# Demo Gallery

These demos are runnable from this repository and produce signed receipts. Use the
standalone verifier at `tools/verify/verify.mjs` with the demo issuer key in
`tools/verify/runx-demo-jwks.json`.

`docs/demo-inventory.json` is the machine-checked source of truth for featured
demos, runnable previews, and fixture support.

```sh
export RUNX_RECEIPT_SIGN_KID=runx-demo-key
export RUNX_RECEIPT_SIGN_ED25519_SEED_BASE64=QkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkI=
export RUNX_RECEIPT_SIGN_ISSUER_TYPE=hosted
```

## Shipped Demos

| Demo | Proof | Run | Gate |
| --- | --- | --- | --- |
| `examples/hello-world` | Native CLI top-level skill and harness baseline. | `runx harness examples/hello-world` | harness |
| `skills/business-ops` | Launch routing stops sends and spend at their gates, requires provider evidence, persists a route, and proves idempotent replay. | `runx harness skills/business-ops` | harness |
| `skills/data-store` | A provider-agnostic data operation appends and reads durable SQLite state through a governed adapter envelope. | `runx harness skills/data-store/fixtures/append-read-sqlite-event.yaml` | harness |
| `examples/github-mcp-hero` | GitHub MCP repo read succeeds, out-of-scope write is refused, and the denial receipt verifies offline. | `sh examples/github-mcp-hero/run.sh` | harness |
| `examples/openapi-graph` | An OpenAPI-described operation is executed through the governed external-adapter lane and sealed. | `sh examples/openapi-graph/run.sh` | harness |
| `skills/nws-weather-forecast` | The official NWS skill executes through native `http.read` and seals stable provider metadata. | `runx harness skills/nws-weather-forecast/fixtures/nws-forecast-washington-monument.yaml` | live external |
| `examples/loop-orchestration` | A bounded outer loop submits governed runx turns, prints receipt ids and next-turn reasons, demonstrates `context_skills`, and includes a refusal path. | `sh examples/loop-orchestration/run.sh` | harness |

## Payment Contract Proof

The internal `mock-charge`, `mock-pay`, and `mock-refund` packages provide the
only local payment simulation and always report `money_moved: false`. Public
payment packages use hosted provider-response fixtures that prove approval,
idempotency, mutation, and readback contracts without embedding a rail
implementation in OSS. Real settlement dogfood belongs to Runx Hosted.

The upstream x402 conformance and interop scripts remain protocol checks only;
they are not local payment adapters and do not prove a Runx-hosted settlement.

## Verify A Receipt

The verifier is independent of runx runtime code. It recomputes the canonical
receipt body hash, checks the content-addressed receipt id, verifies the Ed25519
signature, and can walk receipt ancestry from top-level receipt-store artifacts.

```sh
node tools/verify/verify.mjs /path/to/receipt.json \
  --jwks tools/verify/runx-demo-jwks.json

node tools/verify/verify.mjs /path/to/graph-root-receipt.json \
  --jwks tools/verify/runx-demo-jwks.json \
  --walk-ancestry \
  --receipt-dir /path/to/receipt-store
```

All demos call `tools/verify/verify.mjs` directly; there is no second verifier
entrypoint to drift from the canonical implementation.