Ship Beacon yourself.

A laptop-first Beacon stack. Beacon core, Studio, synth-traffic replay, and an optional mock DNS service run together through Docker Compose. Studio shows live receipts replayed from the 100 real AI failure cases.

# 1. One-liner
git clone https://github.com/bobrapp/aigovops-beacon
cd aigovops-beacon
docker compose -f deploy/lab.yml up -d
open http://localhost:8788

# 2. Sanity check
curl -s http://localhost:8787/healthz
# {"ok":true,"version":"2.2.0","receipts":47,"keys":1}

What's actually running

Studio is now showing receipts replayed live. Click any receipt → Verify → green check.

Each variant is a self-contained block. Pick four for a 90-minute workshop. Pick all nine for a half-day. The 30-minute Level 100 flow maps to Labs 1, 4, and 7. Labs 8 and 9 are v2.3 additions.

Workshop combinations

• 30 minutes — Lab 1 (first receipt) → Lab 4 (score a framework) → Lab 7 (bundle for auditor).
• 90 minutes — Labs 1, 2, 4, 5, 7.
• Half day — All nine, in the order shown.
• Tabletop, no admin rights — Lab 8 (offline USB) only.

Beacon's Make it Policy as Code path emits gate YAML, OPA .rego, a Governance Decision Record, and a signed bundle — then opens a pull request against your governance repo. Checklists become versioned controls. Meeting notes become artifacts.

Gate YAML (governance gate spec)

kind: GovernanceGate
apiVersion: aigovops.foundation/v1
metadata:
  name: high-risk-ai-release
spec:
  framework: nist-ai-rmf
  system: hr-screen-gpt
  requires:
    - human_approval
    - signed_receipt
    - evidence_bundle
  block_on:
    - missing_human_approval
    - stale_receipt: 30d
  emit:
    - governance_decision_record
    - signed_bundle

OPA Rego (enforcement)

package aigovops.beacon.high_risk_ai_release

default allow := false

allow if {
    input.framework == "nist-ai-rmf"
    input.system == "hr-screen-gpt"
    has_human_approval
    has_signed_receipt
    has_evidence_bundle
}

has_human_approval if {
    some i
    input.attestations[i].kind == "human_approval"
    input.attestations[i].verified == true
}

has_signed_receipt if {
    some i
    input.receipts[i].signature_ed25519
    input.receipts[i].verified == true
}

has_evidence_bundle if {
    input.bundle.manifest_sha256
    input.bundle.verify_passed == true
}

That YAML and Rego are the same artifact, in two languages. The YAML is what the governance team reviews. The Rego is what the CI/CD gate runs. The signed receipt is what the auditor verifies — months or years later — without needing Beacon installed.

Wire a real model invocation into Beacon by posting receipt data to /api/v1/receipts with model metadata, environment, prompt, result, latency, and token counts. The Beacon server signs the receipt and appends it to the NDJSON log.

curl -s http://127.0.0.1:8787/api/v1/receipts \
  -H "Content-Type: application/json" \
  -H "X-Beacon-User-Sub: oidc|alice" \
  -H "X-Beacon-User-Email: alice@example.org" \
  -H "X-Beacon-OIDC-Issuer: https://accounts.example.org" \
  -d '{
    "vendor": "OpenAI",
    "model": "gpt-4o-mini",
    "version": "2024-07-18",
    "environment": "production",
    "event_type": "invocation",
    "prompt": "summarize the policy",
    "result": "…",
    "latency_ms": 312,
    "tokens": {"in": 21, "out": 47}
  }'

What gets signed

Beacon canonicalizes the receipt (sorted keys, no whitespace, UTF-8) and signs the bytes with its per-instance Ed25519 key. The response includes the receipt sequence number, the entry hash, and the signature — same shape as the in-browser sandbox in Level 100.

Wiring it into a production AI call

The pattern that works in production:

1. Wrap the model client (OpenAI, Anthropic, etc.) in a thin observer that captures vendor / model / version / latency / token counts.
2. POST to /api/v1/receipts after each call — fire-and-forget, with a local retry queue if Beacon is unreachable.
3. Never block the user-facing path on Beacon. The receipt is observational; the model call is independent.

Verify a bundle from the command line

cd server
node src/cli.js verify ~/.beacon/bundles/bundle-<timestamp>

Or, for the lab-style audit log that built this very page, no Node needed:

pip install cryptography
python -m src.audit_log verify

Every public AI failure in the dataset, mapped to the framework controls and the Beacon artifact that would have caught it. Filter by act, framework, harm type, or sector. Click any row to expand. Each row's Beacon artifact hint cross-links back to the Level 200 section where that artifact lives.

Source: docs/data/ai_failures_top100.json. Methodology mirrors the home-page failures browser.

Pick five technical cases and five policy-facing cases from the deep-dive above. For each, identify the missing Beacon artifact and the framework controls that apply. Use the worksheet to capture your analysis — bring it to your team's next AI governance review.

Open printable worksheet ↗ Worksheet PDF ↓

Suggested splits

You've completed Level 200 when you can say all four statements clearly.