[CC Summit Jun 23] Demo blockers — intercept calls, enforce Cedar policy, produce TRACE Claim

[imran-siddique]

Goal

Minimum viable demo for CC Summit (June 23, 2026): the gateway intercepts MCP tool calls, enforces a Cedar policy, and produces a signed TRACE Claim that a verifier can inspect in real time.

The full Phase 1 GA roadmap is tracked in #97. This issue covers only the sub-issues that must be done before June 23.

---

CC Summit scope

bootstrap

• [bootstrap] Project layout, packaging, and CI skeleton #57 [bootstrap] Project layout, packaging, and CI skeleton
• [bootstrap] Configuration parser — cmcp-config.yaml #64 [bootstrap] Configuration parser — cmcp-config.yaml
• [bootstrap] Dev mode — software-only attestation stub for CI and local development #72 [bootstrap] Dev mode — software-only attestation stub

mcp

• [mcp] HTTP/SSE inbound server — agent-facing MCP endpoint #48 [mcp] HTTP/SSE inbound server — agent-facing endpoint
• [mcp] HTTP/SSE outbound client — upstream MCP server connections #53 [mcp] HTTP/SSE outbound client — upstream MCP servers
• [mcp] JSON-RPC 2.0 routing — dispatch calls from agent to upstream #54 [mcp] JSON-RPC 2.0 routing

policy

• [policy] Cedar policy bundle loading and hash verification #63 [policy] Cedar policy bundle loading and hash verification
• [policy] Cedar policy evaluation — per-call authorization #68 [policy] Cedar policy evaluation — per-call authorization
• [policy] Enforcement modes — enforcing, advisory, silent #73 [policy] Enforcement modes — enforcing, advisory, silent

audit + trace-claim

• [audit] Ed25519 key generation and sealing inside TEE #46 [audit] Ed25519 key generation and sealing inside TEE
• [audit] Audit chain entry format and SHA-256 hash chaining #47 [audit] Audit chain entry format and SHA-256 hash chaining
• [audit] TRACE Claim generation #49 [audit] TRACE Claim generation
• [audit] TRACE Claim canonical serialization and Ed25519 signing #50 [audit] TRACE Claim canonical serialization and signing
• [audit] TRACE Claim JSON Schema validation #52 [audit] TRACE Claim JSON Schema validation

assembly

• [assembly] Gateway request pipeline — policy → forward → inspect → audit #51 [assembly] Gateway request pipeline — policy → forward → inspect → audit
• [assembly] Gateway response pipeline — inspection → session → return #56 [assembly] Gateway response pipeline — inspection → session → return
• [assembly] Session lifecycle management — create, track, close #60 [assembly] Session lifecycle management — create, track, close
• [failures] Startup failure handling — attestation, policy hash, catalog hash #66 [failures] Startup failure handling — attestation, policy hash, catalog hash
• [failures] Per-call failure handling — parse error and TEE fault #69 [failures] Per-call failure handling — parse error and TEE fault

---

Out of scope for June 23 (target: Phase 1 GA)

Everything marked *(GA)* in #97: TEE hardware providers, SPIFFE, full inspection pipeline, session sensitivity, conformance test runner, soak test, Docker, CLI.

---

Done criteria

A live demo session where:

1. An agent sends an MCP tool call through the gateway
2. Cedar policy evaluates and either allows or denies it
3. The gateway returns a signed TRACE Claim
4. A verifier CLI (cmcp-verify) prints VALID and shows the policy bundle hash and chain root

[imran-siddique]

All 19 CC Summit demo blocker sub-issues are closed. The gateway intercepts calls, enforces Cedar policy, and produces signed TRACE Claims. CC Summit (Jun 23) scope complete.