Eval · Trust Layer

Proof you cannot fake.

Run your quality suite against the agent’s real provisioned resources. Because every run executes on Stackbone infra, the result becomes verified evidence — not a screenshot.

  • recorded on infra
  • non-tamperable
  • playground runs excluded
verified scorecardnon-tamperable

source: control-plane telemetry · not creator-reported

  • p95 latencymilliseconds
  • success ratepercentage
  • used bycount · count
excludes is_playground runs
01 · The verified scorecard
live · from telemetry

Six numbers the platform measures — impossible to fake. Select one to see how it is computed.

how this number is computedverified

p50 / p95 / p99 latency

Wall-clock per invocation, bucketed into percentiles.

excludes

is_playground runs are dropped before bucketing.

source: control-plane telemetry

numbers a creator cannot touch.

Enforced · V1 roadmap
02 · The audit — Security Grade
public grade [ V1 ]

An audit pipeline scores the image. The publish auto-checks (CVE, secrets, and declared egress) run privately on every build today; the public letter grade is V1.

  • Docker image CVEsbuild pipeline · private

    CVEs in base image and deps (Trivy / Snyk)

  • Hardcoded secretsbuild pipeline · private

    Hardcoded API keys / credentials

  • Static analysisbuild pipeline · illustrative

    Suspicious patterns (eval, exec, process.env exfiltration)

  • Network egress (declared)build pipeline · private

    Declared egress domains validated against the manifest schema

  • Network egress (declared vs actual)[ V1 ]

    Runtime-observed domains compared against the declared set

  • Requested permissions[ V1 ]

    Organization resources the agent_template requests at install

  • Creator verification[ V1 ]

    Identity badge, history, seniority

grade scale
A+AB
(no grade assigned)

Auto-checks gate your own publish today as a private readiness score; the public letter grade is V1.

03 · Run the suite
live

Declare your evals in agent.yaml in a standard JSON format, versioned with your code.

Run them locally with stackbone dev. Every run lands in the run log (stackbone runs, stackbone logs). The platform does not yet execute or gate publish on evals — there is no stackbone eval platform command today. Enforcement lands in V1.

  • case format:
  • promptfoo
  • deepeval
  • ragas
  • versioned
agent.yamlexample syntax
evals:               # shape, not a verbatim spec  format: promptfoo  # standard JSON (EVAL-07)  cases: ./evals     # versioned with your code (EVAL-06)

maps to case versioning + standard JSON (promptfoo / deepeval / ragas) — both MVP

04 · What lands in V1

You declare evals today; the platform runs and enforces them in V1.

live today
  • case versioning
  • standard JSON (promptfoo / deepeval / ragas)
v1 lane
  • min cases + B2B-Ready badgerule: >= 20 cases[ V1 ]
  • eval in deploy CI (blocking)[ V1 ]
  • public results[ V1 ]
  • pass raterule: >= 90%[ V1 ]
  • adversarial suite[ V1 ]

Declared today; the platform runs and enforces these in V1. The >= 20 and >= 90% figures are the V1 rule — not a number the platform has measured.

Prove it before you ship.

Run the suite locally against the real stack; the platform’s verified metrics become the proof.

The platform for agent developers
Write the agent.
Skip the plumbing.

© 2026 · STACKBONE BUILT WITH ❤️ FROM CANADA AND SPAIN