Twenty runnable demos: wiring fedramplens into a CI gate

[cognis-digital]

The demo corpus grew from five to twenty audience-targeted scenarios, all driving the real API offline and exiting 0 (PYTHONUTF8=1 python demos/run_all.py).

One worth calling out for teams: 07_ci_gate_sarif_upload.py. It mirrors exactly what a pipeline step does — analyze the boundary, emit SARIF 2.1.0 for code-scanning, and fail the job (non-zero exit) when the package is not authorization-ready. Because the CLI already returns 1 on any high/critical finding and 0 when ready, a workflow step is just:

- run: fedramplens --format sarif analyze boundary.json > fedramp.sarif
- uses: github/codeql-action/upload-sarif@v3
  with: { sarif_file: fedramp.sarif }
- run: fedramplens analyze boundary.json   # exits 1 -> fails the build if not ATO-ready

Other new scenarios cover an AO risk dashboard (06), a POA&M tracker (09), external-dependency inventory (10), a boundary hygiene lint you can run pre-commit (11), air-gap snapshot transfer of the OSCAL catalog (14), and a full analyze→SARIF→diagram→SSP→POA&M pipeline capstone (20). How are you gating FedRAMP readiness in your pipelines today?