From 0bc9af9591f8312a9ab97ba116f8123b7fddb38d Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Thu, 20 Aug 2026 20:45:15 -0700 Subject: [PATCH] Show what the demos and the quickstart actually print Both pages describe outcomes in prose and never show the output. For pages whose whole pitch is "don't take the spec on trust, run it", the output is the argument. I ran the published quickstart end to end against cmcp-runtime 0.4.0 and demo 6 against weight-custody-manifest 0.25.0. Both do exactly what the pages say, so nothing here corrects a claim about behaviour. What changes is that a reader can now see it before they install anything. Quickstart: - Step 4 shows the response body the runtime really returns, replacing a one-line prose summary of it. - That body carries a call_id, and the same id lands in the audit chain, which is the thread from the block in step 4 to the signed record in step 5. The page never mentioned it, and it is the point. - Step 5 shows the CRYPTO-001 advisory the CLI prints before the checks. It is not a failure, but it is the first thing on screen and the page did not prepare anyone for it. - Says which version the page was last verified against, and that a step not behaving as written is a bug worth reporting. Demos: - The governance section said "these five govern the tool boundary" above six cards. Demo 10 is in that section and governs model calls, not the tool boundary. - The card times sum to thirteen minutes, not twelve. Fixed in the hero and in the meta, OG and Twitter descriptions. - Dropped export CMCP_BEARER_TOKEN from the quick start: demo.py sets it, as the repo README says. Added --no-pause, without which the runner waits for a keypress before every demo. - Added demo 6's verbatim output. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_013EQx4N5BzTQbY8kvXUsdkY --- demos/index.html | 35 ++++++++++++++++++++++++++++------- quickstart/index.html | 20 ++++++++++++++++---- 2 files changed, 44 insertions(+), 11 deletions(-) diff --git a/demos/index.html b/demos/index.html index 7906c5a..570b858 100644 --- a/demos/index.html +++ b/demos/index.html @@ -4,7 +4,7 @@ Model Weight Protection and Agent Governance Demos | AgenTrust - + @@ -12,7 +12,7 @@ - + @@ -23,7 +23,7 @@ - + @@ -49,7 +49,7 @@
Runnable demos

Don't take the spec
on trust. Run it.

-

Ten demos, about twelve minutes end to end. Four cover custody of model weights. Five govern what an agent does at the tool boundary. One governs model calls through an OpenAI-compatible endpoint.

+

Ten demos, about thirteen minutes end to end. Four cover custody of model weights. Five govern what an agent does at the tool boundary. One governs model calls through an OpenAI-compatible endpoint.

Software mode · CMCP_DEV_MODE=1 · no special hardware
@@ -63,11 +63,32 @@

Clone it and run all ten

Terminal
git clone https://github.com/agentrust-io/demos && cd demos
 pip install -r requirements.txt
-export CMCP_BEARER_TOKEN=demo-token
 python demo.py            # all ten, pausing before each
+python demo.py --no-pause # straight through, no prompts
 python demo.py 6          # just demo 6
-

The requirements install cMCP for demos 1 to 5, Weight Custody Manifest for demos 6 to 9, and the OpenAI client for demo 10. Source: github.com/agentrust-io/demos.

+

The requirements install cMCP for demos 1 to 5, Weight Custody Manifest for demos 6 to 9, and the OpenAI client for demo 10. demo.py sets dev mode and the bearer token for you, so there is nothing to export. Source: github.com/agentrust-io/demos.

+ +

What demo 6 actually prints, verbatim from a run on weight-custody-manifest 0.25.0

+
+
python demo-06-weight-custody/run.py
+
+
Weight Custody Manifest: possession is not provenance.
Real WCM code with a software (mock) attestation provider, no hardware.
+
1. The builder signs a manifest binding the exact weight hash
+
weights_hash bound : sha256:99b3e4e724d0aa75528b5b2214…
+
manifest signature : True (jointly signed builder + custodian)
+
2. Attestation gate: the key releases only into the certified stack
+
gate released key  : True
+
3. A tampered checkpoint fails before it ever loads
+
certified hash     : sha256:99b3e4e724d0aa75528b5b2214…
downloaded hash    : sha256:b3a36b547da3babd1dc9f2b900…
+
matches manifest   : False -> REFUSE to load
+
no human reads 2.8T parameters; the hash does the reading.
+
4. The fine-tune is the real IP: lineage back to the signed base
+
lineage verified   : True  depth 1  root is a base: True
+
honest scope       : accountability-grade against an operator who physically
                      owns the silicon (see TEE.fail), not silicon-proof custody.
+
+
+

Hashes are truncated here for width; the run prints them in full. Every demo ends with a scope statement like that last one.

@@ -133,7 +154,7 @@

Securing model weights

Agent governance

Governing what an agent does

-

Demos 6 to 9 protect the weights. These five govern the tool boundary: what the agent is allowed to call, under which workflow, with what compliance attributes, and what evidence survives afterwards. Cedar policy is enforced on every call and each session closes with a signed TRACE claim.

+

Demos 6 to 9 protect the weights. These six put the policy at the boundary the agent has to cross: five at the tool call, and demo 10 at the model call. What is it allowed to invoke, under which workflow, with what compliance attributes, and what evidence survives afterwards. Cedar is enforced on every call and each session closes with a signed TRACE claim.

diff --git a/quickstart/index.html b/quickstart/index.html index 4b6275b..f8b14d2 100644 --- a/quickstart/index.html +++ b/quickstart/index.html @@ -135,6 +135,7 @@

The quickstart

Before you start. Python 3.11+ · pip · macOS or Linux · two terminal windows · about ten minutes · no special hardware.

+

Every command and every output on this page was last run end to end against cmcp-runtime 0.4.0 on 20 August 2026. If a step does not do what it says here, that is a bug and worth reporting.

@@ -271,10 +272,17 @@

Fire a bad action, watch it get blocked

}'

workflow_id is the only field the runtime reads out of _cmcp. The session id is a label for your own logs: the runtime mints its own session id, which is why step 5 looks it up instead of assuming it.

+
+
what the runtime returns
+
+
HTTP/1.1 403 Forbidden
content-type: application/json
+
{"jsonrpc":"2.0","error":{"code":-32000,
  "message":"Request denied by policy",
  "data":{"error_code":"POLICY_DENY",
    "call_id":"51da9a46-149f-40c4-b83f-82d48fd654bd"}},"id":2}
+
+
-
✓ What you'll see — 403 Forbidden
-

Your policy stops a PII record from leaving on a tool call, before it reaches Salesforce, decided by the rule you wrote, enforced where the agent can't tamper with it. That's the barrier most teams can't cross today: shipping an agent you can actually prove is governed.

-

HTTP/1.1 403 Forbidden · "message": "Request denied by policy" · "error_code": "POLICY_DENY"

+
✓ What just happened
+

Your policy stopped a PII record from leaving on a tool call, before it reached Salesforce, decided by the rule you wrote, enforced where the agent can't tamper with it. That's the barrier most teams can't cross today: shipping an agent you can actually prove is governed.

+

Keep an eye on that call_id. The same id lands in the audit chain, so the deny you just watched is the deny you can hand to someone else in step 5. A refusal nobody can check afterwards is just a log line.

@@ -291,7 +299,11 @@

Walk away with proof

curl -s -X POST "http://localhost:8443/sessions/$SID/close" | python3 -m json.tool > claim.json cmcp verify claim.json -

Expected output in dev mode:

+

Expected output in dev mode. The CRYPTO-001 line comes first and is an advisory, not a failure: it is the CLI saying up front that a software-mode key binding proves nothing about hardware.

+
+
cmcp verify claim.json
+
CRYPTO-001: software-only (dev) mode -- TEE key binding cannot be
verified; this claim provides no hardware provenance guarantee
+
schemaPASS ✓
signaturePASS ✓