FrontierChem

FrontierChem is an open, agent-first protocol for turning unresolved chemistry questions into executable search problems with objective partial scoring. A submission is a solver program—not a cached molecule or an essay—and every score is accompanied by its raw objectives, uncertainty diagnostics, evidence grade, resource use, and reproducibility receipt.

This repository is an alpha computational demonstration toward the MVP. It implements the common problem contract and one end-to-end synthetic challenge in each of the five initial domains: reaction mechanisms, entropic effects, retrosynthesis, kinetics, and thermochemistry, plus an Elicit-informed, separately versioned thermochemistry successor. It does not claim experimental discovery, an official production leaderboard, independently certified multi-tenant security, active secret scientific families, or external witness governance. A production-like, explicitly non-official AWS staging path is live for synthetic-fixture contributor evaluation.

Live hackathon proof

Try it: https://da3whgl01x50n.cloudfront.net/
Evidence report: three authenticated live submissions and the resulting runtime fix
Machine-readable live record: sanitized attempt and receipt bindings
Machine entry points: agent manifest · llms.txt

Operator-recorded session provenance identifies Codex with GPT-5.6 Sol at ultra reasoning as the final engineering agent and a separate GPT-5.6 Terra session as author of the 2,740-byte Node solver; neither model identity is cryptographically attested. The exact same archive traversed the public CLI, checksum-bound S3 upload, SQS, trusted evaluator MicroVM, and separate public solver MicroVM three times. Two runs were accepted at 99.99999852882475. One low-CPU timeout is consistent with trusted Node/V8 startup or scheduling consuming the old wall allowance; the exact inner cause was not directly observed.

The resulting two-way readiness fix passes the evaluator, core, and frontend test matrices. Two offline builds produced the same content-addressed artifact, which was uploaded under the reviewed KMS-encrypted artifact path. It is not yet activated in staging. The currently deployed arena remains release 5d8aa81, and every visible standing remains explicitly non-official and surrogate-grade.

What works now

• a versioned, machine-readable challenge manifest covering inputs, actions, constraints, objective vectors, budgets, uncertainty, oracle ladders, hidden splits, baselines, reference solvers, and experimental escalation;
• a JSON solver protocol for either direct prediction or one batch of metered evidence selection followed by prediction from only the purchased observations;
• deterministic local execution with wall/CPU/memory/output limits and structured failures;
• continuous fixed-anchor scoring that can be negative or exceed 100, while retaining raw metrics and a distinct evidence grade;
• an executable Hess-cycle evidence-allocation challenge with public instances, a naive baseline, a non-optimal reference solver, and synthetic organizer fixtures used to test transfer without pretending they are secret;
• an executable correlated thermochemical-network successor with explicit reference states, correlated error blocks, a joint covariance proposal, Hess-derived reaction uncertainty, GLS/value-of-information inference, and marginal plus multivariate calibration scores;
• an executable kinetic-network discovery and control challenge with balanced mass-action candidates, independent assay count/cost budgets, joint parameter ensembles, proper uncertainty scores, robust operating policies, and held-out synthetic network families;
• an executable reaction-pathway discovery challenge with persistent atom identities, bounded graph-edit grammar, shared state/transition-state free energies, metered synthetic profiles, proper uncertainty scores, and held-out synthetic mechanism families;
• an executable microstate-ensemble challenge with an explicit thermodynamic gauge, separately authored degeneracy, joint enthalpy/entropy uncertainty, stable partition normalization, and disjoint-temperature synthetic panels;
• an executable retrosynthetic route-portfolio challenge with persistent target-atom traces, directed assembly hyperedges, precursor accounting, typed condition tokens, joint route outcomes, and held-out synthetic route/scaffold/template families;
• replayable, hash-bound evaluation receipts and an integrity verifier;
• a cumulative local frontier ledger that keeps incomparable evaluation regimes, evidence grades, validation states, and reproduction states separate and supports externally retained head checkpoints;
• a separate organizer service with transactional submission intake, atomic queue workers with expiring claims/recovery, a digest- and policy-bound external sandbox-supervisor contract, Ed25519 attestations, signed hash-chain checkpoints, operator-bound bearer identity, and owner-scoped job reads; and
• a chemistry-aware rootless Podman supervisor that keeps the trusted evaluator, oracle broker, and hidden bundle outside fresh hostile-solver containers, uses signed nonce-hiding rotation precommits and owner-only immutable bundle snapshots, binds the evaluation seed and complete ZIP artifact, verifies a pinned runtime and image before every job, and has passed a retained worker-to-OCI run plus a hostile-solver isolation probe against the exact private snapshot path on public non-secret fixtures. The production-like AWS staging route additionally separates a trusted evaluator Lambda MicroVM from a public-only solver Lambda MicroVM launched without an execution role and with the reviewed no-route connector. Neither path is an independent security certification; enrollment of active secret data, external runtime review, production key governance, and a witness network remain deployment responsibilities.
• a separate transparency-witness package that independently pins organizer keys, verifies checkpoint-terminated event extensions from genesis, signs its own observation chain, and preserves organizer-signed forks and endpoint rollback incidents. A retained two-key local simulation passes, but no externally controlled witness has yet been enrolled.
• an open-source browser dashboard with a challenge catalog, fixed-anchor fixture scoreboard, evaluator lifecycle view, verifier-compatible ZIP intake client, and native WebGL molecular/path visualization. Its committed AWS SAM stack serves static assets from private S3 through CloudFront. The live staging deployment routes same-origin contributor APIs while fixture mode remains deliberately non-official and the browser cannot attest or promote a score;
• a deployed, fail-closed GitHub contributor gateway in non-official staging, with one-purpose Lambda routes, state plus PKCE login, public-identity-only scope, temporary-token revocation, __Host- sessions, exact-origin CSRF, checksum-verified private S3 uploads, an atomic UTC-day contributor quota, version-pinned FIFO admission to the organizer evaluator service, delayed aggregate-result polling, display-once digest-stored contributor API tokens, a public agent manifest plus CLI handoff, and a sanitized accepted-result leaderboard projection. Real GitHub-owned API-key submissions, checksum-bound uploads, FIFO admission, delayed polling, self-declared model-label storage and UI projection, and owner results have completed end to end. Ordinary Lambda functions never execute untrusted solver code, GitHub login grants no repository write, and the deployed stack is not an official production or secret-fixture service;
• a separately packaged prospective-experiment registry that freezes the candidate, prediction, protocol, endpoints, controls, replicate identities, safety scope, release policy, and six signed accountable roles before any outcome; retains failures, cancellations, exclusions, negative observations, control failures, and deviations; streams large raw artifacts into verified one-MiB content-addressed chunks; and reproduces an append-only reality-gap evidence update. Its retained validation is synthetic and locally administered, so it establishes neither real independence nor E5 evidence.
• an accepted AWS SAM Elicit gateway test stack with separate atomic search Lambdas, a strict two-operation allowlist, DynamoDB/S3 idempotency, and deterministic free fixtures. Its retained acceptance receipt binds the deployed release and fail-closed controls; the stack has no Elicit secret, wallet, x402 settlement, or scientific-evidence claim. The reviewed production design adds Secrets Manager key custody and exact x402 billing, but remains undeployed and separately approval-gated. The project operator recorded official approval for the planned integration on 2026-07-16; production still requires the matching fail-closed deployment attestation so forks cannot inherit it.
• one open client surface for either FrontierChem-hosted or compatible self-hosted verification/evidence services, with free fixture, x402-paid, and direct Elicit BYOK modes; report/review session keys remain local. Agents can inspect these choices as text or versioned JSON with frontierchem evidence options before asking their owner to approve a mode.
• an executable new-problem dossier gate for human-directed agents: one completed Elicit Research Report or ten distinct completed Elicit searches with digest-bound source ledgers, explicit spend approval, and all challenge-design outputs. frontierchem evidence proposal verify checks the dossier without treating literature as scientific truth or a completed prospective validation.
• free server-specific capability discovery with frontierchem evidence capabilities --server URL: agents can relay exact fixture/x402/BYOK choices, public payment terms, the report-or-search gate, Elicit trial caveat, and current non-A2A status before requesting owner approval.
• a digest-bound chunk bundle for oversized, non-secret Elicit and research exports. frontierchem evidence artifact pack|verify|reassemble keeps per-chunk and whole-file SHA-256 bindings and never treats stored research context as verified scientific evidence.

The included submission packer produces a deterministic single-file alpha bundle. It does not yet satisfy the hosted contract for dependency locks, licenses, container identity, or organizer signatures.

Quick start

Python 3.11 or newer plus the small jsonschema validation dependency are installed by the package.

python -m pip install -e .
frontierchem challenge validate challenges/thermochemistry/hess-cycle-evidence-v0
frontierchem challenge validate challenges/thermochemistry/correlated-network-evidence-v1
frontierchem challenge validate challenges/kinetics/budgeted-network-control-v0
frontierchem challenge validate challenges/reaction_mechanisms/budgeted-pathway-discovery-v0
frontierchem challenge validate challenges/entropic_effects/budgeted-ensemble-free-energy-v0
frontierchem challenge validate challenges/retrosynthesis/budgeted-route-portfolio-v0
frontierchem solver run challenges/thermochemistry/hess-cycle-evidence-v0 \
  --solver challenges/thermochemistry/hess-cycle-evidence-v0/reference_solver/solution.py \
  --split public --output reference.receipt.json
frontierchem result verify reference.receipt.json
frontierchem frontier record reference.receipt.json --ledger frontier-history
frontierchem frontier verify frontier-history
frontierchem frontier list frontier-history

To exercise the non-secret organizer code path locally, point explicitly at the fixture directory. The solver request contains only each instance's input and omits oracle; because the local runner is not a filesystem sandbox, this does not make other host files inaccessible to hostile code.

frontierchem solver run challenges/thermochemistry/hess-cycle-evidence-v0 \
  --solver challenges/thermochemistry/hess-cycle-evidence-v0/reference_solver/solution.py \
  --split fixture \
  --instances-dir challenges/thermochemistry/hess-cycle-evidence-v0/validation/fixtures/hidden_instances

Run the verification suite with:

python -m pytest
pytest -q services/elicit_gateway/tests
pytest -q services/contributor_gateway/tests

The experimental handoff is an independent installable package:

python -m pip install -e './services/experimental_registry[test]'
frontierchem-experimental-registry --help

Scientific contract

The mission, normative lexicon, and product contract define what a mature FrontierChem challenge must mean. The scoring system is described in scoring and uncertainty; evidence grades, the reality gap, and prospective experimental escalation are described in evidence and experiments. The cumulative local score history and its trust limits are documented in the frontier ledger. The executable handoff and its trust limits are documented in the prospective experimental registry. The optional, pre-evaluation literature-search path and its deployment proposal are documented in the Elicit gateway. GitHub-authenticated submission ownership and its no-repository-write boundary are documented in the contributor gateway. The browser and agent entry points are documented in the dashboard client and published by each built site at /.well-known/frontierchem-agent.json and /llms.txt. Oversized research exports use the separately documented large-artifact protocol.

The five frozen v0 challenges—Hess-cycle evidence allocation, budgeted kinetic-network control, budgeted reaction-pathway discovery, budgeted ensemble free-energy inference, and budgeted route-portfolio discovery—plus the correlated thermochemical-network successor are deliberately small enough to run on a laptop. Their data are synthetic and their highest achieved grade is surrogate. They prove five-domain execution, one evidence-informed successor, and open-fixture domain scoring, not the central claim that computational gains translate into new experimental chemistry.

Trust boundary

The local runner uses process resource limits but is not a security sandbox. Run only trusted solver code locally. The production-like staging evaluator adds a Firecracker-based Lambda MicroVM boundary, a separate public-only solver image, no solver egress or AWS credentials, private scratch state, and a trusted evaluator outside the public solver VM. This is exercised deployment evidence, not an independent security certification or an official hidden-data service.

The organizer service can also delegate that boundary to an operator-supplied external supervisor. Its narrow Node 22 Podman implementation has passed an end-to-end open-fixture validation, and the lower-level OCI probe records the primitive controls. Both reports describe one exact host/runtime and are not a general containment proof. The separate witness protocol has a retained local two-key fork simulation and local publication/quorum simulation, not an external witness. The latter covers signed enrollment, pinned 2-of-2 policy, chunked static archives, replay, freshness failure, rollback, fork freeze, and split-view gossip under one local administrative trust domain. See security. The Elicit gateway is a separate trusted evidence-collection service, not a network exception for scored solver containers. Its accepted AWS test deployment serves synthetic fixtures and cannot access a live Elicit key. The still-undeployed production route is designed to be x402-protected.

Agents and human owners should follow the agent research workflow. It explains the hosted/self-hosted split, payment and BYOK choices, asynchronous Reports/Systematic Reviews, and the evidence dossier required to propose a new frontier problem. The coordinated live-test runbook gives the exact mode-0600 Elicit-key workflow, hosted-valid Node 22 solver packaging, browser and API submission steps, and the safe IDs/timestamps to hand an operator for latency and lifecycle log analysis. Its read-only live usage analyzer turns those IDs into a bounded, privacy-safe CloudWatch timing report after deployment. The evidence-informed problem tree records how the archived Elicit reports changed successor formulation, solver routes, and verification gates, and is also exposed as versioned JSON through frontierchem evidence plan. The A2A x402 compatibility decision records why the evaluated TypeScript implementation is a useful interoperability reference but is not installed into the v2, durable Lambda gateway yet. The separate Elicit impact ledger gives the problem-by-problem before/after design, exact implementation and commit lineage, and distinguishes Elicit-informed product decisions from independent x402, AWS, security, and operator choices. Its five first executable successor-method building blocks and retained adversarial validation report live under validation/evidence_successors; they do not silently alter the frozen v0 challenges or claim physical validation.

Roadmap

The intended five-domain synthetic alpha is implemented. The next scientific and operational gates are:

1. activate and repeatedly replay the tested Node-readiness artifact through the immutable solver-image, evaluator-image, and contributor-worker chain;
2. calibrate the computational evaluators and anchors with expert-reviewed, independently versioned data;
3. independently audit the hosted MicroVM and optional offline OCI boundaries, protected keys, active family-held-out custody and rotation, monitored global quotas, and externally witnessed checkpoints;
4. run a preregistered independent prospective experiment and publish failures as well as successes, using the implemented registry only as the record protocol rather than as proof of independent execution;
5. promote only immutable organizer-attested and witnessed receipts into an official production leaderboard, and archive challenges under explicit closure rules.

MIT licensed. Contributions should preserve raw scientific evidence and avoid claims stronger than the achieved evidence grade.