The Workshop — the Frontier Infra full-stack demo

A live board whose content is the stack's own receipts. Every card on the board is real work done by an AI agent workforce under the complete Frontier Infra stack — and every claim on it links a cryptographic receipt you can verify yourself. Nothing here is asserted; everything is proven.

npm start          # → http://localhost:4600  (the board)
npm test           # ground truth: 7 tests
curl -s localhost:4600/.agent   # agents read the board directly (AVL, validates L3)

What this demonstrates

One repo running every tier of the stack at once, with the receipts to show it worked:

Tier	Project	In this repo	Receipt
Govern	Maintainer Gate Blueprint	ops/ (10 runbooks, 4 rules), stamped by the installer; prod-DB PreToolUse gate wired; CI intake checks	gate smoke: destructive-prod command → exit 2 (blocked)
Behave	ADL	CLAUDE.md discipline layers + roles + /goal machinery, installed by ADL's installer	receipts/meta-manifest.json — the run's contract as an ADL manifest
Enforce	Proctor	Proctor's own verifier (goal-verify) ran the meta-contract's checks against reality and signed the proof	receipts/meta-manifest.proof.json — signed_off: true, 3/3 checks
Operate	machine-driver	The workforce: a deterministic, zero-token driver dispatched one fresh claude -p worker per task, verified each by npm test, budget-governed, propose-mode	harness/driver-run.log + harness/driver-log.jsonl (hash-chained loop audit)
Prove	AAR	One Ed25519-signed Agent Attestation Record per verified task, signed as did:web:frontierinfra.org — the DID document is published on the live domain	receipts/aar-job-001.json · receipts/aar-job-002.json — verify them yourself, no local files needed
Declare	AVL	The board serves text/agent-view companions (/.agent, /agent.txt, /llms.txt, content negotiation, Link header)	official validator: conformance L3

The run that built this (2026-07-07)

The two API endpoints on the board — /api/uptime and /api/version — were not written by a human, and not written by the maintainer either. They were built by the workforce:

1. Contract (Box 0): harness/goal.json — definition of done, acceptance tests (immutable), constraints, budget (8 worker runs / 30 min), autonomy ceiling 0 (propose-only; the dial is earned, and day one earns nothing).
2. Dispatch: machine-driver spawned a fresh claude -p worker per task. Each worker ran under this repo's ADL discipline and the machine's Proctor supervision.
3. Verify (never self-graded): the driver ran npm test as ground truth. Worker says done ≠ done; exit code 0 = done. Both tasks: ok verified.
4. Prove: one signed AAR per task, verdict: verified, ground_truth: confirmed, with a hash commitment to the verify output. Signature checks against the DID document published at the org's own domain — no vendor, no central server:

   node ../agentcontrolplane/tools/aar.mjs verify harness/aar/job-001.json
   # [✓] L0: Ed25519 signature valid ... → conformance: L2

5. Meta-proof (behave → prove): Proctor's own verifier ran the demo's meta-contract — "all tests green AND both AARs verify" — and its proof was bridged to a signed AAR by harness/proof-to-aar.mjs: receipts/aar-workshop-run-001.json.
6. Land: the workforce diff (23 insertions, exactly the contracted files) was reviewed by the operator and landed through the repo's own gates — branch → PR → CI → merge. Nothing reaches main on an agent's word alone.

A defect the stack caught in its own first run: the driver's AAR signing step failed on a relative key path — and instead of a silent skip, it alerted loudly (that's the fail-closed design), left the unsigned records intact, and the fix was a one-line config change. The receipts you see were then signed and verified. Demos that never break prove nothing; this one broke honestly and recovered with the audit trail to show it.

Reproduce the workforce run

# siblings expected: ../machine-driver, ../agentcontrolplane  (github.com/frontier-infra)
node ../agentcontrolplane/tools/aar.mjs keygen --did did:web:YOURDOMAIN \
  --out-priv secrets/demo.jwk.json --out-did receipts/did.json
# edit harness/goal.json: your tasks, your budget, absolute aar_priv path
python3 ../machine-driver/driver.py harness/goal.json   # the workforce runs
node harness/collect.mjs                                # receipts → the board
npm start

Layout

app/server.mjs            the board (zero-dep node http) + AVL agent views
data/jobs.json            board content — generated from receipts, never hand-written
harness/goal.json         the workforce contract + tasks (machine-driver config)
harness/collect.mjs       driver receipts → board data (re-verifies every AAR)
harness/proof-to-aar.mjs  ADL/Proctor proof.json → signed AAR (behave feeds prove)
receipts/                 served at /receipts/* — AARs, proofs, DID document
ops/                      Maintainer Gate Blueprint (stamped)
CLAUDE.md + .claude/      ADL discipline layers, roles, /goal + gates
(signing key lives outside the repo: ~/.config/frontier-infra/keys/ — rotate by republishing did.json)

---

Part of Frontier Infra — open, producer-owned standards for the agent web. MIT.