gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: re-score from a real full run (155/0) after H5 hardening

Browse Source 
Ran all 7 suites sequentially on 2026-07-04 @ 00aabfa with Vault dev live so KMS
runs (not skips): run-casan4 35 · adversarial 44 · phase1-track-a 25 ·
phase2-track-c 29 · phase3-evidence 7 · phase-h5-approval 8 · phase-h5-infra 7
= 155 PASS / 0 FAIL; security-gate PASS=11 FAIL=0.

- scoring-run-report.md: fair re-score — H5 76→80 (approval-identity + KMS live
  rotate/non-exportable + WORM), lowest harness now H6=79, avg ~80.7/100, Level 4.
  Evidence lists the live KMS + WORM results.
- CASAN_HARDENING_STATUS.md: new Phase 4 (C4 approval-identity, B3 KMS, C5 WORM =
  implemented+tested); test inventory 140→155 (7 suites); planned→partial for
  KMS/approval/WORM with honest remaining gaps (live IdP, S3 WORM store, KMS default).
- Plan-07 §2: key-mgmt 2.5→4, policy-approval 2.5→4, external-audit 1.5→3.5;
  header now H5 76→80, lowest harness H6.
- INDEX row, README claim boundary, video-guide Q&A: 155 checks, H5=80, lowest H6=79.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
2026-07-04 23:51:50 +09:00
co-authored by Claude Opus 4.8
parent 00aabfac4d
commit 2af67ef6a5
6 changed files with 117 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
00_SUBMISSION_PACKAGE/README.md
+11 -4
View File
@@ -69,11 +69,18 @@ removed). Full status: `casan-next-plans/CASAN_HARDENING_STATUS.md`.
--read-only --pids-limit` / nsjail.
- **Implemented + tested (Plan-09 MVP):** Evidence Pack — `casan pack` / `casan
verify-pack` (tamper-evident manifest + signed head + certified-run gate).
- **Implemented + tested (H5 governance hardening):** approval-identity (reviewer
cryptographically signs the request + role authorization — env-var approver no
longer enough); KMS key management (Vault Transit sign + rotation + non-exportable,
**validated live**); external WORM audit ledger (rollback + tamper detection).
- **Planned (NOT done — do not claim as production-ready):** multilingual H4,
classifier/split-injection resistance, HSM key management, policy-approval workflow,
external WORM audit, incident kill-switch, true sandbox isolation.
classifier/split-injection resistance, HSM + KMS-by-default, live IdP (OIDC/JWT),
true WORM store (S3 Object Lock), incident kill-switch, true sandbox isolation.
Test totals: baseline 79 (run-casan4 35 + adversarial 44) preserved, **+61 new**
hardening checks (Track A 25, Track C-MVP 29, Evidence Pack 7) = **140** — see
Test totals: baseline 79 (run-casan4 35 + adversarial 44) preserved, **+76 new**
hardening checks (Track A 25, Track C-MVP 29, Evidence Pack 7, H5-approval 8,
H5-infra KMS+WORM 7) = **155**, 0 fail — last full run 2026-07-04 with KMS live via
Vault (`evidence/scoring-run-report.md`). Fair maturity ~80/100 per harness; H5 rose
76→80 so the **lowest harness is now H6=79** (CASAN Level 4, proven by attack). See
`CASAN_HARDENING_STATUS.md`. Because these live in **separate** suites, the demo
attack battery counts in `video/01_video_recording_guide.md` are unchanged.