gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: harden CASAN production install lifecycle

Browse Source
This commit is contained in:
thanhnv
2026-07-24 11:11:44 +07:00
parent c7671ab198
commit 114340c719
48 changed files with 1036 additions and 165 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/packaging/CASAN_PACKAGING_PLAN.md
+22 -1
View File
@@ -9,7 +9,7 @@ contents + maturity: [`packaging/levels.json`](../../packaging/levels.json).
| Lvl | Package names | Status | What it is |
|---|---|:--:|---|
| **1 — Core Harness** | `casan-core`, `casan-harness` | ✅ implemented | H1–H7 harness, security + action gates, evidence pack, audit, cost/telemetry, hardening tests, policy/config defaults, `bin/casan` CLI |
| **1 — Core Harness** | `casan-core`, `casan-harness` | ✅ implemented | Minimal H1–H7 production runtime: security + action gates, evidence pack, audit, cost/telemetry, policy/config defaults, adapters, `bin/casan` CLI |
| **2 — DevKit / Adoption Kit** | `casan-devkit`, `casan-project-kit` | ✅ implemented | Level 1 + project templates, domain-pack scaffold, Gitea workflow template, harness Dockerfile, install script, adoption/CI/domain-pack guides |
| **3 — Platform Components** | `casan-platform`, `casan-control-panel` | 🟡 preview | Control Panel, Dashboard, Run History, governed chat MVP and **Evidence Pack Viewer**. Attack Battery Viewer, Gitea evidence publishing, and managed rollout are still pending. |
| **4 — Enterprise / Governed Console** | `casan-enterprise`, `casan-governed-console` | 📋 future | Promotion layer requiring managed deployment, KMS/Object Lock operations, HA/DR/SLA, external review and compliance/support evidence. |
@@ -38,6 +38,26 @@ Docker images (see `DOCKER_GUIDE.md`): `casan-harness:X.Y.Z` ✅ · `casan-platf
Every bundle carries `BUNDLE-MANIFEST.txt` + `SHA256SUMS`; preview bundles also carry
`PREVIEW-INCOMPLETE.txt`.
## Production runtime boundary
`packaging/runtime-layout.json` is the canonical allowlist used by macOS/Linux,
Windows, vendored adoption, project scaffolding, and release packaging.
Production Core/DevKit artifacts never include:
- `packages/casan-harness/tests/` or `packages/casan-devkit/tests/`;
- internal CI/adversarial runners (`ci-harness-gate.sh`, `security-gate.sh`,
`test-integrity.py`, cloud smoke);
- the legacy `packages/casan-harness/level5/` directory;
- Platform-only dashboard/local-infrastructure helpers;
- source documentation, installer copies, Dockerfiles, caches, or release tooling
inside the installed version directory.
Policies formerly under `level5/` live in `packages/casan-harness/config/`.
Test fixtures live under the source-only `tests/fixtures/`. The source hub retains
its tests so CASAN itself remains verifiable; only the install/release boundary is
minimal.
## Who adopts what
- **Governance-harness-only / BJT initial / CI gate** → `casan-core`.
- **New project adopting CASAN** → `casan-devkit` (install.sh scaffolds domain + CI).
@@ -54,6 +74,7 @@ packages/casan-enterprise/ # L4 structure-only (future; README)
bin/casan # CLI
scripts/package-release.sh # release packager
packaging/levels.json # bundle contents + maturity (source of truth)
packaging/runtime-layout.json # exact production runtime allowlist
docs/packaging/ # this plan + adoption/CI/domain-pack/gitea/docker guides
```