We run an AI company on BrainOutput itself, every day. These are the numbers that fall out of that work — with the exact command or drill that reproduces each one. A number we cannot reproduce is worse than no number, so we publish none.
Crash recovery is not a checkpoint slideshow — we send SIGKILL to a live server while a task is running, boot a fresh one against the same state, and verify the outcome.
On boot, executions stranded as "running" are reconciled to failed (process restarted), missions become re-launchable, tasks return to the queue with their history intact, and queued work auto-resumes with a bounded recovery budget — two attempts, then it pauses instead of crash-looping. Re-launched missions reconcile by identity: finished subtasks never re-execute, interrupted ones resume under their original record. A clean boot is byte-identical to no recovery at all.
Work is reviewed against evidence, not summaries. The reviewer is fed the real diff with exact elision counts, fails honestly when evidence is truncated, and degrades to reviewer-unavailable — never a rubber-stamp verdict — when the reviewing model is down. Transient provider failures (5xx, 429, timeouts) get one bounded retry with deterministic backoff; permanent ones block the task with the real provider error instead of killing work silently.
The open-source Community runtime carries 767 passing tests (2 skipped, 0 failing) and the managed Cloud layer adds 156 more (0 failing). Re-run any time; the counts only move when the code does.
Our security evidence comes from adversarial test suites that attack the real tenant-isolation, secret-delivery and share-token code — committed next to the code they attack and re-run on every change. The suites below were re-run for this page on 2026-08-06; the drills restate on demand.
21 attacks against the real provider, front-door and token code: 16 isolation attacks (shell-injection through secret-delivery paths, tenant-name collisions that could merge two customers onto one network boundary, cross-tenant token replay, metacharacter file modes) plus 5 share-token forgery attacks. All defended, all reproducible — the suites run against the shipped code with an injected exec, no mocks of the logic under test.
A committed drill script provisions two throwaway tenants on the live host through the real provisioning path: one with egress open, one with external egress blocked and a single allowlisted /32. The blocked tenant cannot reach the internet, still reaches its allowlist, still resolves DNS through the host, still reaches host-published services — and the firewall chain is restored rule-for-rule afterwards. The drill caught a real bug before it shipped: a DROP rule shadowing the entire allowlist, which the unit tests had missed because they asserted rule presence, not order.
A complete mission executed end-to-end inside a real 512 MB / 0.5 vCPU trial container — the same constraints as the 7-day trial workspace on this site: the planner decomposed the request, an iterative coding run on a free model (bundled runtime, loopback model gateway) produced a real 2,811-character landing page, and the evidence-fed reviewer accepted it against the mission's criteria — verdict recorded with the run: "Both acceptance criteria are fully satisfied by the delivered index.html file." No demo harness, no bigger machine, no paid model.
Sources: execution state log and security evidence packs in
brainoutput-hq (execution/STATE.md, security/BRAA-8_HOSTILE_TENANT_EVIDENCE_PACK.md,
security/evidence/), committed test
suites in brainoutput-community
and the managed-service repo.
Test figures verified 2026-08-06 by re-running the suites named above; the live
egress drill last ran 7/7 on 2026-07-25 (recorded in the evidence pack).
The runtime is open source (Apache-2.0), and a 7-day evaluation runs the full hosted product — no card. Reproduce anything on this page yourself.
Evaluate for 7 days — no card Inspect the code