Features
- Docker sandbox — Full container isolation for all statistical code execution
- Fail-closed execution — If Docker is unavailable, verification is blocked rather than falling back to in-process execution
- Pre-execution security validation — AST-based code analysis before Docker execution
- Live Docker health checks — The executor verifies Docker availability on each request, not just at startup
Prerequisites
The Stats Engine requires a running Docker daemon. Without Docker, all statistical verification requests return HTTP 503. See the deployment guide for setup instructions.Usage
Execution model
All generated statistical code is executed inside a Docker container with enforced memory and CPU limits. The engine does not fall back to in-process execution under any circumstances.Error handling
When the Stats Engine encounters an internal failure — such as a code generation or translation error — it returns a generic"Internal verification error" message. Sensitive details like file paths, credentials, or stack traces are never included in the API response.
If you receive this error, check the server-side logs for diagnostic details. The engine logs the exception type for debugging while keeping the client response opaque.
Direct operations
For simple operations, bypass code generation:Fail-closed validation
compute_statistics returns SUCCESS only when the result is clearly defined and safely verifiable. It returns ERROR in the following cases:
Empty series and all-NaN columns are caught by the NaN result check — if the underlying pandas operation returns
NaN, the method returns an ERROR status rather than propagating the undefined value.