Golden rule: run pnpm demo:reset first. It re-asserts fixtures, clears run artifacts and closes PRs — most “demo looks wrong” reports are un-reset state from a previous run. Then re-check the console’s health grid.
  • Seed data / RFC lifecycle state → pnpm demo:reset (drift), then pnpm demo:seed if counts are still short.
  • LLM config → must read openai/gpt-4.1. Anything else and S5/S7 go non-deterministic. Fix in the ACME org’s Settings → LLM or re-run pnpm demo:provision.
  • Plan → the team subscription row is provision-owned; re-run provision.
  • GitHub App → installation 153344346 must be claimed by the ACME org in codex.github_installations (see the unclaimed-installation entry below).
  • MCP → the worker itself; see Smoke tests.
Model drift is the first suspect: the ACME org’s LLM must be openai/gpt-4.1 (bake-off results: gpt-4o/4o-mini miss the violation, gemini-2.5-flash hallucinates findings, Anthropic-via-OpenRouter breaks response_format: json_object and fails the parse). Second suspect: someone edited the fixtures — the determinism constraints are listed on Scenarios. Reproduce via /v1/check with the ACME key and gh pr diff before blaming the model.
Same as production (web troubleshooting): wait 2 minutes, then check for unclaimed installation in worker logs. Demo-specific cause: two orgs claiming installation 153344346 once made the lookup return null and every webhook dropped — the DB now has a unique index on installation_id and the connect flow refuses to steal a claimed installation, but if it recurs, exactly one row in github_installations may hold that id (ACME’s org cc8d928f-…). Re-trigger with close/reopen.
The ruleset policycodex-required on acme-payments-api must be active and pin check PolicyCodex to integration 4542396. demo:github setup recreates it; note setup temporarily disables it around its own force-push — a crash in that window could leave it disabled (re-run setup).
Force-pushed history under open PRs pins stale merge bases. Fix: pnpm demo:github cleanup then re-open PRs. setup now does this automatically — this entry exists for manually created PRs.
The latent violation is src/sessions.ts (plain-JSON 404). If the scan is clean: (1) scan cooldown may have returned a cached-looking run — clear the org’s pending_scans row; (2) the worker’s scan-mode prompt may have regressed to diff framing (a real bug once: the model audits “the change” in a file dump and finds nothing); (3) main may have drifted — pnpm demo:github setup restores canonical content.
Console actions require domain_owner of the ACME demo org or of the internal org. The demo author/viewer accounts are locked out by design. Sign in as owner+clerk_test@acme.example.com (OTP 424242).
Intended: History baselines at the latest demo.reset audit row. The full chain is under Settings → Audit. See Reporting.
Test-mode accounts use the fixed email OTP 424242 (choose “Use another method” → email code if the password is unknown). The accounts live on the Clerk development instance — if the sign-in page is not active-cheetah-78.accounts.dev, the SPA was built with the wrong publishable key.
Pass the model explicitly (-m openrouter/anthropic/claude-sonnet-4-6 — a stale default model errors), and confirm the policycodex MCP entry carries the ACME key (prefix pcx_1081ab83). A key for a different org changes statements_considered and the answers.

​
Useful one-liners