D2 · Vultr Agent Rush — Proposal Delineation
Grouped preview — all six proposals
B · Quarantine Browser Clerk C1·BADVISORY #1
Browser agent confined to a quarantine sandbox visits hostile, untrusted sites and extracts clerical data. Nothing it touches leaves containment; every fetch is logged.
A · Canary Patch Gauntlet C1·AADVISORY #2
Sandboxed agent repairs broken code while adversarial probes attack every patch. Only fixes that survive the full test barrage ship, with test logs as receipts.
C · Dependency Detox Chamber C1·AADVISORY #3
Upgrades project dependencies inside an isolated chamber, scanning every new package version for compromise before it can enter the codebase. Blocked packages stay out.
E · Three-Way Match Room C2ADVISORY #4
Matches every purchase order against its invoice and goods receipt, line by line. Only exact three-way matches pass; every mismatch is flagged with the conflicting lines.
F · Renewal Risk Desk C2ADVISORY #5
Tracks every contract renewal date, scores each renewal for price, usage, and lock-in risk, and prepares a negotiation brief before the deadline forces a signature.
D · Pipeline Rescue Desk C2ADVISORY #6
Watches the CRM pipeline for stalled and at-risk deals, diagnoses why each one stalled, and drafts a rescue action for a salesperson to approve. No outreach sends itself.
Delineation — pick a proposal
B · Quarantine Browser Clerk C1·B
What it is
A browser agent that does real web tasks on semi-trusted sites from a disposable Playwright profile: domain allowlists, quarantined downloads, and an action receipt for everything it does. The website is treated as hostile input — the only candidate on the slate built on that premise.
Core loop: task in → fresh disposable profile → allowlisted browsing with per-fetch logging → downloads held in quarantine → extracted data + receipt out → profile destroyed.
Signature moment: a fake re-login / verifier-download page (lookalike domain + executable) is blocked, and the task still completes in a fresh profile.
How it competes
Screen: PASS as-if-competed — C1 requirements are designed-in: Vultr VM backend, Serverless Inference for agent LLM calls, isolated sandbox, and a containment moment for the video. The brief’s own Pattern B prescribes vision-verify → human approval before final actions, and B is built around exactly that step.
Historic-pattern fit: across 11 placed projects at comparable Vultr events, proof-grounded output and enterprise workflow each appear in 10/11; formal approval gates test weak but recur as human-in-the-loop — B’s prescribed approval step matches where judging is heading.
Differentiation (Recon 🏅 depth): strongest of the C1 trio — a lookalike-domain page socially-engineering the agent itself is an unoccupied angle; market analogues (Anchor Browser, Skyvern, Browserbase) are infrastructure, not that angle. One direct in-field competitor exists (“Vex”, disposable browser sandboxes + evidence), which narrows the moat to the hostile-page/policy angle. Cleanest name on the slate.
Build effort / risk
Tiers: T1 core loop ≤ Nov 4 · T2 signature moment ≤ Nov 5 · T3 polish ≤ Nov 6 · landing Nov 7 · wall Nov 8 15:00 PT.
Main risk: browser flakiness — a flaky live demo can zero the Presentation axis on the day; the hostile fixture site must also be self-built, adding build surface. Mitigation of record: staged sites + recorded fallback (the mitigation itself reads as reliability discipline).
Kill-criterion: signature moment not demonstrable by Nov 5 EOD ⇒ descope to the T1 loop + a recorded containment artifact.
Vultr-credit fit
All figures are envelopes (ceilings), not estimates — usage is unknowable until the picked target is pre-specced. App VM at plans-API rates: vhp-2c-4gb-amd $0.033/h (≈$4.22/window) or 4c-8gb $0.066/h (≈$8.45/window); throwaway VM-per-task sandboxes ≈$0.01–0.05 per run, destroyed after. Vision/screenshot tokens are the heaviest inference draw of the slate (baseline envelope ≈$40–50 total; screenshot cadence capped, DOM-first state).
Wager model: the $200 credit is an expiring stake (expires ≈Dec 3) against a fixed prize — spend only where it buys win probability, and reserve demo-uptime through judging first (≈25 days ≈ $19.80 at 2c-4gb / $39.60 at 4c-8gb): a dead demo during judging is a probability cliff.
Prize fit
Fixed pool $14,000; 1st = $5,000 cash + $3,000 credits. Against the criteria (advisory axis scores /10): Technology 9 — real browser execution under containment, the brief’s “executes safely = product” test. Presentation 8 — visceral block moment, taxed only by flakiness risk. Business Value 8 — safe automation of untrusted-web work. Originality 10 — highest on the slate; the agent-as-target angle is unoccupied.
Basis: differentiation survives the Recon 🏅 depth-check best of the slate; originality + field room carry the raw score lead (46).
A · Canary Patch Gauntlet C1·A
What it is
An agent that repairs broken code inside disposable sandboxes while planted adversarial probes attack every patch — edge cases, regressions, hostile inputs. A fix counts only when it survives the full test barrage; the surviving test log, not the agent’s claim, is the proof, issued as a pass/fail evidence receipt.
Core loop: broken code in → agent patches in-sandbox → test suite + attack probes run → surviving fix ships with a signed receipt → sandbox destroyed.
Signature moment: a probe tries to exfiltrate a canary secret → egress denied, process killed, sandbox destroyed, and a clean rerun completes with a signed receipt.
How it competes
Screen: PASS as-if-competed — C1 requirements designed-in (VM backend, Serverless Inference, isolated sandbox, containment moment in video). Containment is the product itself, and the receipt pattern is fleet-native (evidence envelopes, repo-owned receipt ledgers), so the proof layer is inherited pre-built rather than invented in-window.
Historic-pattern fit: strongest on the slate alongside E — adversarial proof artifacts map directly onto the proof-grounded leg (10/11 placed projects at comparable events).
Differentiation (Recon 🏅 depth): WEAK-PARTIAL, stated honestly — near-clones shipped Oct 2026 (harness-gauntlet, canaryhook, Argus, GuardianX — sandbox patch + adversarial arena + canary tokens + hash-chained ledger — and GitHub Agentic Autofix GA), and A sits on the sponsor’s own Pattern-A example frame; “Gauntlet” is crowded in-space. The execution/proof-depth case is unchanged; the originality case is weakened. Field evidence agrees: the first 3 event submissions were all generic C1 runtimes, and prove-it/witness-style entries are already in the field — A’s separation is adversarial survival, not claim-proof.
Build effort / risk
Tiers: T1 core loop ≤ Nov 4 · T2 signature moment ≤ Nov 5 · T3 polish ≤ Nov 6 · landing Nov 7 · wall Nov 8 15:00 PT.
Main risk: harness scope — pin one language/ecosystem or the gauntlet sprawls; the comparison bar is also highest here precisely because the frame is central to the sponsor’s narrative.
Kill-criterion: signature moment not demonstrable by Nov 5 EOD ⇒ descope to the T1 loop + a recorded containment artifact.
Vultr-credit fit
Envelopes, not estimates. App VM: $0.033/h (2c-4gb, ≈$4.22/window) or $0.066/h (4c-8gb, ≈$8.45/window) at plans-API rates; VM-per-task sandboxes ≈$0.01–0.05/run, destroyed after. Inference is the heavy leg (patch/retry loops; retry cap ≤3/task in the pre-spec) — baseline envelope ≈$35–45 total.
Wager model: expiring stake (≈Dec 3) vs fixed prize; reserve demo-uptime through judging first (≈$19.80 @2c-4gb / $39.60 @4c-8gb for ≈25 days) — marginal spend must argue marginal win probability, not volume.
Prize fit
Fixed pool $14,000; 1st = $5,000 cash + $3,000 credits. Axis scores /10: Technology 9 — enforceable, re-runnable containment. Presentation 9 — the kill-and-rerun moment is the most legible demo on the slate. Business Value 8 — safe code-agent adoption is the sponsor’s core narrative. Originality 8 as scored, taxed by the Oct-2026 near-clones above.
Basis: near-top scores with the most enforceable, re-runnable containment moment — demoted from #1 only on the depth-check’s near-clone findings (revised raw 45).
C · Dependency Detox Chamber C1·A
What it is
Dependency upgrades processed inside an isolated chamber: every new package version is resolved, installed, and scanned in-chamber first, because install scripts are untrusted code. Flagged packages stop at the door with a scan report attached; only verified-clean upgrades reach the codebase — as a proven migration patch, not a bare version bump — with a toxic-version ledger kept of everything blocked.
Core loop: upgrade proposed → install in isolation under registry-only egress → scan + behavior check → clean version exits as a migration patch; toxic version is killed and ledgered.
Signature moment: a postinstall script writes outside the workspace and calls a non-registry host → killed, the version is marked toxic in the ledger, and the upgrade completes safely on a clean version.
How it competes
Screen: PASS as-if-competed — C1 requirements designed-in (VM backend, Serverless Inference, isolated sandbox, containment moment in video). Its containment is an egress allowlist: enforceable and binary-provable, not theatre.
Historic-pattern fit: proof-grounded leg strong (scan reports + toxic ledger are verifiable artifacts, and the receipt-ledger pattern is fleet-native); enterprise-workflow leg moderate (a utility, not a multi-party workflow).
Differentiation (Recon 🏅 depth): PARTIAL — SafeDep (pre-install sandboxing of install scripts) and Socket (install-script exfil flags) are adjacent, so the delta narrows to two things: registry-only egress as demonstrated containment, and output = a proven migration patch rather than a bump PR or a block verdict. Field OSINT found no supply-chain signal in the sampled field, so in-event room is real (“Detox” itself is a generic phrase and an existing JS testing framework’s name — noted, not blocking).
Build effort / risk
Tiers: T1 core loop ≤ Nov 4 · T2 signature moment ≤ Nov 5 · T3 polish ≤ Nov 6 · landing Nov 7 · wall Nov 8 15:00 PT.
Main risk: ecosystem edge cases — pin npm XOR pip; the “utility” read also makes the Presentation axis weaker than A’s arena (counter: the toxic-version ledger is a screenshot-able artifact judges grasp in seconds).
Kill-criterion: signature moment not demonstrable by Nov 5 EOD ⇒ descope to the T1 loop + a recorded containment artifact.
Vultr-credit fit
Envelopes, not estimates. App VM: $0.033/h (2c-4gb, ≈$4.22/window) or $0.066/h (4c-8gb, ≈$8.45/window) at plans-API rates; chamber runs as throwaway VM-per-task sandboxes ≈$0.01–0.05/run, destroyed after; inference lighter than A (fewer retry loops) — baseline envelope ≈$30–40 total.
Wager model: expiring stake (≈Dec 3) vs fixed prize; reserve demo-uptime through judging first (≈$19.80 @2c-4gb / $39.60 @4c-8gb for ≈25 days); registry-only egress also caps accidental burn paths.
Prize fit
Fixed pool $14,000; 1st = $5,000 cash + $3,000 credits. Axis scores /10: Technology 8 — egress enforcement is real, provable tech. Presentation 7 — the weakest axis; the ledger artifact carries it. Business Value 9 — supply-chain compromise via version bumps is a universal, current pain. Originality 7 — mechanism distinct, neighborhood occupied.
Basis: enforceable containment + self-evident business value + genuine in-event room; taxed on presentation legibility (revised raw 45 after the OSINT room bump).
E · Three-Way Match Room C2
What it is
An accounts-payable agent that matches every purchase order against its invoice and goods receipt, line by line. Exact three-way matches pass untouched; only exceptions route to a human, each flagged with the exact conflicting fields, and the close produces an audit-ready packet. Staff work discrepancies instead of re-checking the clean majority.
Core loop: PO + invoice + receipt in → deterministic line-by-line match → clean matches pass → exceptions routed with agent-proposed resolution → controller approval → audit-ready close packet.
Signature moment: a duplicate, price-variance invoice is traced to an amended PO → credit-memo task + approval packet produced in one pass.
How it competes
Screen: PASS as-if-competed — C2 requirements met (Vultr VM backend + web app; inference optional, used for extraction). Deterministic matching core gives it the highest demo reliability on the slate: rules, not model luck.
Historic-pattern fit: strongest on the slate alongside A — the audit pack plus controller approval is the slate’s most explicit gate, mapping onto both the proof-grounded leg and the enterprise-workflow leg (each 10/11 at comparable events).
Differentiation (Recon 🏅 depth): WEAK, stated honestly — the feature set is the category definition: Coupa, Medius, Tipalti, Stampli, Basware, SAP Concur, and Vic.ai all ship three-way match + exceptions + approval + audit. Differentiation must ride audit-pack quality and the agent-proposed resolution, never the match itself. In-event room is nonetheless real: the field skews C1, and exactly one adjacent C2 signal (ledgerpilot, procurement reconciliation) was found.
Build effort / risk
Tiers: T1 core loop ≤ Nov 4 · T2 signature moment ≤ Nov 5 · T3 polish ≤ Nov 6 · landing Nov 7 · wall Nov 8 15:00 PT.
Main risk: data-model weight (synthetic documents must stay structured), and the least “agentic” feel on the slate — the agent-proposed-resolution leg must stay visible or the Application of Technology axis sags. Buildability is the slate’s best (9/10).
Kill-criterion: signature moment not demonstrable by Nov 5 EOD ⇒ descope to the T1 loop + a recorded approval artifact.
Vultr-credit fit
Envelopes, not estimates. App VM: $0.033/h (2c-4gb, ≈$4.22/window) or $0.066/h (4c-8gb, ≈$8.45/window) at plans-API rates; no sandbox fleet needed (deterministic core is free); inference is extraction-only — baseline envelope ≈$18–25 total, the lightest C2-adjacent burn profile after D.
Wager model: expiring stake (≈Dec 3) vs fixed prize; reserve demo-uptime through judging first (≈$19.80 @2c-4gb / $39.60 @4c-8gb for ≈25 days) — E’s low burn leaves the most stake unexposed of any candidate.
Prize fit
Fixed pool $14,000; 1st = $5,000 cash + $3,000 credits. Axis scores /10: Technology 7 — sound but category-standard machinery; the agent-resolution leg carries this axis. Presentation 8 — exception queue + conflicting lines demo cleanly and reliably. Business Value 9 — AP loses hours and money to almost-matches. Originality 6 — precision naming (“three-way match” is the AP term of art) over cleverness.
Basis: reliability + thinned C2 field lift its revised raw score to 46, tied near the top — held at #4 because differentiation is category-standard and must be earned in the audit pack.
F · Renewal Risk Desk C2
What it is
A procurement agent that watches every contract renewal clock: vendor intake, contract/renewal metadata extraction, risk scoring on price, usage, and lock-in, and a negotiation brief prepared while switching or walking away is still possible — because the worst renewal is the unseen one that auto-renews a price increase on a tool the org has outgrown.
Core loop: contracts in → renewal dates + clauses extracted → risk-tiered scoring → approvals routed by tier → negotiation brief delivered ahead of the deadline.
Signature moment: a renewal is blocked 45 days early — an uplift clause plus a missing SOC 2 surfaced as a single hard gate.
How it competes
Screen: PASS as-if-competed — C2 requirements met (Vultr VM backend + web app; inference optional, used for extraction and briefs). Breadth is real: intake → renewal lifecycle is a multi-party workflow, and “money saved 45 days early” is the cleanest single-number business story on the slate.
Historic-pattern fit: enterprise-workflow leg strong (10/11 at comparable events); proof-grounded leg moderate (extraction + briefs, thinner artifacts than A/E); approval routing is on-brief for the human-in-loop direction.
Differentiation (Recon 🏅 depth): WEAK-PARTIAL — Clausefire already extracts renewal dates/price changes into a “Renewal Action Packet”, BRM’s Renewal Wrangler + Compliance Crawler finds SOC 2, and Zip/Tropic/Spendflo/Vertice crowd procurement. The sole delta is the hard BLOCK at 45 days on uplift-clause or missing-SOC-2 as a single gate. Naming is the worst on the slate: Clausefire sells a tier literally named “Renewal Desk”, a shipped app is named “RenewalDesk”, and a competitor homepage demo uses “Renewal risk desk” verbatim ⇒ rename mandatory if picked (alts stand ready: Contract Renewal Radar / Renewal Exposure Room).
Build effort / risk
Tiers: T1 core loop ≤ Nov 4 · T2 signature moment ≤ Nov 5 · T3 polish ≤ Nov 6 · landing Nov 7 · wall Nov 8 15:00 PT.
Main risk: scope balloon (legal/security surface), and the demo moment is a dashboard flag — the least visceral on the slate — so the blocked-renewal approval view must be staged as an event, not a status.
Kill-criterion: signature moment not demonstrable by Nov 5 EOD ⇒ descope to the T1 loop + a recorded approval artifact.
Vultr-credit fit
Envelopes, not estimates. App VM: $0.033/h (2c-4gb, ≈$4.22/window) or $0.066/h (4c-8gb, ≈$8.45/window) at plans-API rates; inference = extraction + brief generation — baseline envelope ≈$18–25 total.
Wager model: expiring stake (≈Dec 3) vs fixed prize; reserve demo-uptime through judging first (≈$19.80 @2c-4gb / $39.60 @4c-8gb for ≈25 days) outranks any discretionary burn.
Prize fit
Fixed pool $14,000; 1st = $5,000 cash + $3,000 credits. Axis scores /10: Technology 7 — extraction + tiered routing, standard shapes. Presentation 6 — the slate’s weakest demo surface. Business Value 9 — the 45-days-early number lands instantly. Originality 6 — the single-gate block is the only claim, and the name must change.
Basis: clean business story and real C2 room (revised raw 42), held back by the weakest presentation surface and a mandatory rename.
D · Pipeline Rescue Desk C2
What it is
A sales-ops agent that watches the CRM pipeline for deals stalling quietly — no reply in 19 days, champion gone silent, next step never set. It diagnoses why each deal stalled, attaches the activity evidence, and drafts a specific rescue move (re-engagement, exec check-in, revised close plan) for a salesperson to approve or edit. No outreach sends itself.
Core loop: stall detection → account brief → rescue draft → human approval → CRM update + follow-up → audit timeline.
Signature moment: a stalled deal is diagnosed from its activity evidence and a rescue draft is approved and written back to the CRM in one closed loop.
How it competes
Screen: PASS as-if-competed — C2 requirements met (Vultr VM backend + web app; inference optional). Approval + state machine + audit timeline is production-style work, which is C2’s stated ask, and its approval routing is on-brief.
Historic-pattern fit: the comparable-events Vultr track was won by a production-shaped enterprise workflow with a human in the loop (Milan AI Agent Olympics: Deals Machine, sales tooling) — the shape fits; the enterprise-workflow leg is 10/11 across placed projects.
Differentiation (Recon 🏅 depth): detection is WEAK — Gong flags stalled deals, Clari does pipeline health, Avoma does stalled deals + CRM auto-update, Outreach/Salesloft crowd the rest. The moat is the closed loop only: approve → CRM write. “Pipeline Rescue” as a phrase is generic-severe (a “Pipeline Rescue Sprint” and a “Pipeline Rescue Engine” already exist in the wild), and C2 sales-ops is the most obvious enterprise pick, hence the most crowded sub-track.
Build effort / risk
Tiers: T1 core loop ≤ Nov 4 · T2 signature moment ≤ Nov 5 · T3 polish ≤ Nov 6 · landing Nov 7 · wall Nov 8 15:00 PT.
Main risk: CRM-clone gravity — the build drifts into re-skinning a CRM instead of the rescue loop; seeded-data work costs time, not credits. The rescue-queue framing is the only moat and must stay the whole product.
Kill-criterion: signature moment not demonstrable by Nov 5 EOD ⇒ descope to the T1 loop + a recorded approval artifact.
Vultr-credit fit
Envelopes, not estimates. App VM: $0.033/h (2c-4gb, ≈$4.22/window) or $0.066/h (4c-8gb, ≈$8.45/window) at plans-API rates; inference is the lightest on the slate (briefs/drafts only) — baseline envelope ≈$15–20 total.
Wager model: expiring stake (≈Dec 3) vs fixed prize; reserve demo-uptime through judging first (≈$19.80 @2c-4gb / $39.60 @4c-8gb for ≈25 days) — D’s cheapness is not itself a virtue under the wager model; only marginal win probability counts.
Prize fit
Fixed pool $14,000; 1st = $5,000 cash + $3,000 credits. Axis scores /10: Technology 7 — competent state-machine work, no distinctive tech claim. Presentation 7 — rescue queue demos understandably. Business Value 9 — stalled-deal dollars land fast with judges. Originality 5 — the slate’s lowest; the category got here first.
Basis: thinnest moat (the approve→write loop alone) in the most crowded sub-track; revised raw 42 with originality at the slate floor.