Sync site with ten runnable demos (#17)

* Sync site with ten runnable demos

* fix quickstart indentation and normalize line endings

Author: imran-siddique

demos/index.html

@@ -4,15 +4,15 @@
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>Model Weight Protection and Agent Governance Demos | AgenTrust</title>
-<meta name="description" content="Nine runnable demos for securing AI model weights and governing agents. Attestation-gated key release, tamper refusal before load, derivative lineage for fine-tunes, and 2-of-3 sovereign threshold custody. Run them on your laptop in ten minutes, no confidential-computing hardware required.">
+<meta name="description" content="Ten runnable demos for securing AI model weights and governing agent tool and model calls. Run them on your laptop in about twelve minutes, no confidential-computing hardware required.">
 <link rel="canonical" href="https://agentrust-io.com/demos/">
 <meta name="robots" content="index, follow">
 
 <!-- Open Graph -->
 <meta property="og:type" content="article">
 <meta property="og:site_name" content="AgenTrust">
 <meta property="og:title" content="Model Weight Protection and Agent Governance Demos">
-<meta property="og:description" content="Nine runnable demos: attestation-gated key release for model weights, tamper refusal before load, derivative lineage for fine-tunes, 2-of-3 sovereign threshold custody. Ten minutes on your laptop, no special hardware.">
+<meta property="og:description" content="Ten runnable demos for model-weight custody and governed agent tool and model calls. About twelve minutes on your laptop, no special hardware.">
 <meta property="og:url" content="https://agentrust-io.com/demos/">
 <meta property="og:locale" content="en_US">
 <meta property="og:image" content="https://agentrust-io.com/og.png">
@@ -23,7 +23,7 @@
 <!-- Twitter -->
 <meta name="twitter:card" content="summary_large_image">
 <meta name="twitter:title" content="Model Weight Protection and Agent Governance Demos">
-<meta name="twitter:description" content="Attestation-gated key release, tamper refusal before load, derivative lineage, 2-of-3 sovereign threshold. Nine runnable demos, ten minutes, no special hardware.">
+<meta name="twitter:description" content="Model-weight custody plus governed agent tool and model calls. Ten runnable demos, about twelve minutes, no special hardware.">
 <meta name="twitter:image" content="https://agentrust-io.com/og.png">
 
 <!-- Icons -->
@@ -165,7 +165,7 @@
   <div class="hero-inner">
     <p class="eyebrow">Runnable Demos</p>
     <h1>Don't take the spec on trust.<br>Run it.</h1>
-    <p>Nine demos, about ten minutes end to end. Four cover custody of model weights: binding a checkpoint's hash, gating the decryption key behind attestation, tracking a fine-tune's lineage, and splitting the key so no single party can release it. Five cover governing what an agent does at the tool boundary.</p>
+    <p>Ten demos, about twelve minutes end to end. Four cover custody of model weights. Five govern what an agent does at the tool boundary. One governs model calls through an OpenAI-compatible endpoint.</p>
     <p>Everything runs in software mode with <code>CMCP_DEV_MODE=1</code>. No confidential-computing hardware, no cloud account, no signup.</p>
   </div>
 </div>
@@ -174,12 +174,12 @@ <h1>Don't take the spec on trust.<br>Run it.</h1>
 
   <div class="quickstart">
     <h3>Quick start</h3>
-    <pre><code>pip install cmcp-runtime weight-custody-manifest
-git clone https://github.com/agentrust-io/demos &amp;&amp; cd demos
+    <pre><code>git clone https://github.com/agentrust-io/demos &amp;&amp; cd demos
+pip install -r requirements.txt
 export CMCP_BEARER_TOKEN=demo-token
-python demo.py            # all nine, pausing before each
+python demo.py            # all ten, pausing before each
 python demo.py 6          # just demo 6</code></pre>
-    <p style="font-size:0.875rem;color:var(--muted);margin:0.875rem 0 0;">Demos 1 to 5 are driven by <code>cmcp-runtime</code>. Demos 6 to 9 need only <code>weight-custody-manifest</code>, with no server and no gateway. Source: <a href="https://github.com/agentrust-io/demos">github.com/agentrust-io/demos</a>.</p>
+    <p style="font-size:0.875rem;color:var(--muted);margin:0.875rem 0 0;">The requirements install cMCP for demos 1 to 5, Weight Custody Manifest for demos 6 to 9, and the OpenAI client for demo 10. Source: <a href="https://github.com/agentrust-io/demos">github.com/agentrust-io/demos</a>.</p>
   </div>
 
   <p class="section-label">Model Weights</p>
@@ -304,6 +304,18 @@ <h2>Governing what an agent does</h2>
     <pre><code>python demo-05-compliance-domain/run.py</code></pre>
   </div>
 
+  <div class="demo">
+    <div class="demo-head"><span class="demo-num">Demo 10</span><strong>Governed model calls</strong><span class="demo-time">~90 seconds</span></div>
+    <p>Put policy in front of an OpenAI-compatible model endpoint and route each request according to its data class.</p>
+    <ul>
+      <li>public prompts can use the shared model route</li>
+      <li>PII leaves only after identifiers are stripped</li>
+      <li>confidential and PHI prompts stay on approved regional infrastructure</li>
+      <li>the same governance boundary applies to model calls, not only MCP tools</li>
+    </ul>
+    <pre><code>python demo-10-model-gateway/run.py</code></pre>
+  </div>
+
   <hr class="divider">
 
   <h2>Where to go next</h2>

index.html

@@ -845,8 +845,8 @@ <h1>Govern AI Agents<br>at the Hardware Boundary</h1>
       <div class="card-accent" style="background: var(--green);"></div>
       <div class="card-body">
         <div class="card-tag" style="color: var(--green);">Runnable Demos</div>
-        <div class="card-name">Nine Demos, Ten Minutes</div>
-        <div class="card-desc">Run the specs on your own machine, no hardware required. Watch a policy block a data leak, verify a signed receipt offline, and see model weight custody refuse a tampered checkpoint before it loads.</div>
+        <div class="card-name">Ten Demos, About Twelve Minutes</div>
+        <div class="card-desc">Run the specs on your own machine, no hardware required. Block a data leak, verify a signed receipt, refuse tampered model weights, and govern OpenAI-compatible model calls.</div>
       </div>
       <div class="card-footer">
         <span class="card-url">agentrust-io.com/demos</span>

llms.txt

@@ -24,7 +24,7 @@ AgenTrust is organized around four complementary open standards. Agent Manifest
 
 ## Runnable demos
 
-- [Demos](https://agentrust-io.com/demos/): Nine runnable demos, about ten minutes total, all in software mode with no confidential-computing hardware required. Four cover custody of AI model weights and five cover governing an agent at the tool boundary.
+- [Demos](https://agentrust-io.com/demos/): Ten runnable demos, about twelve minutes total, all in software mode with no confidential-computing hardware required. Four cover custody of AI model weights, five govern an agent at the tool boundary, and one governs OpenAI-compatible model calls by data class.
   - Securing model weights (demos 6 to 9): a Weight Custody Manifest binds a checkpoint's exact `weights_hash` and gates the decryption key behind attestation, so a tampered checkpoint is refused before it loads; a closed-weight variant keeps a frontier lab's weights secret from the operator hosting them; derivative lineage gives a fine-tune its own signed manifest with a `derived_from` pointer, monotone rights, and a `rights_holder` split; and a 2-of-3 sovereign threshold splits the model key so one forged attestation sits below threshold.
   - Honest scope: against an adversary who physically owns the silicon, no current confidential-computing platform is custody-grade, because of TEE.fail and BadRAM. These demos give accountability-grade custody under an operator-trust model, plus a threshold scheme for when one operator's word is not enough. Claims of weight protection "without operator trust assumptions" overstate what the hardware does.
   - Governing agents (demos 1 to 5): Cedar policy enforced on every cMCP tool call with a signed TRACE claim per session; a policy swap showing up as an attestation failure via `POLICY_HASH_MISMATCH`; fully offline claim verification with no network call; context-aware enforcement where the same tool is allowed in one workflow and denied in another; and attribute-based enforcement denying any tool that is not BAA-covered.