diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..54367a7
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,38 @@
+name: Demos
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  CMCP_DEV_MODE: "1"
+  CMCP_BEARER_TOKEN: demo-token
+
+jobs:
+  demos:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install cmcp-runtime
+        run: pip install cmcp-runtime
+
+      # Run in order: demo-01 produces workspace/trace-claim.json, which
+      # demo-02 and demo-03 consume.
+      - name: Demo 1 - cMCP in action
+        run: python demo-01-cmcp-in-action/run.py
+
+      - name: Demo 2 - policy swap
+        run: python demo-02-policy-swap/run.py
+
+      - name: Demo 3 - offline TRACE verification
+        run: python demo-03-offline-trace/run.py
diff --git a/demo-03-offline-trace/verify.py b/demo-03-offline-trace/verify.py
index 493fb1f..73a9988 100644
--- a/demo-03-offline-trace/verify.py
+++ b/demo-03-offline-trace/verify.py
@@ -68,6 +68,11 @@ def main():
     print(sep)
     print()
 
+    dev_mode_only = (
+        set(result.unverified_fields) == {"hardware_attestation"}
+        and not result.failure_reason
+    )
+
     if result.status.value == "verified":
         print("All cryptographic checks passed.")
         print()
@@ -75,6 +80,14 @@ def main():
         print("uses a software-only TEE. On real Intel TDX or AMD SEV-SNP, it would")
         print("also be verified and status would remain 'verified' with full hardware")
         print("provenance.")
+    elif result.status.value == "partially_verified" and dev_mode_only:
+        # Expected outcome under CMCP_DEV_MODE=1: every cryptographic check passes
+        # and only hardware_attestation is unverified because there is no real TEE.
+        print("All cryptographic checks passed.")
+        print()
+        print("Status is 'partially_verified' because CMCP_DEV_MODE=1 uses a software-only")
+        print("TEE, so 'hardware_attestation' cannot be verified. On real Intel TDX or AMD")
+        print("SEV-SNP, that field is verified too and the status becomes 'verified'.")
     elif result.status.value == "partially_verified":
         print(f"Partial verification. Failure: {result.failure_reason}")
         sys.exit(1)