quarry-vetd

Documentation

Overview

Command quarry-vetd is the off-Cloudflare vetting worker. It runs on a sandboxed microVM pool (Fly = Firecracker microVMs) and is the ONE place System B executes an attacker-controlled reproducer: Cloudflare Workers can't run native code, so the commons Worker dispatches vet jobs here via Queues.

It reuses the client packages verbatim — oracle, runner, verify — so the re-verification is byte-identical to the client's: the reproducer runs air-gapped and the deterministic oracle disposes. The enclosing Firecracker microVM (+ --network none, caps, wall-clock) is the isolation boundary; treat this as running live exploits on your infra, because it is.