update first - 84

2026-06-30 02:21:39 +09:00
commit 07ac1bdcdd
561 changed files with 88164 additions and 0 deletions
@@ -0,0 +1,135 @@
+#!/usr/bin/env pwsh
+# CASAN H5 Compliance Report Generator
+# Usage:
+#   generate-compliance-report.ps1 -FeatureId <id> -OutputPath <path>
+
+param(
+    [Parameter(Mandatory=$true)][string]$FeatureId,
+    [string]$OutputPath = ""
+)
+
+$ErrorActionPreference = "Stop"
+
+$scriptDir   = Split-Path $MyInvocation.MyCommand.Path -Parent
+$projectRoot = (Resolve-Path (Join-Path $scriptDir "../../..")).Path
+$auditLog    = Join-Path $projectRoot ".specify/logs/audit/audit.jsonl"
+$secAudit    = Join-Path $projectRoot ".specify/logs/audit/security.jsonl"
+$toolAudit   = Join-Path $projectRoot ".specify/logs/audit/tool-calls.jsonl"
+
+if (!$OutputPath) {
+    $outDir = Join-Path $projectRoot "docs/output/output_logs/$FeatureId"
+    if (!(Test-Path $outDir)) { New-Item -ItemType Directory -Force -Path $outDir | Out-Null }
+    $OutputPath = Join-Path $outDir "compliance-report.md"
+}
+
+$timestamp = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
+
+# ── Read audit records ─────────────────────────────────────────────────────
+function Read-Jsonl ([string]$path) {
+    if (!(Test-Path $path)) { return @() }
+    Get-Content $path | ForEach-Object {
+        try { $_ | ConvertFrom-Json } catch { $null }
+    } | Where-Object { $_ }
+}
+
+$govRecords  = Read-Jsonl $auditLog
+$secRecords  = Read-Jsonl $secAudit
+$toolRecords = Read-Jsonl $toolAudit
+
+# ── Statistics ─────────────────────────────────────────────────────────────
+$totalActions   = $govRecords.Count
+$highRisk       = $govRecords | Where-Object { $_.risk_level -eq "high" }
+$denied         = $govRecords | Where-Object { $_.decision -eq "denied" }
+$humanApproved  = $govRecords | Where-Object { $_.approval_status -eq "human_approved" }
+$secBlocked     = $secRecords | Where-Object { $_.status -eq "blocked" }
+$piiMasked      = $secRecords | Where-Object { $_.action -eq "allow" -and $_.matched_rules }
+$toolCalls      = $toolRecords.Count
+$toolDenied     = $toolRecords | Where-Object { $_.decision -eq "denied" }
+
+# ── Audit chain validation ─────────────────────────────────────────────────
+$chainValid = $true
+$prevHash   = ""
+foreach ($rec in $govRecords) {
+    if ($prevHash -and $rec.previous_record_hash -ne $prevHash) { $chainValid = $false; break }
+    $prevHash = $rec.record_hash
+}
+$chainStatus = if ($chainValid) { "VALID ✅" } else { "BROKEN ⚠️" }
+
+# ── Report content ─────────────────────────────────────────────────────────
+$highRiskTable = if ($highRisk) {
+    $highRisk | ForEach-Object { "| $($_.timestamp) | $($_.action) | $($_.decision) | $($_.approver) | $($_.approval_status) |" }
+} else { "| — | — | — | — | — |" }
+
+$deniedTable = if ($denied) {
+    $denied | ForEach-Object { "| $($_.timestamp) | $($_.action) | $($_.risk_level) | $($_.approval_status) |" }
+} else { "| — | — | — | — |" }
+
+$report = @"
+# Compliance Report — $FeatureId
+
+**Generated:** $timestamp
+**Pipeline:** $FeatureId
+**Audit chain status:** $chainStatus
+
+---
+
+## Action Summary
+
+| Metric | Count |
+|--------|------:|
+| Total governance actions | $totalActions |
+| High-risk actions | $($highRisk.Count) |
+| Denied actions | $($denied.Count) |
+| Human-approved (identity verified) | $($humanApproved.Count) |
+| Security blocks (H4) | $($secBlocked.Count) |
+| PII-masked inputs | $($piiMasked.Count) |
+| Tool registry calls | $toolCalls |
+| Tool registry denials | $($toolDenied.Count) |
+
+---
+
+## High-Risk Actions
+
+| Timestamp | Action | Decision | Approver | Approval Status |
+|-----------|--------|----------|----------|-----------------|
+$($highRiskTable -join "`n")
+
+---
+
+## Denied Actions
+
+| Timestamp | Action | Risk Level | Approval Status |
+|-----------|--------|:----------:|-----------------|
+$($deniedTable -join "`n")
+
+---
+
+## Security Events (H4)
+
+- Prompt injections blocked: **$($secRecords | Where-Object { $_.status -eq "blocked" -and $_.mode -eq "input" } | Measure-Object | Select-Object -ExpandProperty Count)**
+- Output redactions: **$($secRecords | Where-Object { $_.action -eq "redact" } | Measure-Object | Select-Object -ExpandProperty Count)**
+- Hallucination risk flags: **$($secRecords | Where-Object { $_.action -eq "flag" } | Measure-Object | Select-Object -ExpandProperty Count)**
+
+---
+
+## Audit Chain Status
+
+- Records checked: **$totalActions**
+- Chain integrity: **$chainStatus**
+- Storage: hash-chain JSONL at `.specify/logs/audit/audit.jsonl`
+
+---
+
+## Tool Registry Compliance (H2)
+
+- Total tool calls logged: **$toolCalls**
+- Denied (missing idempotency key): **$($toolDenied.Count)**
+- Side-effecting actions: **$($toolRecords | Where-Object { $_.decision -eq "approved" } | Measure-Object | Select-Object -ExpandProperty Count)**
+
+---
+
+*Report auto-generated by CASAN H5 Governance Harness*
+"@
+
+Set-Content -Path $OutputPath -Value $report -Encoding UTF8
+Write-Output "COMPLIANCE_REPORT_GENERATED: $OutputPath"