autonomy demo contract-refine

Demo the ContractRefine preflight → repair → bind → execute loop

Synopsis

Runs a self-contained, demo-neutral walkthrough of the ContractRefine
loop end-to-end:

  POST /v1/preflight    — verifier returns a passing PreflightDecision
  POST /v1/tool         — with X-Autonomy-Preflight-Id: <id>; 200 allow
  GET  /v1/audit/{id}   — returns both preflight + decision frames in
                          chronological order (INV-CR-8 join)

The embedded policy bundle declares requires_preflight=true, so a
/v1/tool call WITHOUT the header is denied at the runtime binding
layer (contract: preflight_required). The Rego rule additionally
requires input.preflight.outcome == "pass", so repair_required and
deny verdicts also fail at the policy layer. Both gates fire under
mode=enforce.

No Docker, external registry, or control-plane connection is needed.
The demo writes only to a local WAL directory (see --keep /
AUTONOMY_DEMO_WAL_DIR for footprint control).

A "System footprint (this run)" panel is printed before exit so the
operator can inspect the artifacts on disk.

See docs/runbooks/contract-refine-demo.md for the runbook + failure
drills (which demonstrate the deny paths for missing header, kind
mismatch, expired, and replay).

Usage

autonomy demo contract-refine [flags]

Options

      --keep   preserve the auto-generated WAL directory instead of removing it on exit

Options inherited from parent commands

      --require-signed-manifest   Refuse to start if the SHA256SUMS release manifest or its cosign signature is missing/invalid (Tier 2 binary-integrity check; default: build-time compile-in via -ldflags -X, build-hardened artifacts=true, all others=false)

See also

• autonomy demo — Run self-contained demos that require no Docker or control plane