external validation: reproduce MCP demo runner

[safal207]

Context

CML now includes a one-command local MCP demo runner for the experimental agent-audit MCP path.

The broader external validation issue is #77. This issue is intentionally narrower: validate only the MCP demo runner on a clean local checkout.

Goal

Confirm that a contributor outside the maintainer loop can run the MCP demo payload runner and observe the expected sections.

What to run

git clone https://github.com/safal207/Causal-Memory-Layer.git
cd Causal-Memory-Layer
python -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade pip
pip install -e ".[dev]"
python scripts/run_mcp_demo_payloads.py

Windows PowerShell activation:

.venv\Scripts\Activate.ps1

Expected output sections

The command should print JSON sections for:

health
audit_trace
evaluate_cause_band

Suggested validation note

Please add a short note under:

docs/evidence/external_validation/

Suggested filename:

<YYYY-MM-DD>-<github-handle>-mcp-demo-runner.md

Suggested structure:

# MCP Demo Runner External Validation Note

Validator: @your-handle
Date: YYYY-MM-DD
Repository commit: <commit-sha>

## Environment

- OS:
- Python version:

## Commands run

```bash
pip install -e ".[dev]"
python scripts/run_mcp_demo_payloads.py

Results

• MCP demo runner: pass/fail
• Sections observed: health / audit_trace / evaluate_cause_band

Notes

• What worked:
• What was confusing:
• Any reproduction issues:

Interpretation

The MCP demo runner is / is not reproducible on a clean local checkout.

Non-claims

This validation does not prove production safety, enforcement behavior, compliance readiness, or stable Cause Band semantics.

## Acceptance criteria

- [ ] A validation note is added under `docs/evidence/external_validation/`.
- [ ] The note records OS, Python version, and commit SHA.
- [ ] The note records whether `python scripts/run_mcp_demo_payloads.py` passed.
- [ ] The note confirms whether `health`, `audit_trace`, and `evaluate_cause_band` sections appeared.
- [ ] Any failure or confusion is reported honestly.
- [ ] No production safety, enforcement, compliance, or stable Cause Band claim is made.

## Non-goals

- Do not change MCP tool semantics.
- Do not change CML audit semantics.
- Do not require Cursor or another MCP client.
- Do not require hosted services or private credentials.

## Why this matters

This gives CML a small, reviewer-friendly trust signal for the agent-audit integration path:

```text
one command -> visible MCP tool logic -> reproducible external note

Refs #77, #122, #105.

[safal207]

Template added for this validation path:

docs/evidence/external_validation/TEMPLATE_MCP_DEMO_RUNNER.md

Suggested contributor flow:

1. Copy the template.
2. Rename it to:

docs/evidence/external_validation/<YYYY-MM-DD>-<github-handle>-mcp-demo-runner.md

3. Run:

pip install -e ".[dev]"
python scripts/run_mcp_demo_payloads.py

4. Fill in pass/fail, observed sections, environment, and notes.

This should keep the task small, reproducible, and safe: one local command, one short validation note, no hosted services or production claims.

[safal207]

Hi @marcotannoia — no pressure, but if you are interested, this issue is now a very small external validation task for the new MCP demo runner.

It should only require:

1. install CML locally,
2. run:

python scripts/run_mcp_demo_payloads.py

3. copy/fill:

docs/evidence/external_validation/TEMPLATE_MCP_DEMO_RUNNER.md

A short note from your environment would help CML show that the agent-audit MCP demo path is reproducible outside the maintainer loop.

This is intentionally narrower than #77: no Docker, no hosted services, no Cursor setup required.