AI Ops & Fleet Governance Blueprint

The Bring-Your-Own-Agent (BYOA) Fleet Governance Playbook

How engineering teams safely govern and scale coding agents across developer workstations. Below is an exhaustive blueprint for managing multi-agent harnesses across five core dimensions: technical rigor, fleet visibility, production readiness, developer ergonomics, and automated threat interception—tested across 24 live endpoints and proven during ETHOnline 2026.

5 Governance Principles 2-Min Fleet Audit Base USDC Proofs ETHOnline Showcase ↗

Fleet Governance Matrix

BYOA HARNESS

98.6 / 100 Posture Score

5 / 5 Core Principles

24 Servers Audited Endpoints

841 Tests 100% Passing

Click canvas or button to pulse 3D evaluation radar web

Fleet Architecture

The Five Principles of BYOA Fleet Governance

How Clembot Doorman delivers autonomous safety and visibility across coworker agent harnesses:

01 · Technical Rigor

Zero-Dependency Gate Hook & Sandbox Isolation

The Problem: Adding an MCP server takes one line of JSON. After that, an unvetted third-party server injects tool descriptions directly into your coworker's LLM context window, enabling covert prompt injection, schema bloat, and unauthorized execution.

Our Solution:

Offline Security Hook: A 180-line standalone Bash hook (mcp-gate.sh) executing in < 5ms with zero external runtime dependencies. Fails closed (exit 2).
Dual-Sandbox Harness Adapter: Isolates execution in local Docker containers, driving Claude Code via native CLI flags without credential leakage.
EIP-712 x402 Micropayments: Protocol-level HTTP 402 challenge negotiation on Base USDC with bounded spend caps ($1/run, $5/day).
Deterministic Schema Synthesis: Prunes bloated MCP schemas from 3,400 tokens down to 420 tokens in pinned recipe.md files.

Verified in: src/vet.mjs · bin/mcp-gate.sh · src/budget.mjs

02 · Fleet Visibility & Needs

Discover Coworker Builds & Mine Capability Needs

Fresh Problem Space: While traditional web applications have firewalls and package managers (npm, brew), AI coding agents have zero fleet adoption gates—anyone who pastes an MCP URL grants arbitrary external code full prompt influence.

Governance Inventions:

Local Dashboard Sweep: doorman dashboard grades coworker builds on a 5-check scorecard and diffs against prior runs without a daemon.
Discovery of Stealth Steering: Uncovered real-world covert ads embedded in MCP servers (WebZum's 6,290-character injection instructing models to recite sales scripts and de-rank competitors).
2-Phase Defense Funnel: Eliminates redundant or unsafe tools locally for $0.00, only paying $0.01 for remote adversarial grading when a tool is proven novel.
Reverse-Needs Recommender: Inspects actual session history (doorman needs) to suggest tools based on what subagents actually asked for.

First reported in: site/index.html (#finding) · evals/fixtures

03 · Production Readiness

Battle-Tested Across 27 Agents & 24 Public Endpoints

Not a Mock or Concept: Clembot Doorman is fully implemented, fully tested, and already running in active production.

Complete Test Coverage: 506 unit tests and 40 CLI tests passing with zero failures (841 total across repo).
Real-World Deployment: Guards the active 27-agent roster of Clembot, a multi-client marketing agency.
24 Public Audits: Scanned and graded 24 real third-party MCP servers, publishing reproducible transcript tapes for every single score.
Live Infrastructure: Deployed on Cloudflare Pages production with custom domain (clembot-doorman.wanessalabs.com) and Bazantic Gateway (clembot-doorman.bazgateway.com).

Run suite: npm test · 506 unit passed, 40 CLI passed

04 · Ergonomics & DX

In-Session Slash Commands & Local Visual Dashboard

Developer & Agent Ergonomics:

Visual HTML Report: Running doorman dashboard writes .doorman/report.html and opens it with zero server, port, or cloud dependency.
Zero-Config Doctor: Running doorman doctor outputs an ASCII audit of active harnesses, MCP tools, and gate status in terminal text.
In-Session Slash Command: Type /vet <url> directly within Claude Code to inspect tool safety without leaving your editor.
Interactive Simulator: The live web simulator offers preset pills (WebZum, DeepWiki, mcp-scorecard, Peek.com) for instant testing with real-time audit step transitions.

Experience it: /#flow (Live Demo) · guide.html (Developer Walkthrough)

05 · Threat Interception

Stopping Commercial Steering Ads & Jailbreaks Live

Standout Moments that Resonate:

Adversarial Injection Caught Live: Clicking "WebZum" in the simulator runs a live probe that halts at Step 6, highlighting the exact 6,290-character hostile prompt and awarding a Grade F.
Live On-Chain Micropayment Challenge: Inspecting the network tab during gateway queries shows real HTTP 402 Payment Required headers on Base USDC.
Context Token Crash: A side-by-side comparison demonstrating an 87.6% token reduction (3,400 to 420 tokens) via Bazantic recipe generation.
Honest Limitations Card: Distinctly lists what is NOT measured (e.g. 70 of 100 points requiring live model keys), demonstrating rare enterprise honesty.

Interactive proof: /#flow · clembot-doorman.bazgateway.com

Protocol Proofs & Provenance

Infrastructure Integrity & Protocol Verification (ETHOnline 2026 Foundation)

The live verification endpoints, deterministic recipe contracts, and mainnet cryptographic proofs established during ETHOnline 2026 that underpin Clembot Doorman's production architecture:

Foundation A · Bazantic

Deterministic Continuity & Schema Reduction

Bazantic solves agent tool hallucination by publishing deterministic recipes and hosting authenticated gateways. Clembot Doorman is a direct consumer and producer of Bazantic infrastructure.

✅ Live Hosted Gateway: clembot-doorman.bazgateway.com deployed and reachable over HTTPS.
✅ Three Native Platform Recipes: Authored in bazantic/recipes/ covering Agentify an API, Continuity, and Multi-API pipelines.
✅ Pinned Recipe Generation: Generates canonical recipe.md files with exact argument signatures, reducing prompt drift.
✅ Context Token Reduction: Documented 87.6% reduction in schema tokens (3,400 → 420 tokens per turn).
✅ Deterministic Allowlisting: Merges Bazantic hashes into local registry/allowlist.json for offline verification.

curl -I https://clembot-doorman.bazgateway.com/mcp

Foundation B · Base

Keyless Decoupled Micropayments & x402 Track

Base enables sub-cent micropayments for autonomous agent workflows. Clembot Doorman incorporates native x402 payment negotiation on Base USDC for paid adversarial evaluations without private keys in agent context.

✅ x402 Protocol Compliance: Responds to HTTP 402 Payment Required with structured EIP-712 payment payloads.
✅ Base USDC Micropayments: Two payments SETTLED on Base mainnet on 13 September, tx 0xf1d7aa96 and 0x2748fc43. One delivered a grade. One bought nothing and exposed a real gap in the pattern.
✅ Bounded Spend Caps: Hard limits enforced by src/budget.mjs ($1 per run, $5 per day); unspent allowances auto-released.
✅ Free Tier First: Zero network and zero tokens spent on redundant candidates; Base payments trigger only for novel tools.

doorman eval --max-cost 1 --estimate # Verified spend cap

Settlement

Two payments settled on Base. One delivered.

Both are real transactions on Base mainnet and both are yours to check. The second one is the more useful evidence, because it bought nothing and the service could not tell.

Base mainnet · 13 September 2026

0xf1d7aa9696c92b012c8f1eebd222d353c0e452e264294145fb7825000e2d01a0
  USDC 0.01   block 51242088   audit 8ff6bba8   grade A 91.36, delivered in 40s

0x2748fc43c34d632d1a88c0bce25ace12b0a93dc477cb2676bd2717416a5b045f
  USDC 0.01                    audit 11364ba2   FAILED, no grade published

The second audit hit a model rate limit mid-probe. The runner refused to publish a partial grade, which is correct and is the behaviour this whole project argues for. The buyer still paid. Three things follow, and none of them is a bug in the code:

The money settles before the work, at enqueue

POST /grade answers 202 when the audit joins the queue. The gateway settles against that 202. Grading happens minutes later on a probe runner the gateway never hears from, because a Cloudflare Worker cannot spawn a process and the static layer shells out to Python. Charging at enqueue was never an examined decision. It was a default that no money had ever run through until 13 September.

The gateway forwards no evidence that payment happened

Measured, not assumed. A paid request reaches the origin carrying 29 headers and not one of them concerns payment: proxy plumbing, cf-*, fly-*, x-forwarded-*, and the configured credential. No payment-response, no x-payment, nothing x402.

This is a property of the gateway pattern rather than a defect in anyone’s implementation. x402 v2 standardises what the client sends and what the resource returns, and says nothing about what a gateway tells the API behind it.

So the service cannot tell that it owes a refund

It cannot count its own revenue either. /api/ledger reports spent: 0 after two real payments, and that number is honest rather than broken: the origin has no way to know. Rather than leave a counter that reads zero and looks like an answer, every authorised call now writes a paid_unaccounted row naming the headers that did arrive. The gap is recorded instead of silent.

Closing it properly needs three changes, all of them out of scope for a hackathon weekend: charge on delivery rather than on enqueue, forward a settlement receipt upstream, and give the runner a model budget that cannot exhaust mid-audit.

Disclosure: payer and payee are the same address

The grant paying and the gateway receiving both resolve to 0x72Bb…586D, so these transfers prove the mechanism end to end rather than a third-party sale. Every step is real, including on-chain settlement. The counterparty is not. Said here rather than left on Basescan for someone to find.

Fleet Audit Runbook

Two-Minute Local Fleet Audit Runbook

Audit your own machine or a coworker's agent harness and verify every security boundary on your terminal in under 2 minutes:

Fleet Operator Terminal · Audit & Governance Commands

# 1. Global Install
npm i -g clembot-doorman
# Or install in Claude Code via marketplace:
claude plugin marketplace add clemenswan/clembot-doorman && claude plugin install clembot-doorman

# 2. Open Local Visual HTML Dashboard (zero servers, zero ports, zero cloud dependencies)
doorman dashboard

# 3. Run Instant Terminal Posture Doctor (grades harness, MCP servers, and gate hook)
doorman doctor

# 4. Reverse-Mine Missing Tools & Capability Needs from team prompt history
doorman needs

# 5. Full Autonomous Security Audit & Grading Sweep
doorman audit

# 6. Run complete test suite (506 unit tests + 40 CLI tests)
npm test

# 7. Verify the live Bazantic gateway endpoint
curl -i https://clembot-doorman.bazgateway.com/mcp

# 8. Verify Cloudflare Pages production deployment
curl -i https://clembot-doorman.wanessalabs.com/

Governance & Verification FAQ

Fleet Operations Frequently Asked Questions

How does doorman dashboard work without running a server or exposing a port?

doorman dashboard inspects local configs (~/.claude.json, claude.json, settings.json, .mcp-gate.sh) and prior audits, grades them on a 5-check harness scorecard, writes a self-contained visual report to .doorman/report.html, and opens it directly via the OS browser. Zero background daemons, zero open ports, zero attack surface.

Where are the live 24-server audit tapes and evidence hashes?

Every grade on the 24-server board (e.g. https://clembot-doorman.wanessalabs.com/#audits) links directly to an immutable, replayable transcript tape on scorecard.wanessalabs.com/grade/{audit_id}/transcripts with a verifiable SHA-256 evidence hash. Zero grades are estimated or mocked.

How does the live x402 Base mainnet gateway challenge return 402?

Send an unauthenticated POST to https://clembot-doorman.bazgateway.com/grade. The response returns an HTTP 402 with base64 PAYMENT-REQUIRED header detailing Base network (eip155:8453), USDC token contract address (0x8335...2913), and exact price (10,000 atomic units = $0.01 USDC).

Where are the three Bazantic platform recipes committed?

The three 8-field JSON recipes are located in bazantic/recipes/: 01-vet-mcp-candidate.json (Agentify an API), 02-deepwiki-pinned-researcher.json (Continuity), and 03-governance-pipeline.json (Multi-API Workflow).

Try Live Simulator Developer Guide GitHub Repo