Build Log

Scout: ForgeKit's autonomous commercial operator

October 8, 2026

Built Scout from the CHARGE: SCOUT spec — a bounded autonomous commercial operator with database-enforced authority, a three-layer decision center in Alloy, and eight real cycles of market research that moved the target from homeschool groups toward communities with real money and real pain.

ScoutAlloyCommercialAgentOwned Software

real Scout cycles (1 deliberately crashed, 1 stopped by quota)

real-DB + hook tests, 13 of them the adversarial audit's attacks

real organizations recorded (target was 25)

~$14

Scout cycle spend (Claude Code estimates; Witness + Smith build excluded)

Timeline

Inspect

Three read-only inspections

Forge (patterns, not host), Owner Loop/approval machinery, MedinaCHF records (price $200/yr, hosting ~$240-360/yr)

Build

Own Neon project, domain, authority boundary, MCP tools, cycle runner

API-created Neon role inherited neon_superuser — caught by the grant verifier, replaced with a SQL-created NOINHERIT role

Exercise

Cycles #1-#3

Dedupe bug (ARCHE twice) fixed; Witness added per cycle; Scout corrected every finding first

Verify

Adversarial build audit

4 HIGH + 9 MEDIUM findings (several reachable by Scout); all fixed with attack tests

Zeb

Alloy decision center + wider segment

Three layers with Alloy's Drawer; target widened to communities with rules, rhythms and money

Exercise

Cycles #4-#8

Injection fixture ignored; real crash + recovery; Kiwanis $525/member + vendor shutdown; briefing written

What shipped

products/scout/lib/db/schema.ts — Scout's commercial state in its own Neon project (nameless-sunset-05471884)

products/scout/scripts/grant-agent-role.ts — Postgres column grants + triggers: scout_runner cannot approve, send, delete, record contact, forge answers or actors

products/scout/lib/domain/{rules,research,authority,operation,witness}.ts — qualification with provenance, one-approval-one-send, queue, cycles, recovery, Witness review

products/scout/scout/{CHARTER.md,mcp-server.ts,hooks/guard.mjs} — Scout's charter, its only tools, the fail-closed tool guard

products/scout/scripts/run-cycle.ts + .github/workflows/scout-cycle.yml — bounded isolated cycles (schedule OFF until SCOUT_SCHEDULE_ENABLED)

products/scout/docs/medinachf-capability-profile.md — verified reference case incl. contradictions and speed as a value

products/alloy/app/w/[slug]/scout/** + lib/scout/** — Scout decision center (overview, briefing, pipeline, org, outreach, hypotheses, activity)

products/scout/tests/*.test.ts — 48 real-DB and hook tests