From ab83cb2d75093027833723b0a824fb7359009f7a Mon Sep 17 00:00:00 2001 From: mdheller <21163552+mdheller@users.noreply.github.com> Date: Thu, 7 May 2026 02:46:14 -0400 Subject: [PATCH 1/2] Add OpsHistory end-to-end dry-run demo script --- scripts/ops_history_dry_run_demo.py | 119 ++++++++++++++++++++++++++++ 1 file changed, 119 insertions(+) create mode 100644 scripts/ops_history_dry_run_demo.py diff --git a/scripts/ops_history_dry_run_demo.py b/scripts/ops_history_dry_run_demo.py new file mode 100644 index 0000000..a9c8925 --- /dev/null +++ b/scripts/ops_history_dry_run_demo.py @@ -0,0 +1,119 @@ +#!/usr/bin/env python3 +"""Assemble the OpsHistory end-to-end dry-run demo plan. + +This script is intentionally contract-only. It does not connect to Matrix, read browser +profiles, export receipts, write Memory Mesh entries, run AgentPlane bundles, or call +external services. It emits a JSON plan that points at the validation commands in the +other repos participating in the dry-run demo. +""" + +from __future__ import annotations + +import json +import sys +from pathlib import Path +from typing import Any + +ROOT = Path(__file__).resolve().parents[1] +SRC = ROOT / "src" +if str(SRC) not in sys.path: + sys.path.insert(0, str(SRC)) + +from agent_term.ops_history import ( # noqa: E402 + context_pack_plan, + policy_explain, + redactions_pending, + replay_plan, +) + + +def build_demo() -> dict[str, Any]: + """Return the cross-repo OpsHistory dry-run demo envelope.""" + + agent_term_policy = policy_explain("active-multi-agent-room") + agent_term_replay = replay_plan("demo-search") + agent_term_context_pack = context_pack_plan( + "pi-demo", + topic="urn:srcos:topic:professional-intelligence", + ) + agent_term_redactions = redactions_pending() + + return { + "demoId": "urn:srcos:ops-history-demo:end-to-end-dry-run-0001", + "demoKind": "ops-history-end-to-end-dry-run", + "dryRun": True, + "operatorSurface": "SourceOS-Linux/agent-term", + "plans": { + "agentTermPolicy": agent_term_policy, + "agentTermReplay": agent_term_replay, + "agentTermContextPack": agent_term_context_pack, + "agentTermRedactions": agent_term_redactions, + }, + "externalValidation": [ + { + "repo": "SourceOS-Linux/sourceos-spec", + "command": "make validate-ops-history-examples", + "purpose": "Validate shared OpsHistory typed contracts.", + }, + { + "repo": "SocioProphet/policy-fabric", + "command": "make ops-history-policy-validate", + "purpose": "Validate Policy Fabric OpsHistory decision families.", + }, + { + "repo": "SocioProphet/agent-registry", + "command": "make ops-history-grants-validate", + "purpose": "Validate Agent Registry dry-run authority grant examples.", + }, + { + "repo": "SocioProphet/memory-mesh", + "command": "python scripts/validate_ops_history_context_pack.py", + "purpose": "Validate bounded Memory Mesh context-pack references.", + }, + { + "repo": "SocioProphet/agentplane", + "command": "make validate-ops-history-contracts", + "purpose": "Validate AgentPlane context/evidence references.", + }, + { + "repo": "SourceOS-Linux/BearBrowser", + "command": "bearbrowser-history export explain --session demo --profile agent-runtime --dry-run", + "purpose": "Validate BearHistory metadata-only export posture.", + }, + { + "repo": "SourceOS-Linux/sourceos-shell", + "command": "python scripts/validate_ops_history_receipts.py", + "purpose": "Validate operational receipt metadata with content capture disabled.", + }, + ], + "safetyBoundary": { + "liveSync": False, + "liveMatrix": False, + "browserProfileRead": False, + "browserCredentialAccess": False, + "browserCookieAccess": False, + "receiptContentCapture": False, + "memoryWriteback": False, + "agentplaneExecution": False, + "externalBridgeExport": False, + }, + "expectedOutcomes": [ + "AgentTerm emits policy/replay/context-pack/redaction plans.", + "Policy Fabric admits summary-only or ref-only decisions where appropriate.", + "Agent Registry grants are dry-run scoped and deny sensitive payload access by default.", + "Memory Mesh accepts bounded context-pack references without writeback.", + "AgentPlane accepts context/evidence references without execution behavior changes.", + "BearBrowser denies human-secure export and admits agent-runtime metadata-only posture.", + "sourceos-shell receipts keep content capture disabled by default.", + "Redaction/tombstone posture invalidates downstream derived refs in dry-run.", + ], + } + + +def main() -> int: + print(json.dumps(build_demo(), indent=2, sort_keys=True)) + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) From adaa06128389af2d03d2d9b634e3c09ecc66e61a Mon Sep 17 00:00:00 2001 From: mdheller <21163552+mdheller@users.noreply.github.com> Date: Thu, 7 May 2026 02:58:16 -0400 Subject: [PATCH 2/2] Add OpsHistory end-to-end dry-run demo docs --- docs/demos/ops-history-end-to-end-dry-run.md | 68 ++++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 docs/demos/ops-history-end-to-end-dry-run.md diff --git a/docs/demos/ops-history-end-to-end-dry-run.md b/docs/demos/ops-history-end-to-end-dry-run.md new file mode 100644 index 0000000..2d80d86 --- /dev/null +++ b/docs/demos/ops-history-end-to-end-dry-run.md @@ -0,0 +1,68 @@ +# OpsHistory End-to-End Dry-Run Demo + +Status: deterministic dry-run demo plan. + +This demo proves the OpsHistory contract capture can be exercised across the estate without enabling live services. + +## Run + +```bash +python scripts/ops_history_dry_run_demo.py +``` + +The script emits JSON with: + +- AgentTerm policy explanation plan; +- AgentTerm replay plan; +- AgentTerm context-pack plan; +- AgentTerm redaction posture; +- external validation commands for sourceos-spec, Policy Fabric, Agent Registry, Memory Mesh, AgentPlane, BearBrowser, and sourceos-shell; +- explicit no-live-side-effect safety boundary. + +## Safety boundary + +The demo must keep all of these disabled: + +- live sync; +- live Matrix; +- browser profile reads; +- browser credential access; +- browser cookie access; +- operational content capture; +- Memory Mesh writeback; +- AgentPlane execution; +- external bridge/export. + +## Estate validation commands + +```bash +# SourceOS-Linux/agent-term +ruff check . +pytest +python scripts/ops_history_dry_run_demo.py + +# SourceOS-Linux/sourceos-spec +make validate-ops-history-examples + +# SocioProphet/policy-fabric +make ops-history-policy-validate + +# SocioProphet/agent-registry +make ops-history-grants-validate + +# SocioProphet/memory-mesh +python scripts/validate_ops_history_context_pack.py + +# SocioProphet/agentplane +make validate-ops-history-contracts + +# SourceOS-Linux/BearBrowser +bearbrowser-history export explain --session demo --profile agent-runtime --dry-run + +# SourceOS-Linux/sourceos-shell +python scripts/validate_ops_history_receipts.py +``` + +## Non-goals + +This demo does not implement `ops-historyd`, `bearhistoryd`, live receipt adapters, Memory Mesh writeback, AgentPlane execution, or bridge/export runtime behavior.