Consolidate examples and demos into integrations

.clusterfuzzlite/build.sh

@@ -21,3 +21,7 @@ PYI_ARGS=(--collect-submodules=email)
 for target in "$SRC"/integrations/.clusterfuzzlite/fuzz_*.py; do
   compile_python_fuzzer "$target" "${PYI_ARGS[@]}"
 done
+
+# Build the imported suites from the same checkout. Each keeps its reviewed lock.
+bash "$SRC/integrations/examples/.clusterfuzzlite/build.sh"
+bash "$SRC/integrations/demos/.clusterfuzzlite/build.sh"

.gitattributes

@@ -4,3 +4,7 @@ integrations/aeoess-aps/fixtures/action-receipt/*.json text eol=lf
 
 # Registry bytes; the tests check them against the digests Docker Hub serves.
 integrations/docker-sandbox-kit/fixtures/*.json -text
+
+# Imported JSON includes signed evidence and captured audit records.
+examples/**/*.json -text
+demos/**/*.json -text

.github/CODEOWNERS

@@ -1 +1,7 @@
 * @imran-siddique @carloshvp @agentrust-io/maintainers
+
+# Reviewed first-party scenarios and demonstrations.
+/examples/ @imran-siddique @carloshvp @agentrust-io/maintainers
+/demos/ @imran-siddique @pforest @podcastinator @Qiang-Xu @agentrust-io/maintainers
+/.github/workflows/examples-* @imran-siddique @carloshvp @agentrust-io/maintainers
+/.github/workflows/demos-* @imran-siddique @pforest @podcastinator @Qiang-Xu @agentrust-io/maintainers

.github/dependabot.yml

@@ -34,3 +34,16 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 10
+
+  - package-ecosystem: "pip"
+    directories:
+      - "/examples"
+      - "/demos"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"

.github/workflows/cflite_pr.yml

@@ -3,6 +3,8 @@ name: ClusterFuzzLite PR
 on:
   pull_request:
     paths:
+      - "examples/**"
+      - "demos/**"
       - 'packages/agentrust-capture-core/src/**'
       - 'packages/agentrust-trace-adapters/src/**'
       - '.clusterfuzzlite/**'

.github/workflows/demos-ci.yml

@@ -0,0 +1,81 @@
+name: Demos
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  CMCP_DEV_MODE: "1"
+  CMCP_BEARER_TOKEN: demo-token
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    working-directory: demos
+
+jobs:
+  demos:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+
+      # requirements.txt holds the floors for cmcp-runtime (demos 1-5) and
+      # weight-custody-manifest (demos 6-9); installing cmcp-runtime alone once
+      # left the WCM demos unrunnable. requirements/ci.txt is that file plus
+      # pytest and httpx, resolved and hash-locked, so CI installs exactly what
+      # was reviewed.
+      - name: Install demo dependencies
+        run: pip install --require-hashes -r requirements/ci.txt
+
+      - name: Validate shared financial-services example
+        run: |
+          test -f ../examples/financial-services/catalog.json
+          test -f ../examples/financial-services/policy/allow.cedar
+          python -m py_compile web-console/run.py web-console/webserver.py web-console/policy_variants.py
+
+      # Static checks first: they need no ports and fail in under a second.
+      # test_catalog_definition_drift catches a catalog that no longer matches
+      # its upstream server, which the gateway treats as a rug pull and denies.
+      - name: Tests
+        run: python -m pytest tests/ -q
+
+      # Run in order: demo-01 produces workspace/trace-claim.json, which
+      # demo-02 and demo-03 consume.
+      - name: Demo 1 - cMCP in action
+        run: python demo-01-cmcp-in-action/run.py
+
+      - name: Demo 2 - policy swap
+        run: python demo-02-policy-swap/run.py
+
+      - name: Demo 3 - offline TRACE verification
+        run: python demo-03-offline-trace/run.py
+
+      - name: Demo 4 - context-aware enforcement
+        run: python demo-04-context-enforcement/run.py
+
+      - name: Demo 5 - attribute-based enforcement (BAA coverage)
+        run: python demo-05-compliance-domain/run.py
+
+      # Demos 6-9 are offline: no gateway, no ports, no MCP server.
+      - name: Demos 6-9 - weight custody
+        run: |
+          for d in demo-06-weight-custody demo-07-closed-weight                    demo-08-derivative-lineage demo-09-sovereign-threshold; do
+            echo "== $d =="
+            python "$d/run.py"
+          done
+
+      - name: Demo 10 - governed model calls
+        run: python demo-10-model-gateway/run.py

.github/workflows/examples-ci.yml

@@ -0,0 +1,227 @@
+name: Examples
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    working-directory: examples
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Validate JSON files
+        run: |
+          find . -name "*.json" -not -path "./.git/*" | while read -r f; do
+            python3 -m json.tool "$f" > /dev/null && echo "OK: $f" || exit 1
+          done
+      - name: Validate YAML files
+        run: |
+          pip install -q --require-hashes -r requirements/yaml-lint.txt
+          find . -name "*.yaml" -o -name "*.yml" | grep -v ".git" | while read -r f; do
+            python3 -c "import yaml, sys; yaml.safe_load(open(sys.argv[1]))" "$f" && echo "OK: $f" || exit 1
+          done
+
+  financial-services:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: examples/financial-services
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+
+      - name: Run credit engine tests
+        run: python -m unittest discover -s tests -v
+
+  agentic-commerce-accountability:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: examples/agentic-commerce-accountability
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+
+      - name: Run accountability tests
+        run: python -m unittest discover -s tests -v
+
+      - name: Regenerate and compare committed fixtures
+        run: |
+          python generate_fixtures.py
+          git diff --exit-code -- fixtures
+
+  released-ucp-accountability:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Build the locked released-UCP verification image
+        run: >-
+          docker build --no-cache --tag released-ucp-accountability:ci
+          agentic-commerce-accountability/released_ucp
+
+      - name: Run the demo and checks without network or elevated privileges
+        run: >-
+          docker run --rm --network none --read-only --cap-drop ALL
+          --security-opt no-new-privileges --pids-limit 128
+          --memory 1g --cpus 2 --tmpfs /tmp:rw,nosuid,nodev,size=256m
+          released-ucp-accountability:ci
+
+  industrial-embodied-ai:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: examples/industrial-embodied-ai
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+          cache: "pip"
+          cache-dependency-path: examples/industrial-embodied-ai/requirements.txt
+
+      - name: Install controller test dependencies
+        run: python -m pip install --require-hashes -r ../requirements/controller-tests.txt
+
+      - name: Run controller tests
+        run: python -m unittest discover -s tests -v
+
+      - name: Install artifact validation dependencies
+        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
+        run: python -m pip install -r requirements.txt
+
+      - name: Verify committed evidence artifacts
+        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
+        run: python validate_artifacts.py
+
+  healthcare:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: examples/healthcare
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+
+      - name: Run clinical engine tests
+        run: python -m unittest discover -s tests -v
+
+  embodied-action-receipts:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: examples/embodied-action-receipts
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+          cache: "pip"
+          cache-dependency-path: examples/requirements/receipts-tests.txt
+
+      - name: Install dependencies
+        # The job cwd is embodied-action-receipts (defaults above), so the
+        # lock is one level up.
+        run: python -m pip install --require-hashes -r ../requirements/receipts-tests.txt
+
+      - name: Verify embodied-action receipt fixtures
+        run: python -m unittest discover -s tests -v
+
+  multi-tenant-saas:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: examples/multi-tenant-saas
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+
+      - name: Run people directory tests
+        run: python -m unittest discover -s tests -v
+
+  ca2a-delegation:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: examples/ca2a-delegation
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+
+      - name: Install cA2A runtime (pre-release)
+        run: python -m pip install --pre ca2a-runtime
+
+      - name: Run delegation tests
+        run: python -m unittest discover -s tests -v
+
+      - name: Run the delegation demo
+        run: python delegation_agent.py
+
+  weight-custody-manifest:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: examples/weight-custody-manifest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+
+      - name: Install the WCM SDK from PyPI
+        run: python -m pip install -r requirements.txt
+
+      # One runner, discovered rather than listed, so a new demo is covered the
+      # day it lands. The list lived in this file and in nobody else's reach,
+      # which is why the SDK repository could not run these before cutting a
+      # release. It now calls the same script; see run_demos.py.
+      - name: Install the model-signing extra the provenance demo needs
+        # The runner is pinned; the SDK these demos exercise stays resolved
+        # from PyPI, which is what makes them a check on the release.
+        run: |
+          python -m pip install --require-hashes -r ../requirements/wcm-harness.txt
+          python -m pip install "weight-custody-manifest[model-signing]>=0.27.0"
+
+      - name: Run every offline demo and the unit tests
+        run: python run_demos.py