Lantern ArchitectureAS OF 2026-11-04
Budget $100.00 Spent $532 at list, about $132 cash Region us-west-2 Postgres roles 4 Public URL frontier-lab-challenge.ryanprasad.ai
Terraform challenge/infra/ SQL challenge/sql/ Agent challenge/prototype/agent.py

One Postgres in the middle, with a separate role for each thing that touches it.

The agent reads the semantic layer. Reviewers write their decisions. A daily job logs new OPM files. Only the build on the laptop writes the tables the agent reads.

Ask the agent
Postgres roles4Owner, agent, reviewer, pipeline.
Agent tools9Eight governed functions and one read-only query.
Scheduled jobs1The OPM watcher, daily at 06:00 UTC.
AWS per month~$14Almost all of it the RDS instance.

How the pieces connect

Every line runs today. The table below names every box.

Lantern architecture A browser reaches a Cloudflare Worker on the custom domain, which passes requests to the workshop app on Lambda. The app's agent calls the Anthropic API and reads the semantic schema in RDS Postgres as the agent role. Review decisions go to app.decisions as the reviewer role. The eval harness on the laptop runs the same agent and checks truth against the silver and synthetic tables. A DuckDB build on the laptop pulls public files and ships those tables. In AWS, a daily fetch Lambda lands new OPM files in S3 and invokes a load Lambda in the VPC, which writes ops.opm_files as the pipeline role. INTERNET COMPUTE AWS US-WEST-2 Browser Cloudflare Worker the custom domain Workshop app and agent Lambda · FastAPI, Strands, SSE claude-haiku-5-5 · xhigh Eval harness laptop · the same agent DuckDB build laptop · pull, checks, ship Anthropic API the model HTTPS OPM, USAJOBS, Census public files pull OPM FWD API new monthly files truth SQL ship RDS Postgres 17 · db.t4g.micro semantic · 8 views, 8 functions role agent · read-only · 60 s timeout app.decisions role reviewer · insert only silver, synthetic tables owner only ops.opm_files role pipeline · insert only OPM watcher · daily 06:00 UTC fetch Lambda S3 landing load Lambda in the VPC invoke

challenge/infra/main.tf, pipeline.tf · challenge/sql/00_roles, 03_semantic, 04_decisions, 05_pipeline.pg.sql

Every box, where it runs, and what it may touch

PartRuns onTalks toNote
Workshop appLambda, from the repo's one container imageAnthropic API and SSM over IPv6. RDS as agent and as reviewer.No state on the server. The browser sends the transcript with each turn, and the answer streams back as server-sent events. A ping every 15 s keeps the stream open while the model thinks. A cold start takes about 5 s.
AgentInside the app processEight governed functions, one read-only query toolclaude-haiku-5-5 at xhigh effort, 64,000-token cap. A fresh agent per request.
RDS PostgresAWS, db.t4g.micro, 20 GBNothing outboundReachable from one laptop address and two security groups, the app's and the loader's. About $14 a month.
semanticRDSRead by the agent roleEight views and eight table functions. Read-only transactions, 60 s statement timeout, no other schema.
app.decisionsRDSWritten by the reviewer roleOne row per Accept, Edit, or Dismiss click. The agent has no grant here, so a decision is always a person's.
silver, syntheticRDSOwner onlyShipped from the DuckDB build. The eval's truth SQL reads these tables and never the semantic layer.
DuckDB buildThe laptopPublic files. RDS as owner.pull_sources.py, then load_postgres.py --ship. 25 acceptance checks pass before anything ships. The window is pinned to September 2025 through August 2026.
Eval harnessThe laptopThe same agent. RDS as owner for truth.Every graded run goes to experiments.jsonl, which the metrics dashboard reads.
OPM watcherTwo Lambdas, daily 06:00 UTCOPM API, S3, RDS as pipelineThe fetch Lambda runs outside the VPC to reach OPM. The load Lambda runs inside it to reach RDS. It never touches the agent's tables. About $0.10 a month.
Public URLCloudflare Worker, free planThe Lambda Function URLfrontier-lab-challenge.ryanprasad.ai. The Worker passes each request through and streams the answer back. The function leaves the VPC over IPv6, so there is no NAT gateway.

DECISIONS.md · challenge/prototype/agent.py · challenge/scripts/load_postgres.py · challenge/pipeline/