refactor: rename demo-one → enforcement-demo

[beonde]

Summary

Renames demo-one → enforcement-demo and demo-two → policy-demo, restructures the repo for clarity, and addresses multiple issues:

Changes

• Rename: demo-one/ → enforcement-demo/, demo-two/ → policy-demo/
• Remove: mcp-demo/ (consolidated into enforcement-demo), run_video.py (replaced by --auto flag), scenario 5 (fake revocation — not realistic without server-side propagation delay)
• Add: --verbose flag for badge inspection, --auto flag for non-interactive runs
• Fix: time.sleep() → asyncio.sleep() in async context, stale badge reuse, key mismatch in scenario 2
• Deps: Pin capiscio-sdk>=2.7.1 and capiscio-mcp[mcp]>=2.7.1
• Makefile: Add install, enforcement-demo, policy-demo targets, fix venv activation
• Docs: Update READMEs to match 4-scenario demo, remove revocation references

[Copilot]

Pull request overview

Renames the former demo-one/ demo to enforcement-demo/ to better reflect its purpose, and updates repo entrypoints/docs to reference the new name.

Changes:

• Renamed demo directory references across setup tooling (scripts/setup.sh, Makefile, run_video.py) and documentation (README.md).
• Updated internal demo labeling (logger names, banners, headings) to use “enforcement-demo”.
• Modified the enforcement demo MCP server entrypoint to run stdio in an async path and added presenter pauses in the demo runner.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
scripts/setup.sh	Updates the per-demo .env scaffolding loop and help text to use enforcement-demo.
run_video.py	Renames the demo key/command from demo-one to enforcement-demo.
README.md	Reorganizes and updates demo listings and instructions for enforcement-demo.
Makefile	Renames targets/phony entries from demo-one/video-one to enforcement-demo/video-enforcement.
enforcement-demo/setup.sh	Updates setup banner text for the renamed demo.
enforcement-demo/server/main.py	Renames docstring/logger and changes the server stdio startup implementation.
enforcement-demo/run_demo.py	Renames banners and adds interactive pauses between scenarios.
enforcement-demo/requirements.txt	Updates header comment to match the renamed demo.
enforcement-demo/README.md	Updates title to match the renamed demo.
enforcement-demo/agents/untrusted_agent.py	Updates docstring/logger name to match the renamed demo.
enforcement-demo/agents/trusted_agent.py	Updates docstring/logger name to match the renamed demo.
enforcement-demo/.env.example	Updates header comment to match the renamed demo.

Comments suppressed due to low confidence (6)

enforcement-demo/server/main.py:113

• This entrypoint now relies on private/unstable capiscio-mcp internals (_capiscio_meta_ctx) and an internal attribute (server._server.run_stdio_async()). This is likely to break on capiscio-mcp upgrades and is inconsistent with the other demos that use the public server.run(transport="stdio") API; please switch to a public/ documented async run API (or add one upstream) rather than importing/using underscore-prefixed symbols.
  enforcement-demo/server/main.py:106
• The PR description says there are no functional changes, but this file changes the server startup/runtime behavior (new async entrypoint, different stdio run path, explicit telemetry flush). Please either adjust the PR description or add a brief rationale here explaining the behavioral change and why the previous asyncio.run(build_server()); server.run(...) approach was incorrect.
  enforcement-demo/run_demo.py:11
• This docstring says the demo runs four scenarios, but the script actually runs five (including badge revocation). Please update the scenario count and list so the top-level description matches the behavior and the README’s “5 scenarios” wording.
  enforcement-demo/run_demo.py:6
• The docstring below still references an @guard decorator for enforcement, but the server code in this repo enforces trust levels via @server.tool(min_trust_level=...). Please update the wording so readers aren’t directed to a decorator that isn’t used/visible in the demo implementation.
  enforcement-demo/run_demo.py:96
• pause() makes the demo block on stdin unconditionally; this will hang run_video.py / Makefile video-* runs and will also raise EOFError in non-interactive environments. Please make pauses optional (e.g., flag/env var), and/or auto-disable them when sys.stdin isn’t a TTY (and handle EOFError gracefully).
  enforcement-demo/setup.sh:27
• These banner lines overflow the box width defined by the surrounding border, so the output won’t render as a clean aligned frame in terminals. Please adjust the spacing/text length so each line fits within the ╔══…══╗ / ╚══…══╝ width.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 6 comments.

Comments suppressed due to low confidence (5)

enforcement-demo/run_demo.py:29

• argparse is imported but not used, and flags are parsed via sys.argv string checks. Either remove the unused import or switch to argparse for --auto/--no-pause parsing to keep the CLI implementation consistent.
  enforcement-demo/run_demo.py:17
• The module docstring says enforcement is done by an @guard decorator, but the server actually uses @server.tool(min_trust_level=...). Update the docstring to match the real API to avoid misleading readers.
  enforcement-demo/run_demo.py:314
• The presenter-facing output claims enforcement is via an @guard decorator, but the server code uses @server.tool(min_trust_level=...). Consider changing this message so the demo narration matches the actual code/API.
  enforcement-demo/server/main.py:113
• This relies on private/internal APIs (capiscio_mcp.integrations.mcp._capiscio_meta_ctx and server._server.run_stdio_async()), which is brittle and may break on dependency updates. Prefer a public async run API (or wrap this in a small compatibility helper with a fallback to the supported server.run(transport="stdio")).
  enforcement-demo/server/main.py:105
• The PR description states there are "No functional changes", but this introduces a new async entrypoint, manual meta-context injection, and telemetry flushing behavior for the server runtime. Either update the PR description to reflect the runtime behavior change or revert to the prior execution model.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 6 comments.

Comments suppressed due to low confidence (3)

enforcement-demo/server/main.py:113

• This startup path relies on private/internal APIs (_capiscio_meta_ctx, server._server.run_stdio_async()) that aren’t part of the public CapiscioMCPServer contract and may not exist across the supported capiscio-mcp[mcp]>=2.4.0 range. Prefer a public async run entrypoint (or keep server.run(transport="stdio")) or bump/pin the minimum capiscio-mcp version and document the requirement.
  enforcement-demo/run_demo.py:29
• argparse is imported but never used, which will fail make lint (ruff F401). Either remove the import or actually parse --auto/--no-pause via argparse and set AUTO_MODE from the parsed args.
  enforcement-demo/run_demo.py:23
• The PR description says “No functional changes”, but this PR introduces new user-facing behavior (e.g., --auto / --no-pause mode and scenario pausing/summary output). Either update the PR description to reflect these functional changes, or remove the new behavior from this rename-only PR.

[Copilot]

Pull request overview

Copilot reviewed 22 out of 26 changed files in this pull request and generated 11 comments.

Comments suppressed due to low confidence (6)

enforcement-demo/run_demo.py:36

• argparse is imported but never used. With the repo's ruff configuration (selecting F* rules), this will fail lint due to an unused import; either remove the import or wire up a real argparse-based CLI for --auto/--no-pause.
  enforcement-demo/run_demo.py:18
• The module docstring says enforcement is via an @guard decorator, but the server code uses @server.tool(min_trust_level=...) instead. Update the wording so the demo explanation matches the actual mechanism being exercised.
  enforcement-demo/server/main.py:115
• This server runner now depends on private/internal APIs (capiscio_mcp.integrations.mcp._capiscio_meta_ctx and server._server.run_stdio_async()). This is brittle across capiscio-mcp versions; prefer a public async run entrypoint (if available) or keep using server.run(transport="stdio") and address the supervisor-lifetime issue within supported APIs.
  policy-demo/server/main.py:5
• The Policy Demo docstring still says it's the same server as demo-one, which no longer exists after the rename to enforcement-demo. Update the reference so the docs match the current directory/name.
  policy-demo/server/main.py:15
• This docstring claims policy enforcement is performed by an @guard decorator, but the server actually uses @server.tool(min_trust_level=...) for trust gating. Update the explanation to match the real API so the demo doesn't teach an outdated concept.
  policy-demo/agents/untrusted_agent.py:7
• The docstring references trust level being set by @guard, but this demo’s server implementation uses @server.tool(min_trust_level=...). Consider rephrasing to the public API used in this repo to avoid implying a decorator that callers won't find.

[Copilot]

Pull request overview

Copilot reviewed 22 out of 26 changed files in this pull request and generated 13 comments.

Comments suppressed due to low confidence (6)

enforcement-demo/run_demo.py:35

• Unused import: argparse is imported but never used, and the Makefile’s lint step selects F (pyflakes), so this will fail CI/linting. Remove the import or switch AUTO_MODE parsing to argparse.
  enforcement-demo/run_demo.py:26
• The run_demo docstring says enforcement happens via an @guard decorator and lists CAPISCIO_SERVER_ID as a prerequisite, but the server uses @server.tool(min_trust_level=...) and the demo’s .env.example defaults CAPISCIO_SERVER_ID=auto. Update the wording so the docs match how the demo actually works.
  enforcement-demo/server/main.py:113
• This server runner relies on private/underscored APIs (capiscio_mcp.integrations.mcp._capiscio_meta_ctx and server._server.run_stdio_async()). That’s brittle and may break on dependency upgrades; prefer a public async run API (or add a small wrapper in capiscio_mcp that this demo can call).
  policy-demo/server/main.py:5
• Docstring still says this is the “same MCP server as demo-one”, but the repo renamed that demo to enforcement-demo. Update the reference so the docs point to the correct demo name/directory.
  policy-demo/server/main.py:15
• This docstring describes enforcement via an @guard decorator, but the server implementation uses @server.tool(min_trust_level=...). Update the wording to match the actual mechanism used by CapiscioMCPServer.
  enforcement-demo/server/main.py:121
• PR description says “No functional changes”, but this code changes runtime behavior by switching from server.run(transport="stdio") to calling private async stdio run + injecting meta context + flushing telemetry on shutdown. Either update the PR description to reflect the behavioral change, or keep the original public server.run(...) path if functional parity is required.

[Copilot]

Pull request overview

Copilot reviewed 32 out of 52 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (8)

multi-agent-demo/setup.sh:27

• The --help text still claims local repos are at ../capiscio-sdk-python etc, but the script actually checks ../../.... Update the help output to match the real expected layout so developers don’t follow incorrect instructions.
  multi-agent-demo/setup.sh:100
• In --local mode the dependency install is pip install -r requirements.txt 2>/dev/null || true, which can hide real install failures and leave agents with missing deps while the script reports success. Avoid swallowing pip errors; instead exclude/constraint CapiscIO packages explicitly and fail loudly if the remaining deps can’t be installed.
  enforcement-demo/server/main.py:117
• This relies on private APIs (capiscio_mcp.integrations.mcp._capiscio_meta_ctx and server._server.run_stdio_async()). Private members can change without notice and may break the demo when upgrading capiscio-mcp. Prefer a public async run/serve API if available, or wrap this behind a compatibility helper with a fallback to server.run(transport='stdio').
  policy-demo/server/main.py:146
• Same concern here: importing _capiscio_meta_ctx and calling server._server.run_stdio_async() depends on private internals. Please switch to a public API (or isolate this behind a small compatibility layer) to reduce breakage risk on SDK upgrades.
  enforcement-demo/run_demo.py:206
• isError from client.call_tool() indicates a tool execution error, but it’s not necessarily an authorization/trust denial. Treating all isError results as DENY can misreport real failures (e.g., tool exceptions) as enforcement. Consider returning ERROR when isError is true unless the error text matches known guard-deny markers.
  policy-demo/run_demo.py:112
• pause() is defined but never used (the script calls input(...) directly in multiple places). Remove the dead function or use it consistently so the pause behavior is centralized in one place.
  .github/copilot-instructions.md:126
• The instructions still say cd agents/langchain-agent ... but agents now live under multi-agent-demo/agents/.... Update this command so contributors don’t end up in a non-existent path.

python run_demo.py --agent langchain

# Start single agent server
cd agents/langchain-agent && source .venv/bin/activate && python main.py --serve

Makefile:71

• The PR description claims "No functional changes", but this PR introduces new runtime behavior (e.g., new policy-demo batching logic and new multi-agent-demo/shared event emitter package) and removes tooling like run_video.py/video make targets. Please update the PR description to reflect the actual scope so reviewers can assess risk accurately.

dev: dev-check ## Install ALL demos using local repos (pre-release testing)
	@echo ""
	@echo "═══════════════════════════════════════════════════════════"
	@echo "  Installing from LOCAL repos (dev mode)"
	@echo "═══════════════════════════════════════════════════════════"
	@echo ""
	# Shared event emitter
	$(PYTHON) -m pip install -e multi-agent-demo/shared/ -q
	# Local CapiscIO packages (overrides any PyPI versions)
	$(PYTHON) -m pip install -r $(LOCAL_DEPS)
	# Per-demo dependencies (non-capiscio deps like dotenv, httpx)
	$(PYTHON) -m pip install python-dotenv httpx uvicorn fastapi -q
	# Enforcement Demo
	cd enforcement-demo && $(PYTHON) -m pip install -r requirements.txt --no-deps -q 2>/dev/null || true
	# Agent frameworks
	$(PYTHON) -m pip install langchain langchain-openai langchain-community langgraph -q
	$(PYTHON) -m pip install "crewai>=1.12.0,<2.0.0" "crewai-tools>=1.12.0,<2.0.0" -q
	@echo ""

[Copilot]

Pull request overview

Copilot reviewed 56 out of 68 changed files in this pull request and generated 10 comments.

Comments suppressed due to low confidence (4)

policy-demo/.env.example:21

• policy-demo/scripts/setup_policies.py requires CAPISCIO_ADMIN_JWT, but the .env.example no longer includes it. Add a placeholder + warning comment (similar to what was removed) so users can run policy setup successfully.
  multi-agent-demo/agents/langgraph-agent/main.py:475
• Badge verification relies on agent._guard (a private attribute). This is brittle across SDK versions; prefer a public verification API (or middleware/guard instance exposed by the SDK) instead of reaching into underscored internals.
  .github/copilot-instructions.md:126
• This command still references the old agent path (cd agents/langchain-agent), but agents now live under multi-agent-demo/agents/.... Update the path so the instructions are runnable.

# Run demo
python run_demo.py --agent langchain

# Start single agent server
cd agents/langchain-agent && source .venv/bin/activate && python main.py --serve

Makefile:97

• make install prints PyPI versions via pip show langchain-capiscio, but the install recipe never installs langchain-capiscio (and multi-agent-demo/agents/langchain-agent/requirements.txt also doesn’t list it). This will likely make make install fail (grep gets no input) and also leaves the LangChain demo running without the CapiscIO guard/callback integration in release mode.

	@echo "✅ Release mode active. PyPI versions:"
	@$(PYTHON) -m pip show capiscio-sdk 2>/dev/null | grep -E "^(Name|Version)"
	@$(PYTHON) -m pip show capiscio-mcp 2>/dev/null | grep -E "^(Name|Version)"
	@$(PYTHON) -m pip show langchain-capiscio 2>/dev/null | grep -E "^(Name|Version)"