licensing (Startup / Enterprise / Sovereign). Contact\n**Patent Notice**:- DROS deterministic runtime governance and in-band interception technology is protected under U.S. Provisional Patent Application (\n**U.S. PPA No. 64/111,973, Patent Pending**). All commercial and enterprise rights are reserved by Top-Celestial Company Ltd.\n\n- DROS deterministic runtime governance and in-band interception technology is protected under U.S. Provisional Patent Application (", "url": "https://wpnews.pro/news/show-hn-vajraclaw-deterministic-1ms-execution-guardrail-for-ai-agents", "canonical_source": "https://github.com/Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker", "published_at": "2026-08-31 09:08:38+00:00", "updated_at": "2026-08-31 09:23:09.307536+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-tools", "ai-infrastructure"], "entities": ["Top-Celestial-Company Ltd", "DROS VajraClaw Hacker Edition", "Google Antigravity", "Anthropic Claude", "OpenAI Codex", "Cursor", "CrewAI", "AutoGen"], "alternates": {"html": "https://wpnews.pro/news/show-hn-vajraclaw-deterministic-1ms-execution-guardrail-for-ai-agents", "markdown": "https://wpnews.pro/news/show-hn-vajraclaw-deterministic-1ms-execution-guardrail-for-ai-agents.md", "text": "https://wpnews.pro/news/show-hn-vajraclaw-deterministic-1ms-execution-guardrail-for-ai-agents.txt", "jsonld": "https://wpnews.pro/news/show-hn-vajraclaw-deterministic-1ms-execution-guardrail-for-ai-agents.jsonld"}}