Run the Forge Agent Builder Workshop

A 2-hour, copy-paste guide to ship a live, governed AI agent — built on the open Agent Skills standard — onto a real Kubernetes cluster with egress control, guardrails, and audit. Attend the next one or run your own.

Wednesday, June 24, 2026 at 5:00 PM EDT
Tech North Atlanta · Alpharetta
Register on Luma

What you'll build

A hands-on workshop where attendees take a SKILL.md (the open Agent Skills standard) and ship a live, governed AI agent onto a real Kubernetes cluster — with egress control, guardrails, and audit built in. For platform engineers, SREs, AI engineers, and security/governance teams.

Prerequisites

Attendee brings

  • Laptop with Docker and kubectl
  • Forge pre-installed (`brew install initializ/tap/forge` or the curl installer)

Organizer provides

  • A Kubernetes cluster with a namespace per attendee
  • LLM API keys to hand out
  • A pre-seeded failing workload for triage

What the organizer provides

  • Cluster access + LLM keys per attendee
  • A seeded incident (e.g., a CrashLoopBackOff pod)
  • This guide

Agenda

Two hours · 3 hands-on segments · 3 talks

  1. 01 Talk 10 min

    Welcome & setup

    Zero environment friction before the clock starts.
  2. 02 Talk 15 min

    What is Forge

    Standard → runtime → trust layer; deployment locus; preview egress / guardrails / audit.
  3. 03 Hands-on 15 min

    Install & first run (codegen-html)

    A running agent in 15 minutes.
  4. 04 Hands-on 30 min

    Forge UI + Weather skill via Skill Builder

    Author a governed skill from scratch.
  5. 05 Hands-on 35 min

    Build, deploy & run K8s Incident Triage

    An audited agent doing real ops work inside your boundary.
  6. 06 Talk 15 min

    Networking & close

    Recap, CTAs, Q&A.
01 Talk · 10 min

Welcome & setup

Confirm `forge version` on arrival. Hand out KUBECONFIG + LLM keys. Make sure every attendee has Docker running and kubectl reachable.

02 Talk · 15 min

What is Forge

Agent Skills (SKILL.md) is the open format; Forge is the open-source runtime; Forge Hub is the trust layer. Thesis: a SKILL.md compiles to a portable, secure container that runs in *your* VPC/cluster, not a vendor's runtime. Name the three primitives they'll see live: egress allowlists, guardrails, NDJSON audit.

03 Hands-on · 15 min

Install & first run (codegen-html)

A running agent in 15 minutes. Install Forge, scaffold from an embedded skill, run it locally, ask it to do real work.

1

Install Forge (skip if pre-installed).

brew install initializ/tap/forge

Expected: `forge version` prints a version.

2

Scaffold a new project — `forge init` opens a TUI that lists every embedded skill. Choose the codegen-html skill.

forge init

Expected: Project with `forge.yaml`, `.env`, `SKILL.md`, `guardrails.json`.

3

Run it (dev A2A server, hot reload).

forge run

Expected: A local endpoint prints; agent is live.

4

Open the local chat; ask it to scaffold a simple HTML page; open the result.

Outcome: A running agent that produced a working HTML app.

04 Hands-on · 30 min

Forge UI + Weather skill on open-meteo (Skill Builder)

Author a governed Agent Skill from scratch using the Skill Builder UI (not by hand-writing SKILL.md). Call open-meteo, which is keyless on purpose — no API-key friction in a room.

1

Launch the dashboard.

forge ui

Expected: http://localhost:4200

2

Open your agent → Skill Builder. Prompt it to create a weather skill calling `https://api.open-meteo.com` (keyless) with `curl` + `jq`, taking latitude/longitude (optionally `geocoding-api.open-meteo.com` for city names).

3

Validate, then Save.

Expected: Save reports the egress domain auto-added (env/egress injection on save); `api.open-meteo.com` is now in the allowlist.

4

Run the agent; ask for weather at a location.

Outcome: Attendees authored a governed Agent Skill via Skill Builder.

05 Hands-on · 35 min

Build, deploy & run K8s Incident Triage

The headline segment. Package an embedded skill, read the generated egress allowlist and NetworkPolicy aloud, deploy to a real cluster, trigger a seeded incident, watch the audit log, and watch a guardrail block a sensitive command.

1

Scaffold a fresh project in a new directory — `forge init` opens the TUI skill picker. Choose the k8s-incident-triage skill.

forge init
2

Produce container + manifests + egress artifacts.

forge package --prod --registry <your-registry> --tag forge-triage:demo

Expected: `.forge-output/` has the Dockerfile, K8s manifests, `egress_allowlist.json`, and a `NetworkPolicy`.

3

Open `egress_allowlist.json` and the `NetworkPolicy` and read them aloud — egress restricted to declared domains (incl. cluster API) on 80/443. *(security money-shot.)*

4

Provide creds.

export KUBECONFIG="$(cat ~/.kube/config)"
5

Deploy.

kubectl apply -f .forge-output/k8s/

Expected: Agent pod Running; NetworkPolicy applied.

6

Trigger the seeded incident (CrashLoopBackOff pod); ask the agent to triage.

Expected: It inspects the cluster via `kubectl` and returns a structured triage.

7

Inspect the NDJSON audit log — one line per event, metadata-only by default, correlation-threaded.

8

Show a guardrail blocking a sensitive command (e.g., `kubectl get secrets`).

Outcome: An audited agent doing real ops work inside your boundary.

06 Talk · 15 min

Networking & close

Recap the three primitives (egress allowlists, guardrails, NDJSON audit); CTAs (Forge OSS repo, Forge Hub, useforge.ai); Q&A; networking.

Facilitator kit

Checkpoints

  • Talks end by :25.
  • First hands-on agent by :40.
  • Skill Builder save by ~:10 past.
  • Triage deployed by ~:40 past.

Room setup

  • Pre-provision a namespace per attendee.
  • Pre-seed the failing workload.
  • Hand out KUBECONFIG + LLM keys at the door.
  • Confirm forge version on arrival.

Fallback

  • If pace varies, switch the triage deploy to facilitator-led "deploy alongside
me" on a shared screen.

Run your own

Add a new `src/content/events/*.yaml` entry: set your date, venue, and
registration URL, keep `playbook: forge-agent-builder`. Bring your own cluster
and LLM keys (or a managed sandbox). The playbook body stays identical — that's
the point.

Fork the instance YAML

Install Forge

Get started in minutes — install the CLI and ship your first agent.

brew install initializ/tap/forge
Quickstart View on GitHub