Running the Demos

Running the Demos

Python standard library only. No pip install is needed to run anything below. Tests need pytest. All demos use the mock rail: no PayPal network, no PayPal credentials.

Which demos need an LLM

Command	LLM needed?	Dashboard	Flags (from argparse)	Verified at 9900817
python demo.py	No	—	--sandbox (prints guidance and exits)	✅ exit 0, VERIFIED (15 receipts)
python demo_sla_escrow.py --fast	No	—	--fast	✅ exit 0 (17 receipts)
python trace.py	No	—	none	✅ exit 0, TRACE COMPLETE
python demo_six_beat.py --fast	Yes: PERMIT_GROK_CLI required, or --replay	8471	--replay, --fast, --port	❌ without PERMIT_GROK_CLI: stops at beat 2 with setup guidance
python demo_delegation.py --fast	Yes: PERMIT_GROK_CLI required	8471	--fast, --port	❌ without PERMIT_GROK_CLI: stops with setup guidance
python demo_approval.py --fast	Yes: PERMIT_GROK_CLI required	8474	--fast, --port	❌ without PERMIT_GROK_CLI: stops with setup guidance

PERMIT_GROK_CLI (live agent paths)

• Required, with no default (PR #12). agent/react.py reads it when a live agent turn runs.
• Before the first live agent turn, llm_preflight() checks it:
  • unset → RuntimeError: agent LLM backend not configured: PERMIT_GROK_CLI is not set…
  • set to a path that isn't a file → RuntimeError: agent LLM backend unavailable: '<path>' is not a file…
• The check happens at the first agent beat, not at startup, so earlier non-agent beats (for example six-beat beat 1, the grant) have already printed. The error appears as a Python traceback with the guidance text, exit code 1.
• The runner is invoked as python <PERMIT_GROK_CLI> chat <history> --system … --temperature 0.3 --max-tokens 400 (180 s timeout).

Replay (six-beat only)

python demo_six_beat.py --replay <transcript.jsonl> makes no LLM call and needs no PERMIT_GROK_CLI. It replays the recorded reasoning text and re-executes the recorded tool actions against the live mock tools, remapping recorded ids to fresh ones, so the receipts are real. The replay log goes to <name>.replay.jsonl, and the input file is never truncated.

• No transcript is committed. demo_transcript.jsonl and demo_transcript.replay.jsonl are gitignored. You need one live run with PERMIT_GROK_CLI to record a transcript first.
• demo_delegation.py and demo_approval.py have no --replay.
• demo_six_beat.py has no --hold flag, and no demo has --live. Both still appear in docs/submission-checklist.md.

demo.py: what you see

1. Grant a $50 permit (one merchant, 1 h).
2. $30 spend → hold → release with matching bytes → captured.
3. $30 spend with $20 left → BLOCKED over_remaining_cap. The PayPal authorize count is unchanged.
4. Delegate a $15 sub-permit. The child holds $10. Revoke the parent → cascade revokes the child, the void is confirmed, a later release is refused, and the parent is back to $50.00.
5. ledger chain: VERIFIED (15 receipts).

CI runs this on every push and PR.

demo_six_beat.py beats (code)

Grant $50 → agent buys a $30 license (captured) → $60 attempt blocked → $15 carve, child holds $10, parent revoke cascades → $15 hold with tampered bytes refused → $25 capture applies but the response drops → UNKNOWN → reconcile → exactly one capture.

demo_sla_escrow.py (scenario)

Agent-to-agent settlement with an acceptance signature (predicate A). Output prints 6 beats: grant $100 → $40 carve → accept and capture (rolls up) → forged signature refused and voided → $70 over-delegation blocked (the parent had $30 free at that point) → cascade revoke leaves $40 captured and $60 free.

trace.py

Starts server.py on a free loopback port (since 17943eb; it was fixed at 8741 before) and drives it over HTTP: allowed flow, a blocked attempt that never touches PayPal, delegate + cascade, chain check. If the child server dies on startup, it exits instead of probing a foreign server. It ends with TRACE COMPLETE.

Service and dashboard

python server.py                 # JSON API on 127.0.0.1:8741 (mock)
python3 dashboard/server.py      # empty dashboard on 127.0.0.1:8471

See HTTP API Reference.