Skip to content

Chore: Move the demos to rossoctl/cortex-demos - #1759

Merged
huang195 merged 2 commits into
rossoctl:mainfrom
huang195:chore/move-demos
Nov 10, 2026
Merged

huang195 merged 2 commits into
rossoctl:mainfrom
huang195:chore/move-demos

Conversation

@huang195

@huang195 huang195 commented Nov 9, 2026

Copy link
Copy Markdown
Member

Summary

The demos moved to rossoctl/cortex-demos, with their history. This PR removes demos/ and the demo skill from this repo.

Changes

  • Removed: demos/ (13 demos) and .claude/skills/demo/.
  • CI: removed the go-ci-demos job. cortex-demos has the same job now. Removed the demos exclusions from dependabot-tidy.yml and from the Trivy config scan.
  • cpex tests: hrdemo_cpex_test.go read two hr-cpex manifests from demos/. Copies of those two files are now in core/plugins/cpex/testdata/hr-cpex/.
  • Docs and comments: links and comments that pointed at demos/ now point at cortex-demos.
  • CLAUDE.md, .github/CLAUDE.md, CONTRIBUTING.md: the repo has 7 Go modules now, not 10.

How the new repo was made

  • git filter-repo kept every commit that touched AuthBridge/demos/, authbridge/demos/ or demos/, and moved those paths to the repo root (505 commits).
  • The Go modules are now github.com/rossoctl/cortex-demos/<demo>.
  • Makefiles and scripts that build Cortex images or agentop from source read CORTEX_DIR. The default is a cortex checkout beside cortex-demos.

Verification

  • cortex-demos: go vet and go build pass for echo, finance-sparc and ibac.
  • This PR: go vet ./... passes in core and cmd/agentop. The 28 hr cpex tests pass with -tags cpex against the v0.3.1 FFI on darwin-arm64. CI does not run these tests.
  • pre-commit passes on the changed files.

Not done

  • No demo was run end-to-end on a Kind cluster from the new repo.
  • The testdata copies of the two hr-cpex manifests do not follow later changes in cortex-demos.

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

The demos are now in https://github.com/rossoctl/cortex-demos, with their
history. This change removes demos/ and the demo skill from this repo.

- CI: remove the go-ci-demos job (it is now in cortex-demos). Remove the
  demos exclusions from dependabot-tidy and the Trivy config scan.
- The cpex hr-demo tests read two hr-cpex manifests. Copies of those
  files are now in core/plugins/cpex/testdata/hr-cpex/.
- Links and comments that point at demos/ now point at cortex-demos.
- CLAUDE.md, .github/CLAUDE.md and CONTRIBUTING.md: 7 Go modules, not 10.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Hai Huang <huang195@gmail.com>
@huang195
huang195 requested review from a team and rubambiza as code owners November 9, 2026 23:08
@coderabbitai

coderabbitai Bot commented Nov 9, 2026 •

Copy link
Copy Markdown

Important

Review skipped

Too many files!

This PR contains 231 files, which is 131 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

Check out review usage here.

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 29586b8e-f806-4016-a183-728bebe13a02
Commits

Reviewing files that changed from the base of the PR and between 2bf6974 and 262e881.

Files ignored due to path filters: 1

  • demos/coding-agent-cpex/demo/coding-agent-cpex.svg is excluded by !**/*.svg
Files selected for processing: 231

  • .claude/skills/demo/SKILL.md
  • .github/CLAUDE.md
  • .github/workflows/ci.yaml
  • .github/workflows/dependabot-tidy.yml
  • .github/workflows/security-scans.yaml
  • .gitignore
  • CLAUDE.md
  • CONTRIBUTING.md
  • cmd/README.md
  • cmd/agentop/cmd_pipeline.go
  • cmd/agentop/cmd_pipeline_test.go
  • core/config/config_test.go
  • core/config/tlsbridge_bind_test.go
  • core/listener/parity/protocol_parity_test.go
  • core/plugins/CLAUDE.md
  • core/plugins/cpex/README.md
  • core/plugins/cpex/hrdemo_cpex_test.go
  • core/plugins/cpex/testdata/hr-cpex/authbridge.yaml
  • core/plugins/cpex/testdata/hr-cpex/cpex-policy.yaml
  • demos/CLAUDE.md
  • demos/README.md
  • demos/coding-agent-cpex/.gitignore
  • demos/coding-agent-cpex/README.md
  • demos/coding-agent-cpex/agent/agent.py
  • demos/coding-agent-cpex/claude-code/README.md
  • demos/coding-agent-cpex/claude-code/settings.json.example
  • demos/coding-agent-cpex/claude-code/setup.sh
  • demos/coding-agent-cpex/config/cortex.yaml
  • demos/coding-agent-cpex/config/cpex-policy.yaml
  • demos/coding-agent-cpex/demo/caption_bar.py
  • demos/coding-agent-cpex/demo/policy_slide.py
  • demos/coding-agent-cpex/demo/record_demo.py
  • demos/coding-agent-cpex/demo/record_tmux.sh
  • demos/coding-agent-cpex/demo/steps.md
  • demos/coding-agent-cpex/demo/test_record_demo.py
  • demos/coding-agent-cpex/docker-compose.yml
  • demos/coding-agent-cpex/env.sh
  • demos/coding-agent-cpex/fixtures/env.fixture
  • demos/coding-agent-cpex/fixtures/report-clean.json
  • demos/coding-agent-cpex/fixtures/report-with-key.json
  • demos/coding-agent-cpex/mocks/llm/scripts.json
  • demos/coding-agent-cpex/mocks/llm/server.py
  • demos/coding-agent-cpex/mocks/support/server.py
  • demos/coding-agent-cpex/run.sh
  • demos/coding-agent-cpex/scenarios/00-sandbox-boundary.sh
  • demos/coding-agent-cpex/scenarios/01-unapproved-host-deny.sh
  • demos/coding-agent-cpex/scenarios/02-clean-report-allow.sh
  • demos/coding-agent-cpex/scenarios/03-secret-in-report-deny.sh
  • demos/coding-agent-cpex/scenarios/04-tainted-session-deny.sh
  • demos/coding-agent-cpex/scenarios/05-wrong-project-deny.sh
  • demos/coding-agent-cpex/scenarios/06-fresh-session-allow.sh
  • demos/coding-agent-cpex/scenarios/07-custody-allow.sh
  • demos/coding-agent-cpex/scenarios/08-custody-no-credential-on-deny.sh
  • demos/coding-agent-cpex/scenarios/09-intent-deny.sh
  • demos/coding-agent-cpex/scenarios/_lib.sh
  • demos/coding-agent-cpex/walkthrough.sh
  • demos/context-guru/README.md
  • demos/context-guru/context-guru-tls-bridge.yaml
  • demos/context-guru/k8s/agent.yaml
  • demos/context-guru/k8s/authbridge-config.yaml
  • demos/context-guru/run.sh
  • demos/echo/.gitignore
  • demos/echo/Makefile
  • demos/echo/README.md
  • demos/echo/agent/Dockerfile
  • demos/echo/agent/main.go
  • demos/echo/go.mod
  • demos/echo/k8s/agent.yaml
  • demos/echo/k8s/echo-patch.yaml
  • demos/echo/k8s/upstream.yaml
  • demos/echo/scripts/echo-merge.py
  • demos/echo/scripts/patch-echo-config.sh
  • demos/echo/scripts/setup_keycloak.py
  • demos/echo/upstream/Dockerfile
  • demos/echo/upstream/main.go
  • demos/finance-sparc/.gitignore
  • demos/finance-sparc/Makefile
  • demos/finance-sparc/README.md
  • demos/finance-sparc/finance-agent/Dockerfile
  • demos/finance-sparc/finance-agent/main.go
  • demos/finance-sparc/finance-mcp/Dockerfile
  • demos/finance-sparc/finance-mcp/main.go
  • demos/finance-sparc/go.mod
  • demos/finance-sparc/k8s/agent.yaml
  • demos/finance-sparc/k8s/finance-mcp.yaml
  • demos/finance-sparc/k8s/ollama.yaml
  • demos/finance-sparc/k8s/sparc-patch.yaml
  • demos/finance-sparc/scripts/drive-demo.sh
  • demos/finance-sparc/scripts/host-setup.sh
  • demos/finance-sparc/scripts/launch-agentop.sh
  • demos/finance-sparc/scripts/patch-sparc-config.sh
  • demos/finance-sparc/scripts/pipeline-merge.py
  • demos/finance-sparc/scripts/setup_keycloak_finance.py
  • demos/finance-sparc/scripts/show-verdicts.py
  • demos/finance-sparc/scripts/stage-ollama-model.sh
  • demos/github-issue/aiac/.gitignore
  • demos/github-issue/aiac/Makefile
  • demos/github-issue/aiac/aiac.env.TEMPLATE
  • demos/github-issue/aiac/aiac_agent/__init__.py
  • demos/github-issue/aiac/aiac_agent/agent/__init__.py
  • demos/github-issue/aiac/aiac_agent/agent/graph.py
  • demos/github-issue/aiac/aiac_agent/agent/state.py
  • demos/github-issue/aiac/aiac_agent/config/__init__.py
  • demos/github-issue/aiac/aiac_agent/config/config_utils.py
  • demos/github-issue/aiac/aiac_agent/config/constants.py
  • demos/github-issue/aiac/aiac_agent/config/llm_conf.yaml.TEMPLATE
  • demos/github-issue/aiac/aiac_agent/config/llm_config.py
  • demos/github-issue/aiac/aiac_agent/prompts/__init__.py
  • demos/github-issue/aiac/aiac_agent/prompts/prompt_builder.py
  • demos/github-issue/aiac/aiac_agent/utils/__init__.py
  • demos/github-issue/aiac/aiac_agent/utils/parsers.py
  • demos/github-issue/aiac/aiac_agent/utils/validators.py
  • demos/github-issue/aiac/aiac_cli.py
  • demos/github-issue/aiac/keycloak_ops/__init__.py
  • demos/github-issue/aiac/keycloak_ops/apply_policy.py
  • demos/github-issue/aiac/keycloak_ops/delete_policy.py
  • demos/github-issue/aiac/keycloak_ops/export_config.py
  • demos/github-issue/aiac/policies/permissive_policy.txt
  • demos/github-issue/aiac/policies/regular_policy.txt
  • demos/github-issue/aiac/scripts/show-result.py
  • demos/github-issue/demo-aiac.md
  • demos/github-issue/demo-manual.md
  • demos/github-issue/demo-ui.md
  • demos/github-issue/demo.md
  • demos/github-issue/k8s/configmaps.yaml
  • demos/github-issue/k8s/git-issue-agent-deployment.yaml
  • demos/github-issue/k8s/github-tool-deployment.yaml
  • demos/github-issue/rbac/Makefile
  • demos/github-issue/rbac/config.yaml
  • demos/github-issue/rbac/policy.yaml
  • demos/github-issue/setup_keycloak.py
  • demos/hr-cpex/Makefile
  • demos/hr-cpex/README.md
  • demos/hr-cpex/agent/CHAT-WALKTHROUGH.md
  • demos/hr-cpex/agent/Dockerfile
  • demos/hr-cpex/agent/agent.py
  • demos/hr-cpex/agent/chat.py
  • demos/hr-cpex/agent/requirements-client.txt
  • demos/hr-cpex/agent/requirements.txt
  • demos/hr-cpex/auth-channel/Dockerfile
  • demos/hr-cpex/auth-channel/requirements.txt
  • demos/hr-cpex/auth-channel/server.py
  • demos/hr-cpex/demo/.gitignore
  • demos/hr-cpex/demo/record_demo.py
  • demos/hr-cpex/demo/steps.md
  • demos/hr-cpex/demo/test_record_demo.py
  • demos/hr-cpex/hr-mcp-server/Dockerfile
  • demos/hr-cpex/hr-mcp-server/requirements.txt
  • demos/hr-cpex/hr-mcp-server/server.py
  • demos/hr-cpex/hr-mcp-server/test_server.py
  • demos/hr-cpex/k8s/00-namespace.yaml
  • demos/hr-cpex/k8s/10-keycloak.yaml
  • demos/hr-cpex/k8s/20-hr-mcp.yaml
  • demos/hr-cpex/k8s/30-agent.yaml
  • demos/hr-cpex/k8s/40-auth-channel.yaml
  • demos/hr-cpex/k8s/realm-export.json
  • demos/hr-cpex/k8s/spire/agent-patch.yaml
  • demos/hr-cpex/k8s/spire/agent-unpatch.yaml
  • demos/hr-cpex/k8s/spire/authbridge-spiffe.yaml
  • demos/hr-cpex/k8s/spire/spire.yaml
  • demos/hr-cpex/mint-token.sh
  • demos/hr-cpex/scenarios/01-bob-allow.sh
  • demos/hr-cpex/scenarios/02-alice-deny.sh
  • demos/hr-cpex/scenarios/03-eve-redact.sh
  • demos/hr-cpex/scenarios/04-alice-internal-allow.sh
  • demos/hr-cpex/scenarios/05-alice-external-cedar-deny.sh
  • demos/hr-cpex/scenarios/06-bob-apl-deny.sh
  • demos/hr-cpex/scenarios/07-bob-pii-deny.sh
  • demos/hr-cpex/scenarios/08-bob-taint-deny.sh
  • demos/hr-cpex/scenarios/09-cross-principal-taint-isolation.sh
  • demos/hr-cpex/scenarios/10-adjust-under-threshold.sh
  • demos/hr-cpex/scenarios/11-adjust-needs-approval.sh
  • demos/hr-cpex/scenarios/12-assertions.sh
  • demos/hr-cpex/scenarios/13-workload-delegation.sh
  • demos/hr-cpex/scenarios/_lib.sh
  • demos/hr-cpex/verify-token-exchange.sh
  • demos/hr-cpex/walkthrough.sh
  • demos/ibac/.gitignore
  • demos/ibac/Makefile
  • demos/ibac/README.md
  • demos/ibac/agent/Dockerfile
  • demos/ibac/agent/main.go
  • demos/ibac/email-server/Dockerfile
  • demos/ibac/email-server/main.go
  • demos/ibac/evil-server/Dockerfile
  • demos/ibac/evil-server/main.go
  • demos/ibac/go.mod
  • demos/ibac/k8s/agent-unprotected.yaml
  • demos/ibac/k8s/agent.yaml
  • demos/ibac/k8s/email-server.yaml
  • demos/ibac/k8s/evil-server.yaml
  • demos/ibac/k8s/ibac-patch.yaml
  • demos/ibac/k8s/parsers-patch.yaml
  • demos/ibac/scripts/chat.sh
  • demos/ibac/scripts/ibac-merge.py
  • demos/ibac/scripts/launch-agentop.sh
  • demos/ibac/scripts/patch-ibac-config.sh
  • demos/lineage/README.md
  • demos/lineage/ask.sh
  • demos/lineage/k8s/weather.yaml
  • demos/lineage/show-trace.py
  • demos/session-budget/README.md
  • demos/session-budget/hitl-local.md
  • demos/session-budget/hitl-with-claude-code.md
  • demos/session-budget/k8s/pause-webhook-stub.yaml
  • demos/session-budget/local/approver.go
  • demos/session-budget/local/config-https-observe.yaml
  • demos/session-budget/local/config-https.yaml
  • demos/session-budget/local/config.yaml
  • demos/token-exchange-routes/README.md
  • demos/token-exchange-routes/routes.yaml
  • demos/weather-agent/demo-ui-advanced.md
  • demos/weather-agent/demo-ui.md
  • demos/weather-agent/demo-with-agentop.md
  • demos/weather-agent/deploy_and_verify_advanced.sh
  • demos/weather-agent/k8s/agentruntime-weather-service-advanced.yaml
  • demos/weather-agent/k8s/agentruntime-weather-tool-advanced.yaml
  • demos/weather-agent/k8s/configmaps-advanced.yaml
  • demos/weather-agent/k8s/weather-service-advanced.yaml
  • demos/weather-agent/k8s/weather-tool-advanced.yaml
  • demos/weather-agent/setup_keycloak_weather_advanced.py
  • deploy/lineage-attach/README.md
  • deploy/proxy-init/README.md
  • docs/README.md
  • docs/architecture.md
  • docs/cpex-plugin.md
  • docs/ibac-plugin.md
  • docs/kubernetes.md
  • docs/session-budget-plugin.md
  • docs/sparc-plugin.md
  • scripts/dev/verify-spire-keycloak.sh

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@clawgenti clawgenti left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Summary

This is a clean move. After the change no tracked file outside docs/superpowers/ refers to demos/. go.work and the Makefile never listed the demo modules. dependabot.yml, CODEOWNERS and the spellcheck config have no demo entries. The removed go-ci-demos job is now in rossoctl/cortex-demos/.github/workflows/ci.yaml, with the same matrix and steps. I checked every new cortex-demos link and path against the new repo's main tree. All of them exist, and so do the #configmaps-and-secrets-expected-at-runtime, #shared-volume-contract and #building-everything-locally anchors in its CLAUDE.md. The one exception is mtls/ (see inline). The two testdata/hr-cpex/ copies match cortex-demos/hr-cpex/k8s/ byte for byte. The demo skill now lives in cortex-demos under .claude/skills/demo/. The demo modules never imported core, so dropping the job loses no coverage of core's API.

Two nits, inline. There is also a pre-existing one outside the diff: the allow-ghsas exception in security-scans.yaml (around lines 48-52) points at demo/agents/github_agent/pyproject.toml. That path does not exist, and crewai no longer appears anywhere in this repo. You could drop the exception, or move it to cortex-demos if it is needed there.

Author: huang195 (MEMBER — maintainer)
Areas reviewed: CI/GitHub Actions, Go (test paths and comments), Docs, cross-repo link targets
Agent/IDE config (.claude/.vscode): one deletion only (.claude/skills/demo/SKILL.md, now in cortex-demos). Nothing added, modified or renamed.
Commits: 1 commit, signed off: yes
CI status: passing

Comment thread docs/framework-architecture.md Outdated
@@ -806,7 +806,7 @@ flows through to a per-agent rendered envoy-config with the matching TLS
blocks.

> **This envoy-sidecar design has no end-to-end verification in-tree.** The
> `demos/mtls/` demo that used to exercise it was retired as superseded.
> `cortex-demos/mtls/` demo that used to exercise it was retired as superseded.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: mtls/ was retired before the split, so it was never in cortex-demos and cortex-demos/mtls/ does not exist. Rewriting the path here makes it read as if it had been moved. Suggest keeping the historical name, for example: "The former demos/mtls/ demo that used to exercise it was retired as superseded."

func hrManifestConfig(t *testing.T) hrCPEXConfig {
t.Helper()
raw, err := os.ReadFile(filepath.Join("..", "..", "..", "demos", "hr-cpex", "k8s", "authbridge.yaml"))
raw, err := os.ReadFile(filepath.Join("testdata", "hr-cpex", "authbridge.yaml"))

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: The comments around this function still say k8s/authbridge.yaml (lines 296, 312, 321, 352, 357, 362), which was the path in the demo tree. The test now reads testdata/hr-cpex/authbridge.yaml. A short note here and in hrPolicy would help, something like "copied from cortex-demos/hr-cpex/k8s/; resync by hand". It would make the drift the PR mentions under "Not done" visible to the next person who edits these tests.

The mTLS demo was retired before the move. It is not in cortex-demos,
so the note names its old path, demos/mtls/.

The hr-cpex test reads copies in testdata/hr-cpex/, not the demo's
k8s/ files. The header now says the files are a copy that does not
follow cortex-demos. The comments and t.Fatal messages name the
testdata path.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Hai Huang <huang195@gmail.com>

@clawgenti clawgenti left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Summary

I re-reviewed at 262e881. The second commit fixes both nits from my review of 160e7ef. docs/framework-architecture.md is now unchanged from main and keeps the historical demos/mtls/ name. The hr-cpex test header says the two manifests are copies that do not follow cortex-demos, and the comments and t.Fatal messages name testdata/hr-cpex/.

What I checked at head:

  • No dangling references. Outside docs/superpowers/, no tracked file names a demos/ path. The only match is the intentional demos/mtls/ note. go.work, the root Makefile, .dockerignore, dependabot.yml, .pre-commit-config.yaml and every remaining go.mod replace have no demo entries. Nothing outside demos/ imported the demo modules, and none of the three demo modules imported core. No other rossoctl repo links to rossoctl/cortex/.../demos (org code search; the authbridge/demos hits in rossoctl/rossoctl point at a path that was retired earlier, not at this one).
  • New repo. All 205 files that were under demos/ on main exist at the same paths in rossoctl/cortex-demos@main (its tree is public and not truncated). Every new cortex-demos link and path in this diff resolves, and so do the #shared-volume-contract, #configmaps-and-secrets-expected-at-runtime and #building-everything-locally anchors. Its ci.yaml has the same echo/finance-sparc/ibac vet+build matrix as the removed go-ci-demos job. No branch rule requires go-ci-demos, so removing it cannot block merges.
  • cpex tests. The two testdata/hr-cpex/ files are byte-identical to demos/hr-cpex/k8s/ on main and to cortex-demos/hr-cpex/k8s/. The PR touches core/, so go-ci-cpex ran go test -tags cpex ./plugins/cpex/... at 262e881 and passed. The 18 TestHRDemo* functions have no skips, so CI did exercise the relocated testdata on this PR. (The PR body's "CI does not run these tests" holds only for PRs that do not touch the cpex paths.) I could not reproduce locally because the Go module proxy timed out.

Pre-existing and outside the diff (repeating it in case it got lost): the allow-ghsas: GHSA-f4j7-r4q5-qw2c exception in security-scans.yaml (lines 48-52) cites demo/agents/github_agent/pyproject.toml, which does not exist, and nothing in this repo uses crewai. It could be dropped in a follow-up.

Author: huang195 (MEMBER — maintainer)
Areas reviewed: CI/GitHub Actions, Go (test paths and comments), Docs, cross-repo link targets
Agent/IDE config (.claude/.vscode): one deletion only (.claude/skills/demo/SKILL.md, present in cortex-demos). Nothing added, modified or renamed.
Commits: 2 commits, all signed off: yes
CI status: passing

@huang195
huang195 merged commit ecb7cb3 into rossoctl:main Nov 10, 2026
37 checks passed
@huang195
huang195 deleted the chore/move-demos branch November 10, 2026 00:28
@github-project-automation github-project-automation Bot moved this from New/ToDo to Done in Rossoctl Issue Prioritization Nov 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

2 participants