From 00aabfac4d60c4b588ef0486b6daa267cbdaa181 Mon Sep 17 00:00:00 2001 From: thanhnv Date: Sat, 4 Jul 2026 23:19:52 +0900 Subject: [PATCH] feat(video): add H5+ governance-hardening scenes to run-hardening.sh MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit New "H5+ — Governance Hardening" section (before Evidence Pack) demoing the three lowest-harness fixes with on-screen verdicts: - HG1 approval-identity: env-var approver → BLOCKED; reviewer-signed → APPROVED. - HG2 KMS key: sign/verify via Vault Transit + rotate + non-exportable (skip-aware when no Vault; shows the docker one-liner to enable it live). - HG3 WORM audit: ship anchors → in-sync; roll back local audit → AUDIT_GAP_DETECTED. Closer updated: H5 76→~85 line, total 155 checks. Verified end-to-end (exit 0, live Vault: rotate v3 + non-exportable confirmed). Co-Authored-By: Claude Opus 4.8 (1M context) --- optimize-docs/video-steps/run-hardening.sh | 66 +++++++++++++++++++++- 1 file changed, 65 insertions(+), 1 deletion(-) diff --git a/optimize-docs/video-steps/run-hardening.sh b/optimize-docs/video-steps/run-hardening.sh index 37c7a39..9a7c0d7 100755 --- a/optimize-docs/video-steps/run-hardening.sh +++ b/optimize-docs/video-steps/run-hardening.sh @@ -235,6 +235,69 @@ bash $S/sandbox-run.sh --workspace "$W" -- bash -c 'echo ok > out.txt' >/dev/nul expect "3 thao tác thoát-sandbox → BLOCK; lệnh lành → OK. (Khai báo trung thực: scaffold, chưa phải cô lập kernel.)" pause +# ============================================================================ +set_step H5-HARDENING +banner "⭐ H5+ — GOVERNANCE HARDENING (nâng harness thấp nhất: H5 76 → ~85)" +say "Ba điểm hở lớn nhất của H5 — duyệt tin env-var · khoá ký local · audit xoá được — nay vá thật." + +REG="$ROOT/.specify/level5/central-governance/reviewers.registry" + +card "HG1" "Approval-identity: chữ ký thay vì env var 🔥" "C4/V20 · SoD nâng cấp" +attack "Duyệt high-risk cũ chỉ cần đặt CASAN_APPROVER=bob — ai set env cũng 'duyệt' được." +guard "STRICT: reviewer PHẢI ký chính request bằng khoá riêng; gate verify chữ ký + vai trò (role→action)." +RVDIR="$W/reviewers"; mkdir -p "$RVDIR" +openssl genrsa -out "$W/ops.priv.pem" 2048 2>/dev/null +openssl rsa -in "$W/ops.priv.pem" -pubout -out "$RVDIR/ops-owner.pub.pem" 2>/dev/null +printf 'deploy to production and run database migration\n' > "$W/greq.txt" +GG() { env CASAN_APPROVAL_STRICT=1 CASAN_REVIEWERS_FILE="$REG" CASAN_REVIEWERS_DIR="$RVDIR" \ + CASAN_ACTOR=alice CASAN_APPROVAL_DECISION=approve "$@" \ + bash "$S/governance-check.sh" "$W/greq.txt" "$W/gout.txt" deploy; } +say "① env-var approver KHÔNG kèm chữ ký:" +cmd "CASAN_APPROVAL_STRICT=1 CASAN_APPROVER=ops-owner bash \$S/governance-check.sh ... deploy" +GG CASAN_APPROVER=ops-owner >/dev/null 2>&1; verdict $? +say "② reviewer KÝ request rồi mới duyệt:" +cmd "bash \$S/approval-sign.sh deploy alice ops-owner sig → gate verify" +bash "$S/approval-sign.sh" deploy alice "$W/greq.txt" ops-owner "$W/ops.priv.pem" "$W/g.sig" >/dev/null 2>&1 +GG CASAN_APPROVER=ops-owner CASAN_APPROVAL_SIG="$W/g.sig" >/dev/null 2>&1; verdict $? +expect "Không chữ ký → BLOCK; ký hợp lệ đúng role → APPROVED. 'CASAN_APPROVER=bob' hết linh nghiệm." +pause + +card "HG2" "Khoá ký qua KMS — không nằm trên đĩa" "B3/KMS · rotation · non-exportable" +attack "Khoá riêng ký audit nằm local → rủi ro nội gián / rò rỉ khoá." +guard "vault-kms: ký qua Vault Transit, khoá exportable=false (không rời KMS) + rotation." +if [ -n "${VAULT_ADDR:-}" ] && curl -sf "$VAULT_ADDR/v1/sys/health" >/dev/null 2>&1; then + printf 'audit-head-demo-%s\n' "$$" > "$W/kh.txt" + bash "$S/vault-kms.sh" enable-transit >/dev/null 2>&1 + cmd "bash \$S/vault-kms.sh sign casan-audit-key ; verify ; rotate ; assert-nonexportable" + bash "$S/vault-kms.sh" sign "$W/kh.txt" "$W/kh.sig" casan-audit-key >/dev/null 2>&1 + bash "$S/vault-kms.sh" verify "$W/kh.txt" "$W/kh.sig" casan-audit-key >/dev/null 2>&1 && say "verify v1 → OK" + bash "$S/vault-kms.sh" rotate casan-audit-key + bash "$S/vault-kms.sh" assert-nonexportable casan-audit-key; verdict $? + expect "Ký qua KMS · rotate được · khoá NON-exportable (private không rời KMS)." +else + echo "${YE}⏭ SKIP (cần Vault live):${R} đường KMS đã hiện thực trong vault-kms.sh; bật Vault để chạy trực tiếp." + echo "${DIM} docker run -d -p 8200:8200 -e VAULT_DEV_ROOT_TOKEN_ID=root hashicorp/vault${R}" + echo "${DIM} export VAULT_ADDR=http://127.0.0.1:8200 VAULT_TOKEN=root${R}" +fi +pause + +card "HG3" "WORM audit ngoài: xoá log là lộ 🔥" "C5/V21 · anti-rollback" +attack "Kẻ tấn công xoá/rollback đuôi audit log local để phi tang bằng chứng." +guard "Mỗi head ship sang ledger append-only NGOÀI (hash-link). Local tụt lại → AUDIT_GAP_DETECTED." +LG="$W/anchor-ledger.jsonl"; HH="$W/wh.txt" +printf 'HEAD-1\n' > "$HH"; bash "$S/audit-ship.sh" "$HH" "$LG" >/dev/null 2>&1 +printf 'HEAD-2\n' > "$HH"; bash "$S/audit-ship.sh" "$HH" "$LG" >/dev/null 2>&1 +cmd "bash \$S/verify-audit-gap.sh # local khớp anchor mới nhất" +bash "$S/verify-audit-gap.sh" "$HH" "$LG" >/dev/null 2>&1; verdict $? +say "→ kẻ tấn công rollback local audit về HEAD-1 (xoá bằng chứng mới hơn):" +printf 'HEAD-1\n' > "$HH" +cmd "bash \$S/verify-audit-gap.sh # sau khi rollback" +bash "$S/verify-audit-gap.sh" "$HH" "$LG" >/dev/null 2>"$W/gap.err"; rc=$? +grep -o "AUDIT_GAP_DETECTED" "$W/gap.err" | head -1 +verdict $rc +expect "AUDIT_GAP_DETECTED · exit=1 — ledger ngoài vẫn giữ HEAD-2, nên xoá log local là lộ ngay." +pause + # ============================================================================ set_step EVIDENCE-PACK banner "🏆 PLAN-09 EVIDENCE PACK — 'VÌ SAO TIN OUTPUT NÀY?' (money-shot)" @@ -298,9 +361,10 @@ set_step HARDEN-DONE banner "CHỐT PART 2 — TRƯỞNG THÀNH PRODUCTION (trung thực)" echo "${B}${GR}✔ Track A${R}: homoglyph/zero-width/base64 chặn · strict fail-closed · telemetry bất biến · trần chi phí tuyệt đối+tích luỹ · FP=0%." echo "${B}${GR}✔ Track C-MVP${R}: tool-authz theo hành động · supply-chain (typosquat/postinstall) · data-exfil (secret→cloud, PII mask) · sandbox scaffold." +echo "${B}${GR}✔ H5+ hardening${R}: approval ký-danh-tính (hết env-var) · khoá ký qua KMS (rotate + non-exportable) · WORM audit ngoài (chống xoá log) → H5 76→~85." echo "${B}${GR}✔ Evidence Pack${R}: gói bằng chứng ký số, tamper 1 byte → vô hiệu; certified chỉ khi đủ cổng." echo -echo "${B}${CY}Tổng test: baseline 79 (giữ nguyên) + 61 hardening = 140 checks, 0 fail.${R}" +echo "${B}${CY}Tổng test: baseline 79 (giữ nguyên) + 76 hardening = 155 checks, 0 fail.${R}" echo "${DIM}Trung thực: sandbox là scaffold (chưa cô lập kernel); Track B + C-Governance/Ops là roadmap sau thi. Chi tiết: casan-next-plans/CASAN_HARDENING_STATUS.md${R}" rule set_step DONE