First workforce run: /api/uptime + /api/version with full-stack receipts

README.md

@@ -0,0 +1,89 @@
+# The Workshop — the Frontier Infra full-stack demo
+
+**A live board whose content is the stack's own receipts.** Every card on the board is real
+work done by an AI agent workforce under the complete
+[Frontier Infra](https://frontierinfra.org) stack — and every claim on it links a
+cryptographic receipt you can verify yourself. Nothing here is asserted; everything is
+proven.
+
+```bash
+npm start          # → http://localhost:4600  (the board)
+npm test           # ground truth: 7 tests
+curl -s localhost:4600/.agent   # agents read the board directly (AVL, validates L3)
+```
+
+## What this demonstrates
+
+One repo running **every tier of the stack at once**, with the receipts to show it worked:
+
+| Tier | Project | In this repo | Receipt |
+|---|---|---|---|
+| **Govern** | [Maintainer Gate Blueprint](https://github.com/frontier-infra/Maintainer-Gate-Blueprint) | `ops/` (10 runbooks, 4 rules), stamped by the installer; prod-DB PreToolUse gate wired; CI intake checks | gate smoke: destructive-prod command → exit 2 (blocked) |
+| **Behave** | [ADL](https://github.com/frontier-infra/adl) | `CLAUDE.md` discipline layers + roles + `/goal` machinery, installed by ADL's installer | `receipts/meta-manifest.json` — the run's contract as an ADL manifest |
+| **Enforce** | [Proctor](https://github.com/frontier-infra/proctor) | Proctor's own verifier (`goal-verify`) ran the meta-contract's checks against reality and signed the proof | [`receipts/meta-manifest.proof.json`](receipts/meta-manifest.proof.json) — `signed_off: true`, 3/3 checks |
+| **Operate** | [machine-driver](https://github.com/frontier-infra/machine-driver) | The workforce: a deterministic, zero-token driver dispatched one fresh `claude -p` worker per task, verified each by `npm test`, budget-governed, propose-mode | `harness/driver-run.log` + `harness/driver-log.jsonl` (hash-chained loop audit) |
+| **Prove** | [AAR](https://github.com/frontier-infra/agentcontrolplane) | One Ed25519-signed Agent Attestation Record per verified task, signed as `did:web:frontierinfra.org` — the DID document is [published on the live domain](https://frontierinfra.org/.well-known/did.json) | [`receipts/aar-job-001.json`](receipts/aar-job-001.json) · [`receipts/aar-job-002.json`](receipts/aar-job-002.json) — verify them yourself, no local files needed |
+| **Declare** | [AVL](https://github.com/frontier-infra/avl) | The board serves `text/agent-view` companions (`/.agent`, `/agent.txt`, `/llms.txt`, content negotiation, Link header) | official validator: **conformance L3** |
+
+## The run that built this (2026-07-07)
+
+The two API endpoints on the board — `/api/uptime` and `/api/version` — were **not written
+by a human, and not written by the maintainer either**. They were built by the workforce:
+
+1. **Contract** (Box 0): `harness/goal.json` — definition of done, acceptance tests
+   (immutable), constraints, budget (8 worker runs / 30 min), autonomy ceiling 0
+   (propose-only; the dial is earned, and day one earns nothing).
+2. **Dispatch**: machine-driver spawned a fresh `claude -p` worker per task. Each worker ran
+   under this repo's ADL discipline and the machine's Proctor supervision.
+3. **Verify** (never self-graded): the driver ran `npm test` as ground truth. Worker says
+   done ≠ done; exit code 0 = done. Both tasks: `ok verified`.
+4. **Prove**: one signed AAR per task, `verdict: verified`, `ground_truth: confirmed`, with a
+   hash commitment to the verify output. Signature checks against the DID document published
+   at the org's own domain — no vendor, no central server:
+   ```bash
+   node ../agentcontrolplane/tools/aar.mjs verify harness/aar/job-001.json
+   # [✓] L0: Ed25519 signature valid ... → conformance: L2
+   ```
+5. **Meta-proof** (behave → prove): Proctor's own verifier ran the demo's meta-contract —
+   "all tests green AND both AARs verify" — and its proof was bridged to a signed AAR by
+   `harness/proof-to-aar.mjs`: [`receipts/aar-workshop-run-001.json`](receipts/aar-workshop-run-001.json).
+6. **Land**: the workforce diff (23 insertions, exactly the contracted files) was reviewed by
+   the operator and landed through the repo's own gates — branch → PR → CI → merge. Nothing
+   reaches `main` on an agent's word alone.
+
+**A defect the stack caught in its own first run:** the driver's AAR signing step failed on a
+relative key path — and instead of a silent skip, it **alerted loudly** (that's the
+fail-closed design), left the unsigned records intact, and the fix was a one-line config
+change. The receipts you see were then signed and verified. Demos that never break prove
+nothing; this one broke honestly and recovered with the audit trail to show it.
+
+## Reproduce the workforce run
+
+```bash
+# siblings expected: ../machine-driver, ../agentcontrolplane  (github.com/frontier-infra)
+node ../agentcontrolplane/tools/aar.mjs keygen --did did:web:YOURDOMAIN \
+  --out-priv secrets/demo.jwk.json --out-did receipts/did.json
+# edit harness/goal.json: your tasks, your budget, absolute aar_priv path
+python3 ../machine-driver/driver.py harness/goal.json   # the workforce runs
+node harness/collect.mjs                                # receipts → the board
+npm start
+```
+
+## Layout
+
+```
+app/server.mjs            the board (zero-dep node http) + AVL agent views
+data/jobs.json            board content — generated from receipts, never hand-written
+harness/goal.json         the workforce contract + tasks (machine-driver config)
+harness/collect.mjs       driver receipts → board data (re-verifies every AAR)
+harness/proof-to-aar.mjs  ADL/Proctor proof.json → signed AAR (behave feeds prove)
+receipts/                 served at /receipts/* — AARs, proofs, DID document
+ops/                      Maintainer Gate Blueprint (stamped)
+CLAUDE.md + .claude/      ADL discipline layers, roles, /goal + gates
+secrets/                  signing key (gitignored — rotate by republishing did.json)
+```
+
+---
+
+Part of [Frontier Infra](https://frontierinfra.org) — open, producer-owned standards for the
+agent web. MIT.

app/server.mjs

@@ -159,6 +159,10 @@ export function createApp() {
     if (path === "/api/jobs") return send(200, "application/json", JSON.stringify(jobs(), null, 2));
     if (path === "/api/health")
       return send(200, "application/json", JSON.stringify({ ok: true, uptimeSeconds: Math.floor((Date.now() - STARTED) / 1000) }));
+    if (path === "/api/version")
+      return send(200, "application/json", JSON.stringify({ version: JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8")).version }));
+    if (path === "/api/uptime")
+      return send(200, "application/json", JSON.stringify({ up: true, uptimeSeconds: Math.floor((Date.now() - STARTED) / 1000) }));
     if (path.startsWith("/receipts/")) {
       const name = normalize(path.slice("/receipts/".length));
       if (name.includes("..") || name.includes("/")) return send(400, "text/plain", "bad path");

data/jobs.json

@@ -1 +1,22 @@
-[]
+[
+  {
+    "id": "job-001",
+    "title": "GET /api/uptime",
+    "goal": "In app/server.mjs add GET /api/uptime returning JSON {up:true, uptimeSeconds:<integer seconds since server start>}, and add a node:test case in test/app.test.mjs asserting 200 and up===true. Touch only app/server.mjs and test/app.test.mjs. Run npm test before finishing.",
+    "status": "done",
+    "verdict": "verified",
+    "ground_truth": "confirmed",
+    "conformance": "AAR L2 · sig valid",
+    "aar": "aar-job-001.json"
+  },
+  {
+    "id": "job-002",
+    "title": "GET /api/version",
+    "goal": "In app/server.mjs add GET /api/version returning JSON {version} where version is read from package.json, and add a node:test case in test/app.test.mjs asserting it equals the package.json version. Touch only app/server.mjs and test/app.test.mjs. Run npm test before finishing.",
+    "status": "done",
+    "verdict": "verified",
+    "ground_truth": "confirmed",
+    "conformance": "AAR L2 · sig valid",
+    "aar": "aar-job-002.json"
+  }
+]

harness/aar/job-001.json

@@ -0,0 +1,31 @@
+{
+  "aar": "0.02",
+  "subject": "did:web:frontierinfra.org:stack-demo-worker",
+  "principal": "did:web:frontierinfra.org",
+  "task": {
+    "id": "job-001",
+    "claim": "In app/server.mjs add GET /api/uptime returning JSON {up:true, uptimeSeconds:<integer seconds since server start>}, and add a node:test case in test/app.test.mjs asserting 200 and up===true. Touch only app/server.mjs and test/app.test.mjs. Run npm test before finishing."
+  },
+  "verdict": "verified",
+  "ground_truth": "confirmed",
+  "reason": "verify_cmd exited 0 against repo HEAD",
+  "checks": [
+    {
+      "source": "/Users/sem/code/frontier-infra/stack-demo",
+      "query": "npm test",
+      "observed_at": "2026-07-07T17:16:46+00:00",
+      "response_sha256": "9d116f0be8943b0ad86a11f0bf8c493de59141835acf32b1a97781918af2590b",
+      "excerpt": " up:true\n  ---\n  duration_ms: 1.943083\n  type: 'test'\n  ...\n# Subtest: receipts path traversal is rejected\nok 6 - receipts path traversal is rejected\n  ---\n  duration_ms: 1.31275\n  type: 'test'\n  ...\n1..6\n# tests 6\n# suites 0\n# pass 6\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 88.279\n"
+    }
+  ],
+  "verifier": {
+    "id": "did:web:frontierinfra.org:machine-driver-verify",
+    "independence": "same_principal"
+  },
+  "issued": "2026-07-07T17:16:46+00:00",
+  "sig": {
+    "alg": "Ed25519",
+    "by": "did:web:frontierinfra.org",
+    "value": "PhmP2277LEW9dvqOO_xBIZuwaWWTLbGjjY66MpWKWKmMEnvBmCOXqkLqhvCtNL77QXNOnmmDcE_eOjuNPzutBw"
+  }
+}

harness/aar/job-002.json

@@ -0,0 +1,31 @@
+{
+  "aar": "0.02",
+  "subject": "did:web:frontierinfra.org:stack-demo-worker",
+  "principal": "did:web:frontierinfra.org",
+  "task": {
+    "id": "job-002",
+    "claim": "In app/server.mjs add GET /api/version returning JSON {version} where version is read from package.json, and add a node:test case in test/app.test.mjs asserting it equals the package.json version. Touch only app/server.mjs and test/app.test.mjs. Run npm test before finishing."
+  },
+  "verdict": "verified",
+  "ground_truth": "confirmed",
+  "reason": "verify_cmd exited 0 against repo HEAD",
+  "checks": [
+    {
+      "source": "/Users/sem/code/frontier-infra/stack-demo",
+      "query": "npm test",
+      "observed_at": "2026-07-07T17:18:00+00:00",
+      "response_sha256": "69e6bbc834393bb9451e2138edab9bdecc9dc1df24685bfe70260c57d8515872",
+      "excerpt": "rsion\n  ---\n  duration_ms: 1.702875\n  type: 'test'\n  ...\n# Subtest: receipts path traversal is rejected\nok 7 - receipts path traversal is rejected\n  ---\n  duration_ms: 1.17025\n  type: 'test'\n  ...\n1..7\n# tests 7\n# suites 0\n# pass 7\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 97.956625\n"
+    }
+  ],
+  "verifier": {
+    "id": "did:web:frontierinfra.org:machine-driver-verify",
+    "independence": "same_principal"
+  },
+  "issued": "2026-07-07T17:18:00+00:00",
+  "sig": {
+    "alg": "Ed25519",
+    "by": "did:web:frontierinfra.org",
+    "value": "BAhDPuHpl8_k3dPY5OeKKFz_wD5tdQyuMQWVtPBXA-DYUlSZolZpz1933ppbKhf_LcjNqBCsjoROsBHbyTQPDw"
+  }
+}

harness/collect.mjs

@@ -0,0 +1,50 @@
+// Collect the workforce receipts into the board's data: read harness/goal.json
+// task states + the driver's signed AARs, verify each AAR with the org's own
+// verifier, copy them into receipts/, and write data/jobs.json.
+import { readFileSync, writeFileSync, readdirSync, copyFileSync, existsSync, mkdirSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+const AAR_TOOL = "/Users/sem/code/frontier-infra/agentcontrolplane/tools/aar.mjs";
+const goal = JSON.parse(readFileSync(join(ROOT, "harness", "goal.json"), "utf8"));
+const aarDir = join(ROOT, "harness", "aar");
+mkdirSync(join(ROOT, "receipts"), { recursive: true });
+
+const TITLES = { "job-001": "GET /api/uptime", "job-002": "GET /api/version" };
+
+const jobs = goal.tasks.map((t) => {
+  const job = {
+    id: t.id,
+    title: TITLES[t.id] ?? t.id,
+    goal: t.goal,
+    status: t.status,
+  };
+  const aarFile = join(aarDir, `${t.id}.json`);
+  if (existsSync(aarFile)) {
+    const rec = JSON.parse(readFileSync(aarFile, "utf8"));
+    job.verdict = rec.verdict;
+    job.ground_truth = rec.ground_truth;
+    let verify = "";
+    try {
+      verify = execFileSync("node", [AAR_TOOL, "verify", aarFile], { encoding: "utf8" });
+    } catch (e) {
+      verify = String(e.stdout || e.message);
+    }
+    const level = verify.match(/conformance:\s*(L\d)/)?.[1];
+    if (/Ed25519 signature valid/.test(verify) && level) {
+      job.conformance = `AAR ${level} · sig valid`;
+    } else {
+      job.conformance = "SIGNATURE INVALID";
+    }
+    const dest = `aar-${t.id}.json`;
+    copyFileSync(aarFile, join(ROOT, "receipts", dest));
+    job.aar = dest;
+  }
+  return job;
+});
+
+writeFileSync(join(ROOT, "data", "jobs.json"), JSON.stringify(jobs, null, 2) + "\n");
+console.log(`collected ${jobs.length} jobs → data/jobs.json`);
+for (const j of jobs) console.log(`  ${j.id}: ${j.status} · ${j.ground_truth ?? "-"} · ${j.conformance ?? "no AAR"}`);

harness/driver-log.jsonl

@@ -0,0 +1,6 @@
+{"ts": "2026-07-07T17:15:54+00:00", "prev_hash": "", "event": "driver_up", "goal": "Extend The Workshop's API with two small, test-verified endpoints, built entirely by the agent workforce.", "mode": "propose", "ratified_by": "operator (Jason) via 'Go' on the full-stack demo; council ratification not run \u2014 demo stays in propose mode", "proposed_by": "claude-fable (planner, this session)", "hash": "704c08f8a67f9d39"}
+{"ts": "2026-07-07T17:15:54+00:00", "prev_hash": "704c08f8a67f9d39", "event": "dispatch", "task": "job-001", "attempt": 1, "idempotency_key": "bde115300679707b", "hash": "4c32217dcd19672f"}
+{"ts": "2026-07-07T17:16:46+00:00", "prev_hash": "4c32217dcd19672f", "event": "verified", "task": "job-001", "verify_exit": 0, "verifier_id": "npm test", "idempotency_key": "bde115300679707b", "autonomy_used": "propose", "hash": "8aa02ac3a8e3d1e4"}
+{"ts": "2026-07-07T17:16:48+00:00", "prev_hash": "8aa02ac3a8e3d1e4", "event": "dispatch", "task": "job-002", "attempt": 1, "idempotency_key": "c3cb29ea77fb5d80", "hash": "ba4965aaba8d8b4b"}
+{"ts": "2026-07-07T17:18:00+00:00", "prev_hash": "ba4965aaba8d8b4b", "event": "verified", "task": "job-002", "verify_exit": 0, "verifier_id": "npm test", "idempotency_key": "c3cb29ea77fb5d80", "autonomy_used": "propose", "hash": "d1c8eb53e58dbe19"}
+{"ts": "2026-07-07T17:18:02+00:00", "prev_hash": "d1c8eb53e58dbe19", "event": "goal_complete", "tasks": 2, "blocked": 0, "hash": "1102cd82403c7f90"}

harness/driver-run.log

@@ -0,0 +1,10 @@
+[2026-07-07T17:15:54+00:00] driver up — goal: "Extend The Workshop's API with two small, test-verified endpoints, built entirely by the agent workforce."  mode=propose (operator asked propose)
+[2026-07-07T17:15:54+00:00] -> job-001 (attempt 1): In app/server.mjs add GET /api/uptime returning JSON {up:true, uptimeSeconds:<integer seconds since server start>}, and add a node:test case in test/app.test.mjs asserting 200 and up===true. Touch only app/server.mjs and test/app.test.mjs. Run npm test before finishing.
+[2026-07-07T17:16:46+00:00]    ok  verified.
+[2026-07-07T17:16:46+00:00] ALERT: AAR sign FAILED for task job-001 (rc 1): error: ENOENT: no such file or directory, open 'secrets/stack-demo.jwk.json'
+[2026-07-07T17:16:46+00:00]    (propose mode — operator asked propose; diff left for your review)
+[2026-07-07T17:16:48+00:00] -> job-002 (attempt 1): In app/server.mjs add GET /api/version returning JSON {version} where version is read from package.json, and add a node:test case in test/app.test.mjs asserting it equals the package.json version. Touch only app/server.mjs and test/app.test.mjs. Run npm test before finishing.
+[2026-07-07T17:18:00+00:00]    ok  verified.
+[2026-07-07T17:18:00+00:00] ALERT: AAR sign FAILED for task job-002 (rc 1): error: ENOENT: no such file or directory, open 'secrets/stack-demo.jwk.json'
+[2026-07-07T17:18:00+00:00]    (propose mode — operator asked propose; diff left for your review)
+[2026-07-07T17:18:02+00:00] GOAL COMPLETE — 2 tasks, 0 blocked/surfaced.

harness/goal.json

@@ -0,0 +1,57 @@
+{
+  "goal": "Extend The Workshop's API with two small, test-verified endpoints, built entirely by the agent workforce.",
+  "contract": {
+    "definition_of_done": "GET /api/uptime returns 200 JSON {up:true, uptimeSeconds:<number>=0>}; GET /api/version returns 200 JSON {version} matching package.json. Each endpoint has a node --test case. No other route changes.",
+    "acceptance_tests": [
+      "uptime endpoint answers with up===true",
+      "version endpoint matches package.json version"
+    ],
+    "immutable": [
+      "acceptance_tests"
+    ],
+    "constraints": [
+      "touch only app/server.mjs and test/",
+      "no new dependencies"
+    ],
+    "autonomy_ceiling": 0,
+    "proposed_by": "claude-fable (planner, this session)",
+    "ratified_by": "operator (Jason) via 'Go' on the full-stack demo; council ratification not run \u2014 demo stays in propose mode"
+  },
+  "repo": "/Users/sem/code/frontier-infra/stack-demo",
+  "mode": "propose",
+  "worker_cmd": "claude -p \"{task}\" --permission-mode acceptEdits",
+  "verify_cmd": "npm test",
+  "aar_tool": "/Users/sem/code/frontier-infra/agentcontrolplane/tools/aar.mjs",
+  "aar_priv": "/Users/sem/code/frontier-infra/stack-demo/secrets/stack-demo.jwk.json",
+  "subject": "did:web:frontierinfra.org:stack-demo-worker",
+  "principal": "did:web:frontierinfra.org",
+  "verifier": "did:web:frontierinfra.org:machine-driver-verify",
+  "max_attempts": 3,
+  "tick_seconds": 2,
+  "budget": {
+    "max_worker_runs": 8,
+    "max_wall_seconds": 1800
+  },
+  "tasks": [
+    {
+      "id": "job-001",
+      "goal": "In app/server.mjs add GET /api/uptime returning JSON {up:true, uptimeSeconds:<integer seconds since server start>}, and add a node:test case in test/app.test.mjs asserting 200 and up===true. Touch only app/server.mjs and test/app.test.mjs. Run npm test before finishing.",
+      "status": "done",
+      "attempts": 1,
+      "started": "2026-07-07T17:15:54+00:00",
+      "verify_tail": "e agent view\n  ---\n  duration_ms: 1.997917\n  type: 'test'\n  ...\n# Subtest: health and jobs endpoints answer JSON\nok 4 - health and jobs endpoints answer JSON\n  ---\n  duration_ms: 3.379708\n  type: 'test'\n  ...\n# Subtest: uptime endpoint answers 200 with up:true\nok 5 - uptime endpoint answers 200 with up:true\n  ---\n  duration_ms: 1.943083\n  type: 'test'\n  ...\n# Subtest: receipts path traversal is rejected\nok 6 - receipts path traversal is rejected\n  ---\n  duration_ms: 1.31275\n  type: 'test'\n  ...\n1..6\n# tests 6\n# suites 0\n# pass 6\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 88.279\n",
+      "done": "2026-07-07T17:16:46+00:00"
+    },
+    {
+      "id": "job-002",
+      "goal": "In app/server.mjs add GET /api/version returning JSON {version} where version is read from package.json, and add a node:test case in test/app.test.mjs asserting it equals the package.json version. Touch only app/server.mjs and test/app.test.mjs. Run npm test before finishing.",
+      "status": "done",
+      "attempts": 1,
+      "started": "2026-07-07T17:16:48+00:00",
+      "verify_tail": "on_ms: 3.544416\n  type: 'test'\n  ...\n# Subtest: uptime endpoint answers 200 with up:true\nok 5 - uptime endpoint answers 200 with up:true\n  ---\n  duration_ms: 2.240208\n  type: 'test'\n  ...\n# Subtest: version endpoint returns the package.json version\nok 6 - version endpoint returns the package.json version\n  ---\n  duration_ms: 1.702875\n  type: 'test'\n  ...\n# Subtest: receipts path traversal is rejected\nok 7 - receipts path traversal is rejected\n  ---\n  duration_ms: 1.17025\n  type: 'test'\n  ...\n1..7\n# tests 7\n# suites 0\n# pass 7\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 97.956625\n",
+      "done": "2026-07-07T17:18:00+00:00"
+    }
+  ],
+  "runs": 2,
+  "last_success_at": "2026-07-07T17:18:00+00:00"
+}