Static AST checks applied to every user-authored algorithm source file.
Agent-authored algorithms are executed in-process, so this module is the only thing standing between a generated source file and the interpreter. Two rules follow from that.
Imports are an allowlist, not a denylist. A denylist has to enumerate every route to the filesystem and the network, and it always misses one: importlib reaches anything __import__ does, pathlib writes files without open, and blocking attributes by literal name is defeated by getattr. An allowlist inverts the burden -- an import is refused unless it is known to be needed for writing an estimator.
Validation runs on every execution, not once at creation. Checking only at create time protects nothing if a file can reach the algorithms directory by another route: whatever lands there is executed unvalidated at the next server start. load_all therefore re-runs these checks before importing anything.
This is a static check on source, not a sandbox. It raises the cost of getting code to run; it does not make execution safe. Running untrusted algorithms in a subprocess with resource limits is the real fix, and this is the interim.