Worksoft demo kit

Overview

The Worksoft demo runs on prod (https://app.logrite.ai) as [email protected]: workspace 302 (worksoft-demo), Owner, with the worksoft-cortex add-on enabled. Passwords and keys are in ops/testing/accounts.md (worksoftdemo section); never paste them into the guide.

The presenter’s guide (every pathway, talk track, screenshots and terminal output) is ops/demo/worksoft/guide/ in MasterControl, built to dist/LogRite-Worksoft-Demo-Guide.html, and published unlisted at /r/<hex>/worksoft-demo.html (published copy: see CREDENTIALS.md §0).

Versions on prod (2026-10-14): mcp-server b05d595f2174; ai-service, warden and ingest-shim 2cbcb65b81cb; analyzer d8997f44b881.

What exists in ws 302

Area	What is there
Collector agents	8 seeded Certify service agents (ids 17–24) on Windows hosts, live; see Demo seeder → the Worksoft story
Incident	“Last night’s regression”: LDAP bind account rotated without updating Portal, 170 min, scenario: ldap-rotation
Recurring incidents	Since 2026-10-20 about two a week: scheduler loop crash, DC patching (LDAP server is unavailable), Certify DB processing after a schema upgrade, Results Viewer BaseAddress unset — each with its cause line, burst, recovery and an alerting monitor (“Certify …”). See Demo seeder → Recurring incidents
CTM results	log-analytics-302-worksoft-ctm-results; nightly pass rate ~95%, ~28% in the incident window
SOC 2 evidence	compliance-logs-302, with the password change 10 min before the window
Traces	trace-analytics-raw-302, Portal-rooted errors in the window
Dashboards	4 OSD dashboards and 3 saved searches; see Dashboards
Semantic search	log-analytics-302-worksoft-auth_semantic (5,276 docs) and …-scheduler_semantic (6,601); semantic_search answers mode: hybrid
Cortex	Worksoft pack (68 topics, 50 pages); the six demo questions match. See Cortex add-ons
AI Warden	Business-rules policies 16, 17, 18, 22 and 24 (the former rule sets, ids kept by the 2026-10-15 migration); relay keys 26 and 28 “Certify Assistant (prototype)”
Code	3 projects: worksoft-results-sync, worksoft-ctm-orchestrator (Java), worksoft-certify-bridge (C#), with SOC 2 scans and open PRs
AI coding	20 sessions recorded; issue #9 (secret-in-log, fixed in session)
Live host	WS-CERT-07 (agent id 33), the only collector a logs policy reaches (its former agent_rule_set rows became collector assignments)

Semantic copies

The copies are built off-cluster (on the dev VM, sentence-transformers/all-MiniLM-L6-v2, the same model as the deployed one) from [now-14d, now-48h). They fall inside log-analytics-302-*, so a copy of recent docs would double-count them in Cortex and MCP wildcard queries. The consequence: last night’s incident is not in the copies. Present semantic search as “find LDAP credential errors by meaning”, not as “show last night’s incident”.

Repositories and PRs

Repository	What
Deployd-io/worksoft-results-sync	Python sync from Certify results; also the image of the live host’s mock-certify and results-sync
Deployd-io/worksoft-ctm-orchestrator	Java 17 / Spring Boot; planted secret-in-log and PII lines
Deployd-io/worksoft-certify-bridge	C# / .NET 8 worker; planted secret-in-log and PII lines
ai-service	Seeder story (be6e0be) and knowledge fix (d7491fb)
analyzer	Agent-scan TLS fix (d8997f4)

The demo PRs on the two new repos stay open until after the demo (gh pr list --repo Deployd-io/worksoft-ctm-orchestrator, same for worksoft-certify-bridge).

The kit: ops/demo/worksoft/

Path	What it does
live-host/	Compose project worksoft-live on the dev VM: mock-certify (a new run every MOCK_RUN_INTERVAL_SEC=90 s, MOCK_FAIL_RATE=0.2), results-sync (logs a fake key at DEBUG to /var/log/worksoft/results-sync.log, so a real runtime finding appears), ws-cert-07 (bare Alpine, hostname WS-CERT-07, runs crond). No host ports. up.sh [up|reset|logs]
assistant/	“Worksoft Certify Assistant — powered by LogRite”, stdlib Python. An OAuth MCP client of https://mcp.logrite.ai/sse whose LLM calls go through AI Warden (relay key 28). Compose project worksoft-assistant, 127.0.0.1:8787. up.sh; env file /home/deployd/ops/demo/worksoft/assistant/.env (0600). Tokens and client id live in memory: after a restart, Connect again
preflight.py	One PASS/FAIL line per check, exit 1 on any FAIL: python3 ops/demo/worksoft/preflight.py --mcp <sha12> --password-file <f>
semantic_copy.py	Builds <index>_semantic: --estate prod --source <index> --days 14 --exclude-recent-hours 48 --replace; --delete-only removes it. Aborts above 92% heap
make_samples.py	Deterministic Serilog samples in samples/: AuthenticationService.log (3,000 lines, incident and recovery) and Portal.log (1,500 lines, for the live upload)
sessions/	AI-coding task scripts per repo (=== n | kind | branch ===, then the prompt)
guide/	The presenter’s guide sources and build_guide.py

Dashboards are built and imported with scripts/opensearch/ (see Dashboards).

T-1 day

1. Move the incident to last night. In ops/demo/seeders/.env: WORKSOFT_INCIDENT_AT=$(date -u -d "$(TZ=America/Chicago date +%F) 01:40 CDT" +%FT%TZ) (CST after 2026-11-01).
2. ops/demo/seeders/up.sh, then POST 127.0.0.1:9912/admin/backfill with the seeder admin token; poll 127.0.0.1:9912/health until the backfill finishes with no error. The old incident is purged by scenario.
3. Re-run semantic_copy.py for log-analytics-302-worksoft-auth and …-scheduler.
4. Check the NeuralWatt balance (x-budget-remaining-usd; it was 0.54 on 2026-10-14).
5. preflight.py: every line PASS.

T-1 hour

1. preflight.py again.
2. ssh -L 8787:127.0.0.1:8787 dev, open http://localhost:8787, Connect LogRite.
3. ops/demo/worksoft/live-host/up.sh reset so the live collector install starts clean.
4. Claude Code connected (claude mcp list shows logrite connected).

OAuth flows

Claude Code. curl -fsSL https://mcp.logrite.ai/install.sh | sh, press Enter at the key prompt (OAuth mode). claude mcp list shows ! Needs authentication. In claude, /mcp → logrite → Authenticate prints the authorize URL; sign in, consent (“This client registered itself moments ago” is shown; Delete and revoke is unticked), done.

Caution

OAuth mode installs the generic plugin: /logrite:init says “Re-run the installer to add the Worksoft skill”. See MCP Server → The installer.

claude.ai. Settings → Connectors → Add custom connector → https://mcp.logrite.ai/sse → Connect → the same LogRite consent page. Made live on the presenter’s own account.

Upgrade and revoke. /connect/upgrade/<grantId> (tick Delete and revoke) takes effect on the next tool call. Revoking in Settings → Connections leaves the client with no tools within a minute. Reconnect Claude Code afterwards so a connection exists.

The assistant prototype registers itself as “Worksoft Certify Assistant” (dynamic client registration, PKCE S256, redirect http://localhost:8787/callback).

Known limits

• One shared LLM key, 5 slots. Every estate uses one NeuralWatt key. A burst (for example adding plain-English rules to logs policies that reach many agents, which turns on the analyzer’s NL judge for each) makes Cortex answer “The AI step is unavailable right now”. See AI Models.
• Agent scans. The logs policies 17 and 18 reach every collector (agents 17–24 and WS-CERT-07, id 33); the seeded agents’ findings come from the seeder. AGENT_SCAN_ENABLED is unset; trigger a scan by hand (Analyzer).
• Large uploads through MCP are slow. analyse_log_file from Claude Code with a 190 KB file took 834 s in 3 uploads. Upload live through the Sandbox. An upload becomes log-analytics-<ws>-<name>-<hash>; a file dated today counts as an extra service in Cortex, so the demo sample is dated a week back.
• AI coding. Agents usually self-review through the log-review tool and fix before the turn ends, so no issue is raised. A Python commit logging tester_email scored 0 findings at pre-commit (a detection gap).
• Warden. Policy 24 “Certify Assistant (prototype) — observe” (relay key 28) is On with mode async_observe, yet relay key 28 still BLOCKs a prompt with an IBAN and a DOB through the compliance rule aidatagov_prompt_leak (403 warden_blocked).
• Dashboards import. The UI Import is probably broken (multipart 400); import with import-via-proxy.py.
• Semantic search only on the two _semantic indexes, and they hold nothing from the last 48 h.
• No Windows collector. The collector is bash-only; WS-CERT-07 is a Linux container and reports Alpine as its OS. Certify Windows hosts would ship through WSL or a Linux forwarder.
• Don’t click: governance audit Verify; /analytics-dashboards (use Analytics → Dashboards).

Reset after the demo

1. Delete the WS-CERT-07 agent (UI); the collector self-uninstalls after two 401 check-ins.
2. ops/demo/worksoft/live-host/up.sh reset.
3. Revoke the demo connections in Settings → Connections.
4. Close the demo PRs only if asked.