I think isolation itself is the harder problem, as you don't want to have the untrusted code interface with your primary OS, nor the computer owner tamper with

I think isolation itself is the harder problem, as you don't want to have the untrusted code interface with your primary OS, nor the computer owner tamper with the isolated environment. > I guess you can just run it on enough machines that you hope they're not collaborating? Right validation through numbers. Still susceptible to a 51% attack, if I recall correctly what Sybil attacks are about. This type of proof of work gives you a way to find collusion post fact. For example if your last commit on a PR (which triggers a decentralized CI), is the same commit on which you base you distribution build (assuming reproducible builds, same output), that's run on your fully trusted system, you would find out if jobs were faked.