feat: add governed chat agent selection

2026-07-08 22:19:51 +09:00
parent 06d8d31b16
commit 004afa73c9
18 changed files with 677 additions and 39 deletions
@@ -61,7 +61,7 @@
 | Future B1–B6 | 💤 vision | `CASAN_PLAN_FUTURE_PHASES.md` — approval workflow nâng cao · state machine · model benchmark · governed memory · auto-remediation · platform KPI. |
 | **17 Loop Engineering** | � T1–T6 done+test (offline) | **Agentic Loop Governance** — đủ 5 primitive + orchestrator (97/0 WSL, nối CI). T1 **Governor** (`loop-governor.py`; deny-by-default, no/corrupt policy→strict/HALT, on_exceed halt/escalate) 15/0; T2 **Convergence** (`loop-convergence.py`; repeat/thrash→OSCILLATING, flat→STALLED, fail-closed) 15/0; T3 **Verify Contract** (`loop-gate.py`; H4→DENY, unmet→FAIL, correction bounded→ESCALATE, no self-declared DONE) 20/0; T4 **Trace/Replay** (`loop-trace.py`; append-only hash-linked, edited→BREAK, tampered artifact→replay DRIFT) 16/0; T5 **Meta-loop** (`loop-metaloop.py`; propose≠apply, SoD, loosen>org_ceiling refused, apply qua governed CP store→đổi thật ceiling + rollback) 15/0; T6 **Orchestrator** (`loop-run.sh`; gate→governor→convergence→trace/turn, secure-by-default opt-out, nén giữa vòng) 16/0. State qua `CASAN_LOOP_STATE_ROOT` (repo `.specify/state` sạch). **Còn (infra):** T4 KMS-anchor head (A7 Vault), T6 widget Command Center (17.22, C5), live H3-judge. Chi tiết: `CASAN_PLAN_17_LOOP_ENGINEERING.md`. |
 | **16 Security audit remediation** | � P0/P1/P2 phần lớn done+test | **Remediation đã thực thi:** 28 SEC suite (151/0 WSL, nối `ci-harness-gate.sh`). Done: SEC-01..10, 12, 13, **14** (model-digest bỏ env-override ở prod/strict), 15, 16..21, **22** (trusted-time JWT `exp` ARCH-06 + tag proposal nguồn-không-tin ARCH-08), **26** (stored/second-order injection scan), 27..30, **23 Phase 1–5 offline** (multi-tenant: tenant-store+guard · per-tenant CP/audit/telemetry · RBAC data-boundary · tenant kill-switch/quota · ký registry · crypt at-rest per-tenant), **24 offline** (image digest-pin + ký workflow), **25 offline** (artifact attestation tested==deployed); **SEC-11 gộp vào SEC-17** (`CASAN_PROFILE=prod` enforce-by-default). **Còn 📋 planned (hạ tầng/process):** SEC-22 ARCH-10 (attestation ngoài) · SEC-23 23.11 (crypt qua Vault Transit) · **SEC-24 còn** (live CVE/OSV + scan image thật — offline image-pin/ký-workflow đã done) · **SEC-25 còn** (signed-commit enrollment + SLSA chain — offline artifact-attestation đã done). Chi tiết: `CASAN_PLAN_16` §0a/§2d. |
-| **18 Chat Console** | 🟡 **MVP-0 + MVP-1 done+test** · target arch còn planned | **Governed Chat Console** (cắt lát MVP chống lan man). **MVP-0 Ask CASAN read-only DONE**: `prompt-mode-router.py`, `chat-readonly.py`, `chat-session.schema.json`, H4 input/output scan, H5 chat audit hash-chain, H6 token telemetry, answer kèm evidence sources. **MVP-1 Operator DONE**: `operator-actions.yaml`, `chat-operator.py`, `chat-turn.py`, registered actions `run tests`/`build pack`/`verify pack`, all through `action-gate`, no free-command, action artifacts with provenance, Control Panel `POST /api/v1/chat/ask`, `GET /api/v1/chat/actions`, `/chat` UI. Test: chat suites **24/0** (`phase-chat-prompt-router` 8/0, `phase-chat-readonly` 5/0, `phase-chat-session-audit` 3/0, `phase-chat-operator` 8/0), Control Panel **24/0** + build xanh. Sau: MVP-2 chat-as-loop + agent/skill (**cần Plan-17+14**) → MVP-3 multi-tenant (**cần SEC-23**). |
+| **18 Chat Console** | 🟡 **MVP-0 + MVP-1 done+test; MVP-2 Track 4 foundation done** · target arch còn planned | **Governed Chat Console** (cắt lát MVP chống lan man). **MVP-0 Ask CASAN read-only DONE**: `prompt-mode-router.py`, `chat-readonly.py`, `chat-session.schema.json`, H4 input/output scan, H5 chat audit hash-chain, H6 token telemetry, answer kèm evidence sources. **MVP-1 Operator DONE**: `operator-actions.yaml`, `chat-operator.py`, `chat-turn.py`, registered actions `run tests`/`build pack`/`verify pack`, all through `action-gate`, no free-command, action artifacts with provenance. **MVP-2 Track 4 foundation DONE**: `agent-registry.yaml`, `chat-agent-resolver.py`, `chat:select_agent` RBAC, delegation hold, tool allowlist BLOCK, Control Panel `GET /api/v1/chat/agents` + `/chat` agent/skill/delegation picker. Test: chat suites **32/0** (`phase-chat-prompt-router` 8/0, `phase-chat-readonly` 5/0, `phase-chat-session-audit` 3/0, `phase-chat-operator` 8/0, `phase-chat-agent-select` 8/0), Control Panel **25/0** + build xanh. Next: MVP-2 Track 5/6 chat-as-loop + streaming + replay → MVP-3 multi-tenant. |
 ---

 ## Trần điểm & điều kiện lên "Strong (81+)"
@@ -35,7 +35,7 @@
 | 15 | `CASAN_PLAN_15_RESPONSIBLE_AI_DATA_GOV.md` | Responsible AI & Data Governance (FPT §14.3–14.4) | 📋 |
 | 16 | `CASAN_PLAN_16_SECURITY_AUDIT_REMEDIATION.md` | Security audit core harness + kế hoạch vá (tamper-evidence/injection/fail-open) | � P0/P1/P2 done |
 | 17 | `CASAN_PLAN_17_LOOP_ENGINEERING.md` | Loop Engineering / Agentic Loop Governance (budget governor, convergence, verify-contract, loop trace/replay, meta-loop) | 📋 |
-| 18 | `CASAN_PLAN_18_CHAT_CONSOLE.md` | Governed Chat Console (target arch; **MVP-0 Ask CASAN + MVP-1 Operator done** → chat-as-loop → multi-tenant) | 🟡 MVP-0/1 done |
+| 18 | `CASAN_PLAN_18_CHAT_CONSOLE.md` | Governed Chat Console (target arch; **MVP-0 Ask CASAN + MVP-1 Operator done; MVP-2 Track 4 foundation done** → chat-as-loop/streaming/replay → multi-tenant) | 🟡 MVP-0/1 + Track 4 done |
 | Future | `CASAN_PLAN_FUTURE_PHASES.md` | Approval workflow, state machine, benchmark, memory, remediation, KPI | 💤 vision |

 > **Không có plan số 11:** số 11 được bỏ trống có chủ ý — nhánh eval/traceability đã
@@ -1,12 +1,15 @@
 # KẾ HOẠCH 18 — Governed Chat Console (Chat-as-Loop qua Control Plane)

-> Status 2026-07-08: **🟡 MVP-0 + MVP-1 done+test — target architecture còn planned.**
+> Status 2026-07-08: **🟡 MVP-0 + MVP-1 done+test; MVP-2 Track 4 foundation done — target architecture còn planned.**
 > Đã implement **Ask CASAN — Read-only Evidence Assistant** qua harness + Control
 > Panel (`/api/v1/chat/ask`, `/chat` UI): Prompt Router deterministic
 > `READ_ONLY/OPERATOR/BLOCK/NOT_SUPPORTED`, context whitelist, H4 scan in/out, H5
 > chat audit hash-chain, H6 token telemetry, answer kèm evidence sources. **MVP-1
 > Operator** đã có registered actions `run tests` / `build pack` / `verify pack`
-> qua `action-gate`, không free-command, kết quả có artifact provenance. Mục tiêu
+> qua `action-gate`, không free-command, kết quả có artifact provenance. **MVP-2
+> Track 4 foundation** đã có `agent-registry.yaml`, agent/skill resolver, RBAC
+> gate chọn agent, delegation hold, tool allowlist block, Control Panel agent picker.
+> Mục tiêu
 > tổng thể vẫn là thêm **cửa sổ chat** vào Control Plane (Plan-13) như một
 > **bề mặt tương tác của core harness** — mỗi lượt chat là **một loop-run được
 > governance** (Plan-17), đi qua đúng H1→H7, không có đường vòng. Đây **không** phải
@@ -250,10 +253,10 @@ flowchart TD
 ### Track 4 — Agent/Skill selection governance `[MVP-2]`
 | Task | Việc | File | Verify (WSL) |
 |---|---|---|---|
-| 18.4.1 | `agent-registry.yaml` versioned (tool_allowlist, max_delegation, roles_allowed, model_role) + resolver bind theo turn | mới `config/agent-registry.yaml` | chọn agent → allowlist đúng |
-| 18.4.2 | RBAC gate chọn agent (14): role không đủ → DENY; vượt `max_delegation` → security-sensitive → approval | nối `rbac-check.py` | role thấp chọn agent tự chủ → DENY |
-| 18.4.3 | Tool-call runtime chỉ tool **trong allowlist**; ngoài → `action-gate` BLOCK | nối `action-gate.sh` | tool ngoài allowlist → BLOCK |
-| 18.4.4 | Skill code-gen chạy trong allowlist + H4 artifact-scan (Plan-02) trước output | nối `artifact-scan.sh` | skill sinh mã có injection → BLOCK |
+| 18.4.1 | ✅ `agent-registry.yaml` versioned (tool_allowlist, max_delegation, roles_allowed, model_role) + resolver bind theo turn | `packages/casan-harness/config/agent-registry.yaml` + `chat-agent-resolver.py` | chọn agent → allowlist đúng |
+| 18.4.2 | ✅ RBAC gate chọn agent (14): role không đủ → DENY; vượt `max_delegation` → security-sensitive → approval hold | nối `rbac-check.py` (`chat:select_agent`) | role thấp chọn agent tự chủ → DENY |
+| 18.4.3 | ✅ Tool-call runtime chỉ tool **trong allowlist**; ngoài → BLOCK trước runtime | `chat-agent-resolver.py` | tool ngoài allowlist → BLOCK |
+| 18.4.4 | ⏳ Skill code-gen chạy trong allowlist + H4 artifact-scan (Plan-02) trước output | nối `artifact-scan.sh` | skill sinh mã có injection → BLOCK |

 ### Track 5 — Chat-as-loop pipeline `[MVP-2]`
 | Task | Việc | File | Verify (WSL) |
@@ -274,7 +277,7 @@ flowchart TD
 |---|---|---|---|
 | 18.7.1 | ✅ Chat API (NestJS) **bọc** harness (MVP-0/1: read-only + operator; single-source, không verdict riêng) | `packages/casan-control-panel/backend/src/chat/*` | API gọi `chat-turn.py`; `console:test` xanh |
 | 18.7.2 | ✅ Chat panel React + hiển thị **evidence sources**, registered actions, action-gate + badge `mode/risk` | `packages/casan-control-panel/frontend/src/pages/Chat.tsx` | `console:build` xanh |
-| 18.7.3 | (MVP-2) agent/skill picker theo RBAC + badge `UNCERTIFIED/CERTIFIED` + nút **loop-breaker** + delegation-level | Control Plane UI | picker ẩn agent ngoài quyền |
+| 18.7.3 | 🟡 (MVP-2 partial) agent/skill picker theo RBAC + delegation-level đã có; còn badge `UNCERTIFIED/CERTIFIED` + nút **loop-breaker** khi Track 5/6 mở | Control Plane UI | picker hiện locked agent, backend DENY agent ngoài quyền |
 | 18.7.4 | Fail-loud: API/telemetry chết → UI `STALE/503` (tái dùng D3 `/healthz`) | nối Plan-07 D3 | ngắt backend → UI báo stale |

 ### Track 8 — Replay / Evidence / Command Center widgets `[MVP-2 → MVP-3]`
@@ -313,8 +316,8 @@ flowchart TD

 **File test (theo MVP):** MVP-0 — `phase-chat-prompt-router-tests.sh`,
 `phase-chat-readonly-tests.sh`, `phase-chat-session-audit-tests.sh`; MVP-1 —
-`phase-chat-operator-tests.sh`; MVP-2 — `phase-chat-pipeline-tests.sh`,
-`phase-chat-agent-select-tests.sh`, `phase-chat-stream-hold-tests.sh`,
+`phase-chat-operator-tests.sh`; MVP-2 — `phase-chat-agent-select-tests.sh`,
+`phase-chat-pipeline-tests.sh`, `phase-chat-stream-hold-tests.sh`,
 `phase-chat-replay-tests.sh`; MVP-3 — `phase-chat-tenant-tests.sh`. Chạy **WSL**
 (deterministic, mock model; nhánh live cần Ollama SKIP-aware). Nối `ci-harness-gate.sh`;
 cập nhật tổng test ở `CASAN_HARDENING_STATUS.md`.
@@ -336,6 +339,13 @@ cập nhật tổng test ở `CASAN_HARDENING_STATUS.md`.
 - [x] Kết quả action ghi artifact có provenance và được hiển thị lại trong `/chat`.
 - [x] Suite MVP-1 xanh và nối CI. Verify: `phase-chat-operator` 8/0, prompt-router 8/0, read-only 5/0, session-audit 3/0, `console:test` 24/0, `console:build` xanh.

+**MVP-2 Track 4 foundation (Agent/Skill selection governance):**
+- [x] Agent registry versioned có `tool_allowlist`, `max_delegation_level`, `roles_allowed`, `model_role`.
+- [x] Agent resolver bind theo turn, ghi audit hash-chain, fail-closed khi registry lỗi.
+- [x] RBAC gate `chat:select_agent`; role thấp chọn agent tự chủ → DENY; cross-tenant → DENY.
+- [x] Delegation vượt agent max → `REQUIRES_APPROVAL`; tool ngoài allowlist → BLOCK trước runtime.
+- [x] Control Panel `GET /api/v1/chat/agents`, `/chat` agent/skill/delegation picker, response có `agent_binding`. Verify: `phase-chat-agent-select` 8/0, RBAC 12/0, SEC-23 RBAC 6/0, `console:test` 25/0, `console:build` xanh.
+
 **Full (target architecture) — DoD tổng:**
 - [ ] Turn chạy **đúng như một loop-run Plan-17** (không định nghĩa vòng lặp riêng).
 - [ ] **Không đường vòng:** test chứng minh bỏ bất kỳ gate nào (preflight/verify) → FAIL.
@@ -349,9 +359,10 @@ cập nhật tổng test ở `CASAN_HARDENING_STATUS.md`.
 ---

 ## 7. Ghi chú trung thực & Non-goals (không lan man)
- **[MVP-0 + MVP-1] — 🟡 done+test.** Ask CASAN read-only và Operator registered
-  actions đã có harness CLI + Control Panel API/UI. Các phase Chat-as-loop /
-  Agent-selection / multi-tenant production vẫn chưa mở.
+- **[MVP-0 + MVP-1 + MVP-2 Track 4 foundation] — 🟡 done+test.** Ask CASAN read-only,
+  Operator registered actions, và agent/skill governance foundation đã có harness CLI
+  + Control Panel API/UI. Các phase Chat-as-loop / streaming / replay / multi-tenant
+  production vẫn chưa mở.
 - **MVP-first (chống lan man):** **MVP-0 (Ask CASAN read-only) KHÔNG phụ thuộc Plan-17/
  14/SEC-23** — làm được ngay trên nền H4/H5/H6 hiện có. Chỉ **MVP-2 trở đi** (chat-as-
  loop + agent) mới cần Plan-17 (T1–T3) + Plan-14 RBAC; **MVP-3** mới cần SEC-23 tenant.
@@ -77,7 +77,7 @@ approval JWT thật ([16 SEC-07](CASAN_PLAN_16_SECURITY_AUDIT_REMEDIATION.md)),
 |---|---|---|:--:|:--:|---|
 | B9 | ✅ **done** — **MVP-0 Ask CASAN read-only**: Prompt Router (Track 0) + Read-only Ask CASAN (Track 1) + session/audit (Track 2) + Control Panel API/UI (Track 7). H4 in/out, H5 audit hash-chain, H6 token, evidence sources; chat suites 14/0, Control Panel 23/0 + build xanh. Real model provider binding remains Track M follow-up when a provider is enabled. | [18 §1b, Track 0/1/2/7/M](CASAN_PLAN_18_CHAT_CONSOLE.md) | L | ✅ | done |
 | B10 | ✅ **done** — **MVP-1 Operator mode**: registered actions `run tests` / `build pack` / `verify pack`, no free-command, all through `action-gate`, action artifacts with provenance, Control Panel quick actions. `phase-chat-operator` 8/0; total chat suites 24/0; Control Panel 24/0 + build xanh. | [18 Track 3](CASAN_PLAN_18_CHAT_CONSOLE.md) | M | ✅ | done |
-| B11 | **MVP-2** Chat-as-loop (Track 5) + Agent/Skill selection (Track 4) + streaming draft-hold (Track 6) | [18 Track 4/5/6](CASAN_PLAN_18_CHAT_CONSOLE.md) | L | 🔗 | B6, C7(RBAC), B10 |
+| B11 | 🟡 **partial done** — Track 4 Agent/Skill governance foundation: `agent-registry.yaml`, `chat-agent-resolver.py`, RBAC `chat:select_agent`, delegation hold, tool allowlist BLOCK, Control Panel agent/skill/delegation picker. `phase-chat-agent-select` 8/0; Control Panel 25/0 + build xanh. **Remaining MVP-2:** Track 5 chat-as-loop + Track 6 streaming draft-hold + Track 8 replay widget. | [18 Track 4/5/6](CASAN_PLAN_18_CHAT_CONSOLE.md) | L | 🔗 | B6, C7(RBAC), B10 |
 | B12 | **Widget Loop/Chat** trên Command Center (loop ticker/budget/replay drawer) | [17 (17.22)](CASAN_PLAN_17_LOOP_ENGINEERING.md) · [18 Track 8](CASAN_PLAN_18_CHAT_CONSOLE.md) | M | 🔗 | C5 ✅ baseline |
 | B13 | **MVP-3** multi-tenant chat hardening (Track 9) | [18 Track 9](CASAN_PLAN_18_CHAT_CONSOLE.md) | M | 🔗 | A3(SEC-23) |