feat(demos): WCM talk-track demos 07-09 (closed, lineage, threshold)

README.md

@@ -1,6 +1,6 @@
 # agentrust-io demos
 
-Runnable demos for [cMCP](https://github.com/agentrust-io/cmcp), [TRACE](https://github.com/agentrust-io/trace-spec), and [WCM](https://pypi.org/project/weight-custody-manifest/). Six demos, ~7 minutes total.
+Runnable demos for [cMCP](https://github.com/agentrust-io/cmcp), [TRACE](https://github.com/agentrust-io/trace-spec), and [WCM](https://pypi.org/project/weight-custody-manifest/). Nine demos, ~10 minutes total.
 
 ---
 
@@ -10,7 +10,7 @@ Runnable demos for [cMCP](https://github.com/agentrust-io/cmcp), [TRACE](https:/
 pip install cmcp-runtime weight-custody-manifest
 ```
 
-`cmcp-runtime` includes all dependencies (`starlette`, `uvicorn`, `cmcp-verify`) and drives demos 1 through 5; `weight-custody-manifest` (from PyPI) drives demo 6. All demos use `CMCP_DEV_MODE=1` (software-only TEE, no hardware required). The local MCP server performs real filesystem operations on `./workspace/`.
+`cmcp-runtime` includes all dependencies (`starlette`, `uvicorn`, `cmcp-verify`) and drives demos 1 through 5; `weight-custody-manifest` (from PyPI) drives demos 6 through 9. All demos use `CMCP_DEV_MODE=1` (software-only TEE, no hardware required). The local MCP server performs real filesystem operations on `./workspace/`.
 
 ## Quick start: one command
 
@@ -158,6 +158,54 @@ What you see:
 
 ---
 
+## Demo 7 -- Closed-weight custody (~60 seconds)
+
+The mirror of demo 6. There the base was an open-weight model, so the machinery did integrity, license, and derivative custody. Here the model is **closed** (a frontier lab shipping weights into a customer's or sovereign's own enclave), so the base weights *are* the secret and the job is to keep the decryption key off the operator.
+
+```
+python demo-07-closed-weight/run.py
+```
+
+What you see:
+- a manifest with `base_confidentiality: confidential`, jointly signed by the lab and the customer
+- the decryption key releases only into the attested, lab-signed serving stack
+- an unapproved serving stack (one that could export plaintext weights) is refused the key
+- the closed-vs-open contrast spelled out: same protocol, different job
+
+---
+
+## Demo 8 -- Derivative lineage (~60 seconds)
+
+When a customer fine-tunes inside the enclave on private data, the result is novel IP that never existed publicly. WCM gives the derivative its own signed manifest with a `derived_from` pointer and a `rights_holder` split, so its chain of custody resolves back to the base.
+
+```
+python demo-08-derivative-lineage/run.py
+```
+
+What you see:
+- a base manifest permitting `fine-tune-only`, and a derivative that permits `none`
+- `verify_lineage` resolving the derivative back to the base (chain, depth, root)
+- the derivative's `rights_holder` recording the base/derivative IP split
+- monotone rights: a fork of the no-derivatives derivative is **rejected**, the base's terms travel down the chain
+
+---
+
+## Demo 9 -- Sovereign threshold (~90 seconds)
+
+For a sovereign deployment the honest limit bites hardest: a hardware owner who forges one attestation could release a key. The answer is to never let one release be enough. The model key is split **2-of-3** across independent parties, each releasing its share only against its own attestation.
+
+```
+python demo-09-sovereign-threshold/run.py
+```
+
+What you see:
+- the model key split 2-of-3 across the lab, the sovereign authority, and the customer
+- a single share reconstructs nothing (one forged attestation is below threshold)
+- two independent shareholders each attest and release their share
+- the quorum reconstructs the key, so forging it requires forging attestation to a quorum of independent roots, not one
+
+---
+
 ## Structure
 
 ```
@@ -203,7 +251,13 @@ demos/
 |   +-- run.py                  # Cross-platform launcher (use this)
 |   +-- run.sh                  # bash-only launcher
 +-- demo-06-weight-custody/
-    +-- run.py                  # WCM flow: sign, attestation gate, tamper refusal, lineage
+|   +-- run.py                  # WCM flow: sign, attestation gate, tamper refusal, lineage
++-- demo-07-closed-weight/
+|   +-- run.py                  # Closed-weight secrecy: key releases only into the attested stack
++-- demo-08-derivative-lineage/
+|   +-- run.py                  # The fine-tune is the IP: derived_from + rights split + lineage
++-- demo-09-sovereign-threshold/
+    +-- run.py                  # 2-of-3 threshold split, each share released against attestation
 ```
 
 ---

demo-07-closed-weight/run.py

@@ -0,0 +1,138 @@
+"""Demo 7: Closed-weight custody - when secrecy IS the job.
+
+Usage:
+    python demo-07-closed-weight/run.py       # from repo root
+    python run.py                              # from the demo-07 directory
+
+The counterpart to demo 6. Demo 6 ran an OPEN-weight model, where the base
+weights are public so the machinery does integrity, license, and derivative
+custody. Here the model is CLOSED (a frontier lab shipping weights into a
+customer's or sovereign's own enclave), so the base weights ARE the secret and
+the whole job is to keep the decryption key off the operator. Same protocol,
+software (mock) attestation, no hardware.
+"""
+from __future__ import annotations
+
+import hashlib
+import sys
+
+from wcm import (
+    Ed25519Signer,
+    KeyBrokerService,
+    SoftwareProvider,
+    VerificationContext,
+    WeightCustodyManifest,
+    generate_ed25519,
+    verify_manifest,
+)
+
+sys.stdout.reconfigure(line_buffering=True)
+
+
+def rule(title: str) -> None:
+    print(f"\n{'-' * 66}\n{title}\n{'-' * 66}")
+
+
+def sha256(data: bytes) -> str:
+    return "sha256:" + hashlib.sha256(data).hexdigest()
+
+
+def build_manifest(*, weights_hash: str, serving: str, builder_id: str, custodian_id: str) -> dict:
+    return {
+        "manifest_version": "0.1",
+        "weights_hash": weights_hash,
+        "builder": {"identity": builder_id, "signing_key": "ed25519:demo"},
+        "release_terms": {
+            "license": "Frontier-Model-License (confidential, field-of-use bound)",
+            "permitted_derivatives": "none",
+            "derivatives": "none",
+            "permitted_environments": ["sovereign-governed-enclave"],
+        },
+        "release_policy": {
+            "required_assurance_tier": "hardware-attested",
+            "trusted_time_source": "secure-tsc",
+            "required_hw_platform": ["amd-sev-snp", "nvidia-cc-gpu"],
+            "required_gpu_measurement": {"rim_pin": "nvidia-rim:demo-golden"},
+            "required_serving_image": {
+                "signer": "ed25519:demo",
+                "release_rule": "prefer-current",
+                "accepted_measurements": [{"measurement": serving, "status": "current"}],
+            },
+            "attestation_revocation_check": "live-per-release, max-cache-age: short-window",
+            "revocation_authority": "builder-and-opaque-joint",
+        },
+        "custody": {
+            "custodian": custodian_id,
+            "custodian_type": "customer-self-custody",
+            "kbs_image": {"measurement": sha256(b"reference-kbs-image"), "signer": "ed25519:demo"},
+            "enclave_id": "did:example:sovereign-enclave-01",
+            "attestation_cadence": "1h",
+        },
+        "base_confidentiality": "confidential",
+        "deployment_model": "builder-to-customer",
+    }
+
+
+def sign(manifest: WeightCustodyManifest, keypair, role: str, signer: str) -> dict:
+    return Ed25519Signer(keypair).sign(manifest.unsigned_dict(), role=role, signer=signer)
+
+
+def _evidence(kbs: KeyBrokerService, serving: str):
+    challenge = kbs.issue_challenge()
+    return SoftwareProvider().produce(
+        challenge, serving_image_measurement=serving, gpu_measurement="nvidia-rim:demo-golden"
+    )
+
+
+def main() -> None:
+    print("Closed-weight custody: the weights are the secret. Keep the key off the operator.")
+    print("Real WCM code with a software (mock) attestation provider, no hardware.")
+
+    builder = generate_ed25519()     # the frontier lab
+    custodian = generate_ed25519()   # the deploying customer / sovereign
+
+    weights_hash = sha256(b"<the confidential frontier model weights>")
+    serving = sha256(b"trusted-serving-stack + no-raw-weight-export-path")
+
+    rule("1. The lab ships CLOSED weights and signs the release policy")
+    doc = build_manifest(
+        weights_hash=weights_hash, serving=serving,
+        builder_id="frontier-labs", custodian_id="sovereign-customer",
+    )
+    manifest = WeightCustodyManifest.model_validate(doc)
+    manifest = manifest.with_signatures([
+        sign(manifest, builder, "builder", "frontier-labs"),
+        sign(manifest, custodian, "custodian", "sovereign-customer"),
+    ])
+    ctx = VerificationContext()
+    ctx.add_key(builder.public_bytes)
+    ctx.add_key(custodian.public_bytes)
+    result = verify_manifest(manifest, ctx)
+    print("base_confidentiality:", manifest.base_confidentiality.value, "(the weights are secret)")
+    print("manifest signature  :", result.ok, "(jointly signed lab + customer)")
+
+    rule("2. The key releases ONLY into the attested, lab-signed enclave")
+    kbs = KeyBrokerService({weights_hash: b"the-model-decryption-key"})
+    released = kbs.verify_and_release(manifest, _evidence(kbs, serving)).released
+    print("approved enclave    : key released =", released)
+    print("-> the weights decrypt only inside the measured stack, never on the host.")
+
+    rule("3. An unapproved serving stack gets nothing")
+    tampered_serving = sha256(b"a modified serving stack with a raw-weight export path")
+    denied = kbs.verify_and_release(manifest, _evidence(kbs, tampered_serving))
+    print("unapproved enclave  : key released =", denied.released)
+    print("why                 :", next(c.detail for c in denied.failures))
+    print("-> a stack that could exfiltrate plaintext weights never receives the key.")
+
+    rule("Closed vs open: same protocol, different job")
+    print("closed model (here): the base weights ARE the secret; the job is secrecy.")
+    print("open model (demo 6): the base is public; the same steps do integrity,")
+    print("                     license, and derivative custody instead.")
+    print("honest scope       : cost, detection, and mandatory physical hardening")
+    print("                     against a hardware owner who can lift keys (TEE.fail),")
+    print("                     not silicon-proof custody. That is why the sovereign")
+    print("                     profile adds a threshold split (demo 9).")
+
+
+if __name__ == "__main__":
+    main()

demo-08-derivative-lineage/run.py

@@ -0,0 +1,146 @@
+"""Demo 8: Derivative lineage - the fine-tune is the real IP.
+
+Usage:
+    python demo-08-derivative-lineage/run.py   # from repo root
+    python run.py                               # from the demo-08 directory
+
+When a customer fine-tunes a model inside the enclave on its own private data,
+the result is novel IP that never existed publicly. WCM gives that derivative its
+own signed manifest with a `derived_from` pointer and a `rights_holder` split, so
+its whole chain of custody resolves back to the base, and the base's rules travel
+down the chain. Software (mock) attestation, no hardware.
+"""
+from __future__ import annotations
+
+import hashlib
+import sys
+
+from wcm import (
+    Ed25519Signer,
+    WeightCustodyManifest,
+    generate_ed25519,
+    is_root,
+    verify_lineage,
+)
+
+sys.stdout.reconfigure(line_buffering=True)
+
+
+def rule(title: str) -> None:
+    print(f"\n{'-' * 66}\n{title}\n{'-' * 66}")
+
+
+def sha256(data: bytes) -> str:
+    return "sha256:" + hashlib.sha256(data).hexdigest()
+
+
+def build_manifest(
+    *,
+    weights_hash: str,
+    org: str,
+    derivatives: str,
+    derived_from: str | None = None,
+    rights_holder: dict | None = None,
+) -> dict:
+    m: dict = {
+        "manifest_version": "0.1",
+        "weights_hash": weights_hash,
+        "builder": {"identity": org, "signing_key": "ed25519:demo"},
+        "release_terms": {
+            "license": "Frontier-Model-License",
+            "permitted_derivatives": "fine-tune-only",
+            "derivatives": derivatives,
+            "permitted_environments": ["enterprise-governed-enclave"],
+        },
+        "release_policy": {
+            "required_assurance_tier": "hardware-attested",
+            "trusted_time_source": "secure-tsc",
+            "required_hw_platform": ["amd-sev-snp", "nvidia-cc-gpu"],
+            "required_gpu_measurement": {"rim_pin": "nvidia-rim:demo-golden"},
+            "required_serving_image": {
+                "signer": "ed25519:demo",
+                "release_rule": "prefer-current",
+                "accepted_measurements": [{"measurement": sha256(b"serving"), "status": "current"}],
+            },
+            "attestation_revocation_check": "live-per-release, max-cache-age: short-window",
+            "revocation_authority": "builder-and-opaque-joint",
+        },
+        "custody": {
+            "custodian": org,
+            "custodian_type": "customer-self-custody",
+            "kbs_image": {"measurement": sha256(b"reference-kbs-image"), "signer": "ed25519:demo"},
+            "enclave_id": "did:example:enterprise-enclave-01",
+            "attestation_cadence": "1h",
+        },
+        "base_confidentiality": "gated-open",
+        "deployment_model": "builder-to-customer",
+    }
+    if derived_from is not None:
+        m["derived_from"] = derived_from
+    if rights_holder is not None:
+        m["rights_holder"] = rights_holder
+    return m
+
+
+def sign_manifest(doc: dict, keys: list) -> WeightCustodyManifest:
+    m = WeightCustodyManifest.model_validate(doc)
+    return m.with_signatures([
+        Ed25519Signer(k).sign(m.unsigned_dict(), role=r, signer=s) for k, r, s in keys
+    ])
+
+
+def main() -> None:
+    print("Derivative lineage: the fine-tune is the asset. Prove where it came from.")
+    print("Real WCM code with a software (mock) attestation provider, no hardware.")
+
+    builder, custodian = generate_ed25519(), generate_ed25519()
+    keys = [(builder, "builder", "acme-governance"), (custodian, "custodian", "acme-governance")]
+
+    rule("1. The base model, signed")
+    base = sign_manifest(
+        build_manifest(weights_hash=sha256(b"<public base checkpoint>"), org="acme-governance",
+                       derivatives="fine-tune-only"),
+        keys,
+    )
+    print("base weights_hash  :", base.weights_hash)
+    print("permits            : fine-tune-only (derivatives allowed, one level)")
+
+    rule("2. Fine-tune on private data: the derivative gets its own manifest")
+    deriv = sign_manifest(
+        build_manifest(
+            weights_hash=sha256(b"<base>+<acme proprietary fine-tune on private data>"),
+            org="acme-governance", derivatives="none",
+            derived_from=base.weights_hash,
+            rights_holder={"base": "meta", "derivative": "acme"},
+        ),
+        keys,
+    )
+    print("derivative hash    :", deriv.weights_hash)
+    print("derived_from       :", deriv.derived_from)
+    print("rights_holder      :", {"base": deriv.rights_holder.base, "derivative": deriv.rights_holder.derivative})
+    print("permits            : none (acme does not permit derivatives OF its derivative)")
+
+    rule("3. Lineage resolves the derivative back to the base")
+    manifests = {base.weights_hash: base, deriv.weights_hash: deriv}
+    lineage = verify_lineage(manifests, deriv.weights_hash)
+    print("lineage ok         :", lineage.ok)
+    print("chain (leaf->root) :", " -> ".join(h.split(":")[1][:12] + "..." for h in lineage.chain))
+    print("depth              :", lineage.depth, " base is a root:", is_root(base))
+    print("-> this fine-tune never existed publicly. The chain is its custody record.")
+
+    rule("4. The base's rules travel down the chain")
+    # Someone tries to fork the derivative, but the derivative permits no derivatives.
+    rogue = sign_manifest(
+        build_manifest(weights_hash=sha256(b"<a fork of acme's derivative>"), org="rogue",
+                       derivatives="none", derived_from=deriv.weights_hash),
+        keys,
+    )
+    manifests[rogue.weights_hash] = rogue
+    bad = verify_lineage(manifests, rogue.weights_hash)
+    print("fork of derivative : lineage ok =", bad.ok)
+    print("violation          :", bad.violations[0] if bad.violations else "(none)")
+    print("-> monotone rights: a child may narrow the parent's terms, never widen them.")
+
+
+if __name__ == "__main__":
+    main()