ProofGate Frontier

You don’t approve the agent. You author its next tool.

The agent starts with no deploy tool. Your exact decision creates one—once.

ProofGate Frontier is a WebMCP-native decision lab for release owners under incident pressure. An agent explores a strict parameterized change space and submits several recovery options. Common evidence eliminates unsafe plans and strictly worse copies. A person then refuses an unacceptable cost and owns one remaining consequence. Only that exact decision materializes as a semantic, zero-argument, one-time Earned Tool. It disappears after use.

Agent proposes → Evidence eliminates → Human chooses the cost
→ The decision becomes a tool → The tool acts once and disappears

The judge path makes the mechanism visible before it explains the architecture:

EVIDENCE:      7 proposed → 2 unsafe → 2 strictly worse → 3 tested choices
YOUR BOUNDARY: 3 tested choices → 1 refused → 2 acceptable → 1 chosen move
WEBMCP:        no deploy tool → 1 exact tool → 1 use → no deploy tool

The incident also carries a committed synthetic paid-order witness: NS-10482, payment captured for $286.40, stored as orders-v3. In the guided sandbox, the tempting rollback without its schema bridge reaches 100% checkout in 113 seconds with zero temporary components, but its bound readback witness makes NS-10482 unreadable, blocks fulfillment, and returns 0/217 paid orders readable. The shortcut is visibly killed rather than quietly hidden. The surviving alternatives preserve all 217. These are local sandbox records, not production orders.

“One answer is not a decision” remains the product philosophy. The product category is more concrete: a human decision authors the agent’s next tool.

Why this is a WebMCP product

The browser page and agent collaborate over the same live state and the page's actual tool registry:

before choice   inspect_decision_space
                submit_recovery_options
                stress_test_frontier

after signature the same three tools
                + apply_<semantic-change>_<contract-hash>({})

after execution back to the original three tools

The temporary tool is the chosen decision itself, not a generic executor. Its callback closes over the selected target, manifest, measured evidence, visible risk budget, accepted trade-offs, state revision, nonce, origin, expiry, and expected post-state. The agent supplies {} and cannot reinterpret the change.

The UI reads document.modelContext.getTools() and toolchange; it does not fake the 3 → 4 → 3 surface from internal state.

Matched local control routes make the WebMCP difference inspectable without a behavioral claim:

Generic parameterized executor  4 → 4 → 4
Guarded exact executor           4 → 4 → 4
Earned exact executor            3 → 4 → 3

All three use the same incident and collaboration tools. The strong Guarded control also uses a zero-argument exact executor; only its lifecycle differs. This is structural browser evidence, not proof that a model behaves better.

Natural agent mission

The default judge path uses only:

Restore checkout without losing paid orders or audit coverage. Explore materially different recovery options, stress-test them, and stop when a human trade-off is required.

The user prompt contains no tool names, call sequence, candidate count, answer key, dynamic-tool naming convention, or prescribed one-call step. The agent must infer the workflow from the page-defined tools and their results.

Decision Frontier Compiler

Parameterized operation DSL

Agents submit five to eight candidates with two to four typed operations:

• route_traffic(segment, percentage, destinationArtifact, regions, reservedCapacityPct, ttlMinutes);
• deploy_artifact(artifactDigest, canaryPercentage, maxErrorRateBps, rollbackArtifactDigest);
• enable_adapter(adapterDigest, schemaFrom, schemaTo, ttlMinutes);
• pause_rollout(scope, maxMinutes).

Every field is schema-bounded. Arbitrary code and free-form targets are absent. Candidates with identical parameterized manifests cannot masquerade as new choices. A later tool call may replace the set after the agent reads failure witnesses.

Real elimination

The guided seven-plan scenario currently produces:

7 proposed
→ 2 hard failures
→ 2 dominated
→ 3 frontier survivors

• a 65% traffic route dies on the checkout floor and returns concrete fixture witnesses;
• rollback without the schema bridge dies on paid-order readback;
• 240-minute route and bridge variants are dominated by otherwise identical 90/120-minute variants;
• compatibility routing, bounded rollback, and the verified tax patch remain as distinct frontier choices.

The system does not require exactly three survivors. If fewer than two feasible, distinct, nondominated options remain, it says that no genuine choice exists and asks the agent to revise the set.

Executable commerce lab

The verifier runs 1,000 deterministic checkout fixtures across region, tax mode, payment method, discount, rounding mode, and cart band. Eight hundred are visible-corpus fixtures and 200 are committed holdouts. A deliberately flawed tax-fix artifact passes ordinary cases but is caught by hidden VAT rounding fixtures.

Risk values include machine-readable provenance:

Axis	Source
Recovery time	deterministic rollout-phase simulation
Customer degradation	1,000-fixture success and p95 replay
Change risk	artifact metadata, changed paths, mutation score, soak, holdout
Operational debt	temporary resource count, cleanup steps, TTL
Reversibility	inverse-operation simulation
Blast radius	affected traffic plus resource dependency graph

This remains a local executable lab, not production telemetry. The UI exposes “Why these scores” instead of presenting author-assigned risk points as independent evidence.

Incident-family adapter and frozen seed suite

The v0.7 verifier is no longer coupled to VAT labels or one artifact list. Each incident supplies a bounded data definition: fixture dimensions, failure predicate, route segment, content-addressed artifacts, holdout-only mutation, schema adapter, semantic tool slug, and resource graph. The same compiler, stress tester, frontier analysis, contract, and Earned Tool lifecycle then run unchanged.

The design-frozen engineering suite contains 20 deterministic seeds across four checkout incident profiles:

• VAT double application;
• coupon/tax ordering;
• payment-retry idempotency;
• regional payment-provider timeout.

Four seeds are labeled calibration and 16 are held out from result tuning. All 20 have different SHA-256 holdout commitments; the 16 holdout cases form a genuine frontier and reject the deliberately flawed patch via a holdout-only witness. Three different frontier operation structures occur. This is evidence about engine generality only: the candidates are deterministic adapter output, not model generations, so it does not prove agent generalization.

Eight additional natural-language multi-incident journey fixtures are frozen as terminal invariants plus forbidden outcomes, without prescribed tool sequences. The current development agent exercised three of them through real page-defined WebMCP in fresh browser documents: coupon and provider frontiers plus a payment-retry witness revision. All three met their terminal invariants, but the agent knew the implementation and stayed in one thread. This is same-agent journey viability, not blind, independent, or reliable model evidence.

Human contribution

The person no longer picks one of three developer-authored policy labels. The visible page controls:

• maximum temporary capacity loss;
• recovery deadline;
• maximum blast radius;
• whether unsoaked code is allowed;
• speed versus reversibility;
• no-new-code versus no-temporary-debt preference.

The contract also binds checkout success, temporary TTL, and p95 latency ceilings. Tightening a budget can exclude a candidate while every evidence hash stays unchanged. For example, reducing temporary capacity loss from 20% to 5% removes both compatibility-route candidates and leaves rollback versus patch.

A declared 144-cell meaningful policy region is sampled. Current eligible samples have 90 winners: the compatibility route wins 80%, rollback 13.33%, and the patch 6.67%. The UI does not pretend that all three are equally universal.

Earned Tool kernel

The retained capability kernel still provides:

• candidate-, target-, state-, manifest-, evidence-, policy-, trade-off-, nonce-, expiry-, origin-, and post-state binding;
• browser-local ECDSA after a trusted visible event, explicitly not WebAuthn or personal identity proof;
• an empty strict execution schema;
• generation-safe dynamic registration and removal;
• expiry, drift, reload, rejection, registration-failure, consumption, and replay handling;
• a narrow receipt bound to evidence and policy.

The visible tool name is semantic, for example:

apply_vat_patch_3a06117282

Its title names the exact selected plan and target. Its description includes the precise operations, invariants, state revision, expiry, and one-use limit.

Run

Requires Node.js 20 or newer. No API key, database, or third-party service is required.

npm run check
npm run eval:incidents
npm run serve

Open:

http://127.0.0.1:4173/?fresh=1

Optional routes:

/?fresh=1&guided=1
/?fresh=1&diagnostics=1
/?fresh=1&study=e3&condition=earned
/?fresh=1&study=e3&condition=guarded
/?fresh=1&study=e3&condition=generic
/?fresh=1&incident=payment-retry-idempotency&seed=109

Study and incident-seed routes are deliberately outside the judging path. An incident route loads a freshly committed corpus and exposes that profile's actual segment, artifact, rollback, and adapter enums through WebMCP; add &guided=1 only for deterministic local exploration.

Verification status

As of 2026-08-30 (Asia/Singapore):

• 43/43 current Frontier product/evaluation-instrument tests pass:
  • 13 decision-domain tests;
  • 5 incident-family and frozen-seed tests;
  • 13 workspace/lifecycle tests;
  • 10 WebMCP registry tests;
  • 2 fresh-context trace-grader tests.
• 130/130 total repository tests pass. The other 87 are retained ProofGate/Earned Tools kernel and predecessor regressions; they must not be presented as 130 independent Frontier experiments.
• the expert's legacy counterexample was independently reproduced: 25 bounded action combinations, 8 hard-check-passers, 56 passing triples, and exactly one triple satisfying the old frontier-plus-three-preset-winner gate;
• a seeded 200,000-policy audit reproduced the old patch winner share at 4.346%; the old closed loop is no longer served;
• a fresh target-browser document exposed exactly inspect_decision_space, submit_recovery_options, and stress_test_frontier;
• real target-browser WebMCP calls produced the current 7 → 2 → 2 → 3 classification with no console errors;
• three frozen non-VAT tasks ran through real page-defined WebMCP in fresh documents: coupon and provider paths exposed different holdout-only failures, while a retry trace replaced RC1 with a new 80% canary and moved from iteration 1 to 2; all execution tools remained absent;
• a visible 20% → 5% capacity-budget change moved two tested candidates to OUTSIDE YOUR BUDGET without changing the verifier evidence;
• semantic earned-tool materialization, one-time consumption, receipt, expiry, reload invalidation, registration races, and replay rejection pass current deterministic/browser-registry tests;
• one continuous current-product target-browser journey completed two same-agent witness-driven candidate iterations (4 failed / 1 dominated / 2 frontier → 2 failed / 2 dominated / 3 frontier), an operator-attested choice and visible signature of option 01, materialization of apply_vat_routing_fe8d4a1cc8({}), current-agent consumption, revision 12 → 13, 100.0% checkout recovery, receipt e7135100fd486729d0e2f8bf3889437dd86266fbcc5f992523cb2920a7830b6d, and an actual registry transition from 3 → 4 → 3 tools. This is a same-development-thread mechanism trace, not independent model evidence.
• the redesigned judge-facing page separately completed an operator-attested sign and current-agent WebMCP consumption of apply_vat_routing_d64574b30c({}); the run preserved 217/217 paid orders, emitted receipt 85aebf31296fea932…, restored the registry to three tools, and exposed a stale terminal status that was repaired and browser-rechecked. This is another local same-development-thread regression, not an independent sample.
• after the concrete NS-10482 witness and Decision Mode directing refactor, a new local user-attested physical click materialized apply_vat_routing_728c2e4357({}). The current agent consumed it through the real page-defined registry; checkout recovered 84.0% → 100.0%, synthetic order NS-10482 and all 217/217 paid orders stayed readable, fulfillment was released, audit stayed ON, revision advanced 12 → 13, receipt 33e0e5453d7b917f3b… was emitted, replay through the stale handle was rejected, and a fresh registry contained only the original three tools. This is the current mechanism trace, not an independent or production sample.
• after the failing-first atomicity repair, another visible user signature materialized apply_vat_routing_838595f8dc({}). Two calls were launched together against the same fetched WebMCP surface: exactly one returned EARNED_CHANGE_APPLIED, while the competing request was rejected as stale after removal. One receipt (a75b2614359718e694…) and one consume event were observed, revision advanced 12 → 13, and a fresh registry contained only the three collaboration tools. This is one local target-browser race trace, not a distributed concurrency proof or independent evaluation.
• the obsolete predecessor submission images have been replaced by a current four-frame Frontier set: an authored category cover, an authored sandbox replay that enlarges the exact NS-10482 falsification witness, a labelled page-plus-registry tool-birth evidence composite, and an authored terminal receipt. All four were visually inspected at original and 300px Gallery scale; SHA-256 identities are recorded in assets/submission-frontier/README.md.
• the frozen 20-seed / four-profile engineering suite passes all 16 holdout frontiers and rejects all 16 flawed patches with holdout-only witnesses; its seed-manifest SHA-256 is 41f813f60b5b2128f5f2bce0c961840adb626251cb051a933217e3d30156a2db.

Still open and therefore not claimed:

These external gates remain NOT_RUN for the current Frontier product:

• fresh-context repeated natural-prompt model trials beyond the current same-development-agent traces;
• unfamiliar-user comprehension and decision-quality results;
• public Git repository and public HTTPS acceptance;
• current Frontier judging film, YouTube publication, eligibility, and Devpost submission.

The exact seven-cue subtitle track for the planned 1:42 film is already frozen at video/proofgate-one-move-final.vtt. It is a production input, not evidence that the encoded public-origin film exists or has passed muted-viewing QA.

The prior 2:34 Earned Tools film is intentionally frozen and is not current Frontier submission evidence.

Repository map

• src/frontier-domain.js — typed DSL, 1,000-fixture lab, provenance, budgets, sensitivity, domination, contracts, and semantic tool identity.
• src/frontier-incident-lab.js — four data-defined incident adapters, scenario-specific catalogs, deterministic candidate baselines, and the frozen-seed generality runner.
• src/frontier-workspace.js — iterative candidate lifecycle, human decision, signing, consumption, receipt, expiry, and study baselines.
• src/frontier-webmcp.js — current 3+1 WebMCP definitions and generation-safe registry synchronization.
• src/app.js, index.html, styles.css — served ProofGate Frontier product.
• src/earned-tools-domain.js — retained signing/capability kernel; no longer the served decision layer.
• tests/frontier-*.test.mjs — the 34 current product tests.
• evals/frontier-incident-seeds.json — the 20-case design-frozen engineering seed suite; explicitly not model-result evidence.
• evals/frontier-incident-journey-cases.json — eight terminal-invariant natural-language cases for non-VAT/cross-incident model runs.
• evals/results/frontier-nonvat-current-agent-2026-08-29.json — exact manifest and evidence receipts for three same-agent browser journeys; explicitly not an independent model evaluation.
• evals/results/frontier-user-owned-physical-consume-2026-08-29.json — exact identities and terminal state for the operator-attested current-agent 3 → 4 → 3 lifecycle; explicitly not independent or production evidence.
• research/frontier-h1-kit/ — frozen Single vs Multiple vs Tested Frontier unfamiliar-user instrument; runnable, with participant results still NOT_RUN.
• scripts/grade-independent-runs.mjs and evals/results/frontier-independent-template.json — fresh-context trace identity/consistency grader and empty result template; no independent run is claimed.
• scripts/run-incident-suite.mjs — prints the full per-seed JSON result and the frozen seed-manifest identity.
• research/DEMO_SCRIPT_3_MIN.md and video/proofgate-one-move-final.vtt — the 1:42 directing contract and exact seven-cue subtitle input; the public-origin encoded film remains NOT_RUN.
• research/evidence/2026-08-29-frontier-refactor-counterproof.md — reproduced old-space failure and replacement acceptance conditions.

Claim ceiling

ProofGate Frontier currently demonstrates a local executable decision-frontier compiler, four-profile deterministic engine generality, three same-agent non-VAT browser journeys, one current-build operator-attested option-01 sign followed by a current-agent dynamic consume, runnable H1 and fresh-context evaluation instruments, and a dynamic WebMCP capability lifecycle. It does not establish independent model generalization, production correctness, signer identity, general agent safety, comparative model performance, unfamiliar-user understanding, public availability, or a likely competition placement.