Chore: Move the demos to rossoctl/cortex-demos

.github/CLAUDE.md

@@ -8,7 +8,7 @@ including the PR title format and the Go checks that CI gates on, are in the roo
 
 | Workflow | Trigger | Purpose |
 |----------|---------|---------|
-| `ci.yaml` | PR to main/release-*, push to main | Pre-commit; `go vet` and build for all 10 modules, and tests for all but the three demos; a macOS job for `peerproc`, `tlsbridge`, `cmd/cortex` and `cmd/agentop`; the cgo `cpex` builds (`go-ci-cpex`); `go mod tidy -diff` for all 10 modules; proxy-init iptables, Python, install-script and release-notes-script tests. `go fmt` rewrites rather than fails, so it does not gate |
+| `ci.yaml` | PR to main/release-*, push to main | Pre-commit; `go vet`, build and tests for all 7 modules; a macOS job for `peerproc`, `tlsbridge`, `cmd/cortex` and `cmd/agentop`; the cgo `cpex` builds (`go-ci-cpex`); `go mod tidy -diff` for all 7 modules; proxy-init iptables, Python, install-script and release-notes-script tests. `go fmt` rewrites rather than fails, so it does not gate |
 | `build.yaml` | Tag push (`v*`), push to main, manual; PRs to main build amd64 only and skip `**.md` | Multi-arch Docker builds for the six images below. Every Go image passes `GO_BUILD_TAGS` naming a profile — plugins are all opt-in, so an image built without tags registers none |
 | `praxis.yaml` | PR to main/release-*, push to main, on `praxis/**` or the Go parser paths it ports | `cargo fmt --check`, clippy and tests for `praxis/`. A failure blocks only when `praxis/` or the workflow changed |
 | `security-scans.yaml` | PR to main | Dependency review, shellcheck, YAML lint, Hadolint, Bandit, Trivy, CodeQL |

.github/workflows/ci.yaml

@@ -265,34 +265,6 @@ jobs:
       - name: Test
         run: go test -v -race -cover ./...
 
-  # The demo modules build against core through a replace directive, so a core
-  # API change can break them; nothing else compiles them.
-  go-ci-demos:
-    name: Go CI (demos/${{ matrix.demo }})
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    strategy:
-      fail-fast: false
-      matrix:
-        demo: [echo, finance-sparc, ibac]
-    defaults:
-      run:
-        working-directory: demos/${{ matrix.demo }}
-    env:
-      GOWORK: "off"
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
-        with:
-          go-version-file: demos/${{ matrix.demo }}/go.mod
-          cache-dependency-path: demos/${{ matrix.demo }}/go.sum
-
-      - name: Vet and build
-        run: |
-          go vet ./...
-          go build ./...
-
   go-ci-readme-demo:
     name: Go CI (README demo)
     runs-on: ubuntu-latest

.github/workflows/dependabot-tidy.yml

@@ -51,7 +51,7 @@ jobs:
             echo "::group::go mod tidy in $mod"
             (cd "$mod" && go mod tidy)
             echo "::endgroup::"
-          done < <(find . -name go.mod -not -path '*/demos/*' -print0 | sort -z)
+          done < <(find . -name go.mod -print0 | sort -z)
 
       - name: Commit and push if changed
         id: commit

.github/workflows/security-scans.yaml

@@ -248,7 +248,6 @@ jobs:
           scan-type: 'config'
           scan-ref: '.'
           severity: 'CRITICAL,HIGH,MEDIUM'
-          skip-dirs: 'demos'
           exit-code: '0'
           format: 'table'
 

.gitignore

@@ -77,8 +77,7 @@ __pycache__/
 # can tell "the compiled output" from a source file or a package directory —
 # `cmd/*/*` would ignore the source. One line per binary is the only
 # pattern that is safe, so the list below is exhaustive for `cmd/` and for the
-# two `scripts/` helpers further down. The `demos/*` mains are deliberately not
-# listed. Keep adding to it.
+# two `scripts/` helpers further down. Keep adding to it.
 cmd/agentop/agentop
 cmd/cortex/cortex
 cmd/cortex-envoy/cortex-envoy

CLAUDE.md

@@ -93,7 +93,6 @@ directories, read its `CLAUDE.md`** if it has not loaded:
 | [`core/plugins/CLAUDE.md`](core/plugins/CLAUDE.md) | Inbound JWT validation and outbound token exchange: route resolver, config loading, credential files |
 | [`core/listener/vmcontrol/CLAUDE.md`](core/listener/vmcontrol/CLAUDE.md) | The MOCA SBX VM control channel |
 | [`deploy/proxy-init/CLAUDE.md`](deploy/proxy-init/CLAUDE.md) | `init-iptables.sh` and its gotchas |
-| [`demos/CLAUDE.md`](demos/CLAUDE.md) | Kubernetes deployment: pod shape, shared volumes, ConfigMaps, Envoy, Keycloak, Kind builds, cluster gotchas |
 | [`.github/CLAUDE.md`](.github/CLAUDE.md) | CI workflows, container images, adding an image to CI, release binaries |
 
 ## Repository Overview
@@ -132,7 +131,7 @@ artifact identifiers that other things address by name:
 | Frozen — do not rename | Where it is defined |
 |---|---|
 | `authbridge`, `authbridge-envoy`, `authbridge-lite`, `authbridge-cpex` | published image names; the operator selects images **by name** |
-| `authbridge-proxy` as a **container** name | **another repo's API** — the operator's `AuthBridgeProxyContainerName`. `kubectl … -c authbridge-proxy`, agentop's pod picker and the demos' sidecar detection address it. The binary inside is `cortex`; the operator sets only `Args`, so the image's entrypoint picks it |
+| `authbridge-proxy` as a **container** name | **another repo's API** — the operator's `AuthBridgeProxyContainerName`. `kubectl … -c authbridge-proxy`, agentop's pod picker and the cortex-demos sidecar detection address it. The binary inside is `cortex`; the operator sets only `Args`, so the image's entrypoint picks it |
 | `x-authbridge-{direction,secret}`, `x-authbridge-unmapped-<name>` | wire protocol |
 | `AUTHBRIDGE_*` | env vars users may already have set |
 | `authbridge-config{,-<agent>}`, `authbridge-runtime{,-config,-mtls}`, `authproxy-routes` | ConfigMaps the operator creates and mounts |
@@ -176,7 +175,6 @@ remains there: it runs `scripts/install.sh`, for the URL v0.7.0 and its docs giv
 | `docs/` | Plugin and framework reference ([`docs/README.md`](docs/README.md) is the index). `docs/superpowers/{plans,specs}/` holds dated design records and is **still written to** |
 | `scripts/` | `install.sh` (laptop installer), `keycloak_sync.py` (scope mappings from `routes.yaml`), `profile-tags/` (build-tag profiles), `hooks/commit-msg`, `dev/` |
 | `deploy/` | `proxy-init/` (iptables init container), `sparc-service/`, `lineage-attach/` |
-| `demos/` | End-to-end demos; [`demos/README.md`](demos/README.md) gives the order |
 | `tests/` | Python tests |
 
 ## AuthBridge Binaries
@@ -200,11 +198,10 @@ each binary links it in its own `storage_redis.go`. A build with no `-tags` regi
 no plugins and rejects every config it is handed. Tag sets come from
 [`scripts/profile-tags`](scripts/profile-tags/), one profile per shipped artifact.
 
-**Go modules:** 10 in total, all on Go 1.26.10 except the three `demos/*` modules (1.24).
+**Go modules:** 7 in total, all on Go 1.26.10.
 - `core/`, `core/storage/redis/` (nested, but its own module), `cmd/cortex`,
   `cmd/cortex-envoy`, `cmd/agentop`, `scripts/profile-tags`, `scripts/readme-demo`.
   `go.work` links these 7.
-- `demos/{echo,finance-sparc,ibac}/` are self-contained and outside the workspace.
 - `core/` is **consumed outside this repo**, so removing exported API there is a
   cross-repo change.
 
@@ -299,7 +296,7 @@ re-verify them by hand after a change.
 - Run `go vet ./...` and `gofmt -l .` from each module you touched, before you push.
   **Always give `gofmt` a path:** a bare `gofmt -l` reads stdin, scans nothing and
   exits 0.
-- **Only `go vet` is a CI gate**, on all 10 modules (cpex code is vetted with
+- **Only `go vet` is a CI gate**, on all 7 modules (cpex code is vetted with
   `-tags cpex` in `go-ci-cpex`). pre-commit has no Go hooks, and CI's `go fmt ./...`
   rewrites the checkout and exits 0, so formatting drift never fails a build.
 - Run per-module commands with `GOWORK=off`, as every CI Go job but `core`'s does,