Here is the canvas. Hand it to your coding agent.

Karkhana (कारख़ाना — the workshop) is this monorepo's blank canvas, generated from it and built for coding agents first: a coding agent given only the repo and a .env with the keys you supply reaches a deployed, running app on Cloudflare in one session — without asking anyone anything — and can then add a new agent with one command.

A watercolour of a bright workshop with a blank canvas on an easel.

Status · v0, public

Generated from this monorepo — and live.

The public repo dashayushman/karkhana (MIT) is produced by scripts/export-starter.mjs with an allow-list: the Agent Kernel, the shared contracts, the config loader, RBAC, Alchemy IaC (account- and stage-pinned), bootstrap · doctor · check · smoke · new:agent, the daily-card example (Workers AI through your AI Gateway, D1, HTTP + cron), task runbooks, and a CI that proves check + bootstrap --dry-run without owning any account. Out: the brand, the playbooks, the Langfuse library, our account ids.

v0 means: the kernel, config, infra, the example and the scaffold work; the console shell, new:consumer / new:page / new:port and a weekly cloud end-to-end are next. The terminal on the story page is what bootstrap prints.

github.com/dashayushman/karkhana ↗The story's last beat →

The success criterion, verbatim.

A coding agent (Claude Code, Codex, Cursor, Gemini CLI…) is given only the repo and a .env containing the keys the human must supply. Without asking a human anything, in one session, it reaches: Cloudflare infra provisioned · the example pipeline running on staging · the console showing a rendered card · green checks · and it can then add a new agent with one command.

Agent-first principles.

K-1
AGENTS.md is the front door
The first file any agent reads: invariants, the ONE bootstrap command, scaffolds, the verification contract, the runbooks index. CLAUDE.md is a one-line import of it.
K-2
One idempotent bootstrap
reads .env → install → Alchemy provisions D1 · KV · R2 · Queues · Vectorize · AI Gateway · Secrets Store → migrations → config seed → deploy staging → smoke → prints the URLs. Re-runnable; `doctor` explains what is missing in agent-readable form.
K-3
Every external dependency is yours
.env.example lists each one with required/optional and what it unlocks: Cloudflare token + account (required — your account), model keys (optional; Workers AI default), Langfuse, Tavily, MCP tokens. The kit owns no accounts and points at none of ours.
K-4
Scaffolds, not file archaeology
npm run new:agent <name> · new:consumer · new:page · new:port — deterministic output, each prints its follow-up checklist.
K-5
Verification contracts
npm run check (typecheck + tests + lint + secret-scan) and npm run smoke (deployed endpoints). CI runs exactly these; "done" = both green.
K-6
Task runbooks
tasks/*.md with frontmatter: add an agent, add a tool, add a queue stage, add a console page, switch a role to OpenAI, deploy prod — goal, files, acceptance criteria.
K-7
Safety rails
.env*/.dev.vars/.mcp.json gitignored from day one; pre-commit + CI secret scan; doctor refuses prod without --prod --i-know; keys never in tracked files.
K-8
MCP-ready
.mcp.json.example for the Cloudflare + GitHub servers; AGENTS.md says which MCP to prefer for which job.
K-9
Runs without the cloud
npm run dev = the local mesh (wrangler dev per worker, optional compose, stub renderer/embedder) — see the pipeline move with no keys.
K-10
Generated, never hand-forked
scripts/export-starter.mjs in this monorepo (allow-list + transforms) → the public repo. Its CI proves the promise without any owned account: check · bootstrap --dry-run · a local end-to-end on workerd.

Go deeper

In the repo

scripts/export-starter.mjs (allow-list + transforms)
packages/agent-kernel · packages/shared · packages/config · packages/rbac (what ships)
infra/ (Alchemy, account-pinned) · the console shell · the CI workflows