feat(demo): add Claude and ANF booth proof

.github/workflows/ci.yml

@@ -24,23 +24,26 @@ jobs:
       - name: Download modules
         run: go mod download
 
-      - name: Verify gofmt
-        run: |
-          FILES=$(find . -name '*.go' -not -path './.git/*')
-          UNFORMATTED=$(gofmt -l $FILES)
-          if [ -n "$UNFORMATTED" ]; then
-            echo "Unformatted Go files:"
-            echo "$UNFORMATTED"
-            exit 1
-          fi
+      - name: Download nested ANF snapshot modules
+        working-directory: tools/anf-snapshot
+        run: go mod download
 
       - name: Verify go.mod/go.sum are tidy
         run: |
           go mod tidy
           git diff --exit-code go.mod go.sum
 
-      - name: Run go vet
-        run: go vet ./...
+      - name: Verify nested ANF snapshot go.mod/go.sum are tidy
+        working-directory: tools/anf-snapshot
+        run: |
+          go mod tidy
+          git diff --exit-code go.mod go.sum
+
+      - name: Run canonical lint
+        run: make lint
+
+      - name: Run nested ANF snapshot vet
+        run: make vet-anf-snapshot
 
       - name: Install envtest binaries
         run: |
@@ -51,6 +54,9 @@ jobs:
       - name: Run Go tests
         run: go test ./api/... ./pkg/... ./internal/... -count=1
 
+      - name: Run nested ANF snapshot tests
+        run: make test-anf-snapshot GO_TEST_FLAGS="-count=1"
+
   landing-build:
     name: Landing Lint and Build
     runs-on: ubuntu-latest

.github/workflows/oss-private-boundary-guard.yml

@@ -19,6 +19,10 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Test boundary scanner
+        shell: bash
+        run: bash tests/smoke/test_oss_private_boundary.sh
+
       - name: Validate OSS/private boundary policy
         shell: bash
         run: |

.github/workflows/test-gates.yml

@@ -10,7 +10,9 @@ on:
       - "cmd/**"
       - "agents/**"
       - "charts/**"
-      - "scripts/scan_secrets.sh"
+      - "scripts/**"
+      - "tests/smoke/**"
+      - "examples/**"
       - ".github/workflows/test-gates.yml"
   push:
     branches:
@@ -23,7 +25,9 @@ on:
       - "cmd/**"
       - "agents/**"
       - "charts/**"
-      - "scripts/scan_secrets.sh"
+      - "scripts/**"
+      - "tests/smoke/**"
+      - "examples/**"
       - ".github/workflows/test-gates.yml"
   schedule:
     - cron: "0 3 * * *"
@@ -42,6 +46,9 @@ jobs:
       - name: Quick secret scan
         run: make scan-secrets
 
+      - name: Run booth CLI smoke tests
+        run: bash tests/smoke/test_demo_booth_cli.sh
+
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
@@ -59,5 +66,31 @@ jobs:
       - name: Run Go tests
         run: make test-go
 
+      - name: Install helm-unittest plugin
+        run: |
+          # Build the plugin from an immutable source commit. Do not run its
+          # installer hook, which downloads a mutable release asset.
+          plugin_dir="${RUNNER_TEMP}/helm-unittest"
+          git clone --filter=blob:none https://github.com/helm-unittest/helm-unittest.git "${plugin_dir}"
+          git -C "${plugin_dir}" checkout --detach 9cf59a78dbb89f3e3c70c62d2570cd7e96b97845
+          test "$(git -C "${plugin_dir}" rev-parse HEAD)" = "9cf59a78dbb89f3e3c70c62d2570cd7e96b97845"
+          (
+            cd "${plugin_dir}"
+            CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOTOOLCHAIN=go1.26.0 \
+              go build -trimpath -buildvcs=false -o untt-linux-amd64 \
+              -ldflags "-X github.com/helm-unittest/helm-unittest/internal/build.version=1.1.1 -extldflags '-static'" \
+              ./cmd/helm-unittest
+          )
+          helm_plugins="$(helm env | sed -n 's/^HELM_PLUGINS="\(.*\)"$/\1/p')"
+          test -n "${helm_plugins}"
+          install_dir="${helm_plugins}/unittest"
+          mkdir -p "${install_dir}"
+          install -m 0755 "${plugin_dir}/untt-linux-amd64" "${install_dir}/untt-linux-amd64"
+          install -m 0644 "${plugin_dir}/plugin.yaml" "${install_dir}/plugin.yaml"
+          helm plugin list | grep -Eq '^unittest[[:space:]]+1\.1\.1([[:space:]]|$)'
+
+      - name: Run Helm unit tests
+        run: helm unittest charts
+
       - name: Lint Helm chart
         run: make helm-lint

.gitignore

@@ -56,6 +56,9 @@ manager
 manager
 bin/
 
+# Portable Agentic Summit fallback. Other logs remain ignored.
+!demos/demo-claude-anf.log
+
 # Strategic documents (pitch decks, large media)
 *.mp4
 *.pptx

Makefile

@@ -18,7 +18,7 @@ SETUP_ENVTEST := $(LOCALBIN)/setup-envtest
 STATICCHECK := $(LOCALBIN)/staticcheck
 CONTROLLER_GEN := $(LOCALBIN)/controller-gen
 
-.PHONY: help test validate test-unit test-go test-python setup-envtest test-controller fmt fmt-check vet lint build build-agentctl build-agentctl-web install-agentctl scan-secrets clean-venv check-python-version helm-lint test-cluster test-smoke test-e2e-cluster manifests generate
+.PHONY: help test validate test-unit test-go test-anf-snapshot vet-anf-snapshot verify-anf-snapshot test-python setup-envtest test-controller fmt fmt-anf-snapshot fmt-check fmt-check-anf-snapshot vet lint staticcheck-anf-snapshot build build-agentctl build-agentctl-web build-anf-snapshot install-agentctl scan-secrets clean-venv check-python-version helm-lint test-cluster test-smoke test-e2e-cluster manifests generate
 
 .DEFAULT_GOAL := help
 
@@ -27,15 +27,21 @@ help:
 	@echo "  make test           - Run go + python tests"
 	@echo "  make validate       - Run canonical validation sequence"
 	@echo "  make test-go        - Run go tests (excluding envtest controller)"
+	@echo "  make test-anf-snapshot - Run nested ANF snapshot tests"
+	@echo "  make vet-anf-snapshot - Run nested ANF snapshot vet checks"
 	@echo "  make test-python    - Run python agent tests (creates .venv automatically)"
 	@echo "  make test-controller - Run envtest controller suite"
 	@echo "  make fmt            - Format go code"
+	@echo "  make fmt-anf-snapshot - Format nested ANF snapshot go code"
 	@echo "  make fmt-check      - Fail if go files are not formatted"
+	@echo "  make fmt-check-anf-snapshot - Check nested ANF snapshot formatting"
 	@echo "  make vet            - Run go vet"
 	@echo "  make lint           - Run lint checks"
+	@echo "  make staticcheck-anf-snapshot - Run nested ANF snapshot staticcheck"
 	@echo "  make manifests      - Generate CRD manifests"
 	@echo "  make generate       - Generate code (deepcopy + go generate)"
 	@echo "  make build          - Build go binaries"
+	@echo "  make build-anf-snapshot - Build the live ANF namespace snapshot CLI"
 	@echo "  make helm-lint      - Lint the Helm chart"
 	@echo "  make scan-secrets   - Run repository secret scan"
 	@echo ""
@@ -44,9 +50,9 @@ help:
 	@echo "  make test-smoke     - Smoke tests only (cluster must be pre-installed)"
 	@echo "  make test-e2e-cluster - E2E tests only (cluster must be pre-installed)"
 
-test: test-go test-python
+test: test-go test-anf-snapshot test-python
 
-validate: fmt-check lint test-controller test-go test-python helm-lint
+validate: fmt-check lint test-controller test-go test-anf-snapshot vet-anf-snapshot test-python helm-lint
 
 test-unit: test
 
@@ -59,6 +65,16 @@ test-go:
 	fi; \
 	$(GO) test $$pkgs $(GO_TEST_FLAGS)
 
+test-anf-snapshot:
+	@echo "Running nested ANF snapshot tests..."
+	@cd tools/anf-snapshot && $(GO) test ./... $(GO_TEST_FLAGS)
+
+vet-anf-snapshot:
+	@echo "Running nested ANF snapshot vet checks..."
+	@cd tools/anf-snapshot && $(GO) vet ./...
+
+verify-anf-snapshot: test-anf-snapshot vet-anf-snapshot
+
 check-python-version:
 	@$(PYTHON) -c 'import sys; assert sys.version_info < (3, 13), "test-python requires Python <= 3.12 due dependency pins; run with PYTHON=python3.12"'
 
@@ -116,11 +132,18 @@ test-controller: $(SETUP_ENVTEST)
 	@assets="$$( $(SETUP_ENVTEST) use -p path $(ENVTEST_K8S_VERSION) )"; \
 	KUBEBUILDER_ASSETS="$$assets" $(GO) test ./internal/controller/... $(GO_TEST_FLAGS)
 
-fmt:
+fmt: fmt-anf-snapshot
 	@echo "Formatting Go code..."
 	@$(GO) fmt ./...
 
-fmt-check:
+fmt-anf-snapshot:
+	@echo "Formatting nested ANF snapshot Go code..."
+	@files="$$(find tools/anf-snapshot -type f -name '*.go' -print)"; \
+	if [[ -n "$$files" ]]; then \
+		gofmt -w $$files; \
+	fi
+
+fmt-check: fmt-check-anf-snapshot
 	@echo "Checking Go formatting..."
 	@unformatted="$$(gofmt -l $$(git ls-files '*.go'))"; \
 	if [[ -n "$$unformatted" ]]; then \
@@ -129,11 +152,24 @@ fmt-check:
 		exit 1; \
 	fi
 
+fmt-check-anf-snapshot:
+	@echo "Checking nested ANF snapshot Go formatting..."
+	@unformatted="$$(gofmt -l $$(find tools/anf-snapshot -type f -name '*.go' -print))"; \
+	if [[ -n "$$unformatted" ]]; then \
+		echo "The following nested ANF snapshot files are not gofmt-formatted:"; \
+		echo "$$unformatted"; \
+		exit 1; \
+	fi
+
 vet:
 	@echo "Running go vet..."
 	@$(GO) vet ./...
 
-lint: vet fmt-check $(STATICCHECK)
+staticcheck-anf-snapshot: $(STATICCHECK)
+	@echo "Running nested ANF snapshot staticcheck..."
+	@cd tools/anf-snapshot && PATH="$(LOCALBIN):$$PATH" $(STATICCHECK) ./...
+
+lint: vet fmt-check staticcheck-anf-snapshot $(STATICCHECK)
 	@echo "Running staticcheck..."
 	@PATH="$(LOCALBIN):$$PATH" $(STATICCHECK) ./...
 
@@ -151,6 +187,11 @@ build-agentctl-web:
 	@mkdir -p bin
 	@$(GO) build -o bin/agentctl-web ./cmd/agentctl-web/...
 
+build-anf-snapshot:
+	@echo "Building anf-snapshot binary..."
+	@mkdir -p bin
+	@cd tools/anf-snapshot && $(GO) build -o ../../bin/anf-snapshot .
+
 install-agentctl: build-agentctl
 	@if [[ ! -f bin/agentctl ]]; then \
 		echo "agentctl binary not found at bin/agentctl"; \