ci: add PoCI conformance gate and runnable evidence demo

[safal207]

What changed

Adds the fourth PoCI v0.1 slice:

• a dedicated PoCI GitHub Actions workflow;
• an exact 12-fixture corpus guard that prevents an empty or drifting fixture set from passing;
• Python compilation and all test_poci*.py conformance tests as a CI gate;
• generation and validation of a machine-readable conformance report;
• a deterministic reviewer demo that verifies a valid envelope as ACCEPT, then detects result-digest substitution as CHALLENGE;
• portable ACCEPT, CHALLENGE, summary, and transcript reports;
• GitHub Actions artifact upload with fail-on-missing behavior;
• a demo export integration test, expected transcript, quickstart, and architecture diagram.

Reviewer command

python3 examples/poci-witness/run_demo.py --check

Expected decisions:

• valid-action.accept.json -> ACCEPT
• result-digest-mismatch.challenge.json -> CHALLENGE / RESULT_DIGEST_MISMATCH

CI contract

The workflow fails when:

• the manifest does not contain exactly 12 unique fixtures;
• manifest entries and committed fixture filenames diverge;
• Python entrypoints do not compile;
• any conformance, mutation, determinism, or demo test fails;
• the generated report does not pass all 12 cases;
• demo output drifts from the committed transcript;
• expected report files are missing at artifact upload.

Successful runs upload poci-conformance-<run_id> for 14 days.

Security boundary

The demo proves deterministic evidence evaluation and tamper detection in the committed mock scenario. It does not prove model truthfulness, real hardware identity, TEE or zkML correctness, witness independence, or objective real-world truth.

Stacked PR

Base: agent/poci-python-verifier-v0.1 / #195

Review and merge after #195, then retarget to main if GitHub does not do so automatically.

Backlog

Epic: #180

Advances:

• P0: Add PoCI validation and cross-language checks to CI #188 — Python CI gate and report artifacts; Python/Rust root comparison remains deferred until P1: Extend Rust verifier with PoCI envelope validation #186 exists
• P0: Build runnable PoCI end-to-end evidence demo #190 — runnable end-to-end evidence demo

Next:

• independent Rust PoCI verifier and golden-root parity (P1: Extend Rust verifier with PoCI envelope validation #186)
• ecosystem adapter map (P1: Map PoCI adapters to CML, LTP/T-Trace, LiminalDB, and Ibex #191)

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e52f862a-4b5a-418d-9fae-7f0b1334a3f5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[safal207]

Validation complete

Both workflows passed on head 1ec1ef999f2e54a2045662c1440f1f726d1db19c:

• PoCI run Write ProofPath HTTP Profile v0.1 #1 — success. Corpus guard, Python compilation, all PoCI tests, conformance report generation, reviewer demo, and artifact upload all completed successfully.
• Rust run #268 — success.

Uploaded artifact:

• poci-conformance-30591789944
• artifact id: 8778614392
• size: 3346 bytes
• SHA-256: 718265c448304d8f0587b00cf8c8c18afce182cf246404f075f0bc183fe112e7
• expires: 2026-08-13T23:51:21Z

The Python/Rust PoCI golden-root comparison remains outside this PR and waits for #186.