From cf5b8f36b994b2257e96f63dcffe974b9a915f69 Mon Sep 17 00:00:00 2001 From: Imran Siddique <45405841+imran-siddique@users.noreply.github.com> Date: Tue, 7 Jul 2026 16:45:33 -0700 Subject: [PATCH 1/2] fix(demo-03): treat software-only partial verification as demo success Under CMCP_DEV_MODE=1 (the documented way to run the demos) verify_trace_claim returns partially_verified because hardware_attestation cannot be verified without a real TEE. verify.py exited 1 on that, so run.py (check=True) crashed the offline-verification demo on its own expected output. Treat the dev-mode case (only hardware_attestation unverified, no failure reason) as success while keeping fail-closed behaviour for real partial/failed verification. Co-Authored-By: Claude Opus 4.8 (1M context) --- demo-03-offline-trace/verify.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/demo-03-offline-trace/verify.py b/demo-03-offline-trace/verify.py index 493fb1f..73a9988 100644 --- a/demo-03-offline-trace/verify.py +++ b/demo-03-offline-trace/verify.py @@ -68,6 +68,11 @@ def main(): print(sep) print() + dev_mode_only = ( + set(result.unverified_fields) == {"hardware_attestation"} + and not result.failure_reason + ) + if result.status.value == "verified": print("All cryptographic checks passed.") print() @@ -75,6 +80,14 @@ def main(): print("uses a software-only TEE. On real Intel TDX or AMD SEV-SNP, it would") print("also be verified and status would remain 'verified' with full hardware") print("provenance.") + elif result.status.value == "partially_verified" and dev_mode_only: + # Expected outcome under CMCP_DEV_MODE=1: every cryptographic check passes + # and only hardware_attestation is unverified because there is no real TEE. + print("All cryptographic checks passed.") + print() + print("Status is 'partially_verified' because CMCP_DEV_MODE=1 uses a software-only") + print("TEE, so 'hardware_attestation' cannot be verified. On real Intel TDX or AMD") + print("SEV-SNP, that field is verified too and the status becomes 'verified'.") elif result.status.value == "partially_verified": print(f"Partial verification. Failure: {result.failure_reason}") sys.exit(1) From edf9f49e2d15d126a6a7fe849fb813cc7f1a2983 Mon Sep 17 00:00:00 2001 From: Imran Siddique <45405841+imran-siddique@users.noreply.github.com> Date: Tue, 7 Jul 2026 16:45:34 -0700 Subject: [PATCH 2/2] ci: run all three demos end-to-end on push/PR The demos repo had no CI, so nothing verified the public quickstart demos (a dependency bump could break them silently). Runs demo-01..03 in order (demo-01 produces the claim demo-02/03 consume) under CMCP_DEV_MODE=1. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci.yml | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..54367a7 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,38 @@ +name: Demos + +on: + push: + branches: [main] + pull_request: + branches: [main] + workflow_dispatch: + +env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" + CMCP_DEV_MODE: "1" + CMCP_BEARER_TOKEN: demo-token + +jobs: + demos: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Set up Python 3.11 + uses: actions/setup-python@v5 + with: + python-version: "3.11" + + - name: Install cmcp-runtime + run: pip install cmcp-runtime + + # Run in order: demo-01 produces workspace/trace-claim.json, which + # demo-02 and demo-03 consume. + - name: Demo 1 - cMCP in action + run: python demo-01-cmcp-in-action/run.py + + - name: Demo 2 - policy swap + run: python demo-02-policy-swap/run.py + + - name: Demo 3 - offline TRACE verification + run: python demo-03-offline-trace/run.py