Skip to content

fix(demo)+feat(attest,graph): harden demo path, MCP attest CLI, store-backed auto-enable - #4336

Merged
andres-linero merged 3 commits into
mainfrom
cursor/p0-p1-audit-fixes-6ba6
Jul 21, 2026
Merged

fix(demo)+feat(attest,graph): harden demo path, MCP attest CLI, store-backed auto-enable#4336
andres-linero merged 3 commits into
mainfrom
cursor/p0-p1-audit-fixes-6ba6

Conversation

@msaad00

@msaad00 msaad00 commented Jul 21, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Owner

Summary

Closes the 2026-07-21 audit P0/P1 gaps in one PR (does not touch hosted-poc compose anonymous-demo wiring — that stays in #4335).

  • Demo resilience: demo-redeploy triggers on successful Release workflow_run (GITHUB_TOKEN-safe), builds images before up -d, fails loud if DEMO_DEPLOY_DIR is not a git checkout; Deployment Freshness probes demo.agent-bom.com/health; README documents uvx agent-bom scan --demo --offline fallback.
  • MCP attest user surface: agent-bom attest mcp sign|verify derives evidence from scan JSON; 0.96.4 changelog line narrowed to “foundation”; CLI_MAP + site-docs updated.
  • Store-backed default path: unset AGENT_BOM_GRAPH_STORE_BACKED_BUILD auto-enables above AGENT_BOM_GRAPH_STORE_BACKED_MIN_ENTITIES (default 5000); explicit off preserved; ADR-006 + env allowlist updated.
  • README visuals: how-it-works + blast-radius light/dark diagrams simplified to the three-lane product story and a single blast-radius path.
  • CI hygiene: drop no-op dependency-pin-check.yml and the non-blocking main-only ci.yml agent-bom-scan job (covered by PR Security Gate + post-merge self-scan).

Verification

uv run ruff check src/
uv run mypy src/agent_bom/mcp_scan_attestation.py src/agent_bom/cli/_attest_group.py src/agent_bom/api/pipeline.py --ignore-missing-imports --disable-error-code import-untyped
uv run pytest -q tests/test_mcp_attest_cli.py tests/api/test_store_backed_auto_enable.py tests/test_mcp_scan_attestation.py
# 28 passed
uv run pre-commit run --files <changed files>   # ruff/format/bandit/env-var/comment hygiene passed; mypy hook follows imports into pre-existing no-any-return elsewhere
uv run agent-bom scan --demo --offline -f json -o /tmp/demo-smoke.json
# demo smoke produced findings JSON (exit 1 expected for critical findings)
uv run agent-bom attest mcp --help

Notes

  • Host restore for a live 502 remains an operator/VM concern; this PR hardens redeploy trigger + monitoring + local fallback.
  • Residual store-backed peak is still O(N) — docs state measured reduction, not a strict memory bound.
  • Intentionally avoids deploy/docker-compose.hosted-poc.yml to stay clear of fix(deploy)+feat(auth): self-host first-run bootstrap, anonymous demo, and guided OIDC/SSO setup #4335.
  • Develop-skill style local gates run before this push; waiting on CI to finish (do not stack follow-up commits unless CI is red for a real failure).

how-it-works light
blast-radius light

To show artifacts inline, enable in settings.

Open in Web Open in Cursor 

@cursoragent @msaad00
fix(demo)+feat(attest,graph): harden demo redeploy, MCP attest CLI, s…
469432f 
…tore-backed auto-enable

Close audit P0/P1 gaps without overlapping the open self-host compose PR:
- demo redeploy on Release workflow_run, build-then-up, loud DEMO_DEPLOY_DIR check
- daily demo.agent-bom.com/health freshness in deployment-freshness
- agent-bom attest mcp sign|verify from scan JSON + docs/changelog honesty
- auto-enable store-backed UnifiedGraph above entity threshold (default 5000)
- simplify README how-it-works and blast-radius diagrams (light/dark)

Co-authored-by: W S <msaad00@users.noreply.github.com>
@agent-bom
agent-bom marked this pull request as ready for review July 21, 2026 05:41
@cursoragent @msaad00
fix(ci)+chore(ci): clear mypy on MCP attest path; drop redundant CI n…
b49b062 
…oise

- Narrow list narrowing / Sequence typing in mcp_scan_attestation so Lint
  mypy passes for attest mcp evidence derivation.
- Remove no-op dependency-pin-check workflow and non-blocking main-only
  ci agent-bom-scan job (PR Security Gate + post-merge self-scan cover it).

Co-authored-by: W S <msaad00@users.noreply.github.com>
@cursor
cursor Bot requested a review from andres-linero as a code owner July 21, 2026 05:49
@andres-linero
andres-linero enabled auto-merge (squash) July 21, 2026 05:50
andres-linero
andres-linero previously approved these changes Jul 21, 2026
View reviewed changes
agent-bom
agent-bom previously approved these changes Jul 21, 2026
View reviewed changes
@msaad00
fix(docs): regenerate blast-radius SVGs marker-free for GitHub-safe e…
3132df1 
…mbeds

The committed SVGs were stale — they carried <marker>/marker-end refs that
GitHub's SVG sanitizer strips, failing test_generated_svgs_are_github_safe.
The generator already draws arrowheads as inline <polygon>; regenerating
brings the committed files back in sync.
@msaad00
msaad00 dismissed stale reviews from agent-bom and andres-linero via 3132df1 July 21, 2026 05:52
@andres-linero
andres-linero merged commit 2efc2d4 into main Jul 21, 2026
30 checks passed
@andres-linero
andres-linero deleted the cursor/p0-p1-audit-fixes-6ba6 branch July 21, 2026 06:11
@msaad00 msaad00 mentioned this pull request Jul 21, 2026
Merged
andres-linero pushed a commit that referenced this pull request Jul 21, 2026
@msaad00 @cursoragent
chore(release): prepare 0.97.2 (#4347)
b6fec95 
<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
## Summary

- Bump release-managed package, UI, Docker, Helm, registry, OpenClaw,
Snowflake, and docs surfaces to **0.97.2**.
- Move `[Unreleased]` into the `0.97.2` changelog covering auth/OIDC
bootstrap (#4335), Helm first-install auth Secrets (#4337), attest CLI +
demo/store-backed graph (#4336), and MCP honesty / audit exit codes
(#4346).
- Promote simplified teal blast-radius SVGs (replacing the denser
violet-accent art that lagged how-it-works) and align
`product-screenshots.json` metadata (no full PNG recapture).

## Verification

```bash
uv run agent-bom --version   # 0.97.2
uv run agent-bom scan --demo --offline -o /tmp/ab-demo-scan.json
uv run agent-bom attest mcp sign ... --server filesystem-server --tenant-id demo  # signed=true
uv run agent-bom attest mcp verify ... --public-key ... --tenant-id demo
uv run agent-bom auth setup-oidc --provider google --client-id demo-client --base-url https://example.internal --non-interactive
helm lint deploy/helm/agent-bom
helm template ab deploy/helm/agent-bom -f deploy/helm/agent-bom/examples/eks-control-plane-sqlite-pilot-values.yaml
uv run python scripts/bump-version.py 0.97.2 --check
uv run python scripts/check_release_consistency.py
uv run python scripts/check_product_surface_contract.py
uv run python scripts/export_openapi.py --check
uv run python scripts/generate_agent_capability_manifest.py --check
uv run python scripts/lint_release_workflow.py .github/workflows/release.yml
uv run pytest -q tests/test_version_alignment.py tests/test_mcp_attest_cli.py
# 9 passed
curl -fsS https://demo.agent-bom.com/health
# status=ok, version=0.97.1 (hosted still on prior tag until release), unauthenticated_allowed=true
```

## Notes

- Prepares the release only; does **not** tag or publish PyPI/Docker.
- After merge: tag `v0.97.2` via the normal Release workflow.
- `#4344` (external pre-install dependency risk signal proposal) is
intentionally deferred — not a patch blocker.
- Screenshot PNGs remain the same-day 0.97.1 DEMO DATA capture; manifest
`visible_version`/`release_version` aligned for the release gate.
<!-- CURSOR_AGENT_PR_BODY_END -->

<div><a
href="https://cursor.com/agents/bc-a579ae44-c48d-4515-8cf6-2da701406ba6"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a
href="https://cursor.com/background-agent?bcId=bc-a579ae44-c48d-4515-8cf6-2da701406ba6"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div>

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: W S <msaad00@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@andres-linero andres-linero andres-linero approved these changes
@agent-bom agent-bom agent-bom approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@msaad00 @andres-linero @agent-bom @cursoragent