gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(plan-01): Phase 0.5 — path indirection via casan-paths.sh (no file moves)

Browse Source 
Task 1.2: introduce a single path resolver so no harness script hardcodes
`.specify/...` scattered across the tree. casan-paths.sh resolves four roots
(HARNESS/STATE/GOVERNANCE/APP) by marker-based walk-up from its own location —
never `git rev-parse` (git root is the repo PARENT here, not the app dir).

- 101 bash scripts/tests: 238 hardcoded `$PROJECT_ROOT/.specify/...` refs rewritten
  to CASAN_HARNESS_ROOT (code) / CASAN_STATE_ROOT (logs,state) / CASAN_GOVERNANCE_ROOT.
  Sandbox test vars ($WORK/$TP/$FP/$T1_WORK) left untouched.
- Roots are NOT exported: each script/subprocess self-resolves from its own tree,
  matching the original per-script semantics and preserving hermetic sandbox isolation
  (node casan-step.mjs, copied telemetry/rollback scripts must not inherit real roots).
- Sandbox tests that copy a harness script now also copy casan-paths.sh (its new
  sibling dependency): adversarial (verify-audit-chain/verify-tool-audit/rollback) +
  track-a (security-check/telemetry-integrity).
- control-plane-settings.json reclassified as STATE (untracked runtime store).

Roots all still resolve to `.specify` in this monolithic layout, so behavior is
unchanged. Full gate: PASS=64 FAIL=0 SKIP=3 (adversarial 44/0, track-a 25/0).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
2026-07-07 22:07:41 +09:00
co-authored by Claude Opus 4.8
parent 61c3a7c648
commit 2c765c9a45
102 changed files with 1605 additions and 1429 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AINative_OKR_CASAN5/.specify/scripts/bash/security-gate.sh
+11 -10
View File
@@ -7,6 +7,7 @@ set -uo pipefail
# Exit: 0 all required gates green, 1 a required gate failed.
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/casan-paths.sh"
ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
PASS=0; FAIL=0; SKIP=0
run() { # <name> <command...>
@@ -16,21 +17,21 @@ run() { # <name> <command...>
}
echo "== CASAN security gate =="
run "run-casan4 harness suite" bash "$ROOT/.specify/tests/run-casan4-harness-tests.sh"
run "adversarial suite" bash "$ROOT/.specify/tests/adversarial-harness-tests.sh"
run "run-casan4 harness suite" bash "$CASAN_HARNESS_ROOT/tests/run-casan4-harness-tests.sh"
run "adversarial suite" bash "$CASAN_HARNESS_ROOT/tests/adversarial-harness-tests.sh"
# Wave 5: sign audit head via Vault KMS (or local fallback) before verifying.
# This changes verify output from anchor=unsigned to anchor=signed when Vault is configured.
run "sign audit-chain head (KMS)" bash "$ROOT/.specify/scripts/bash/sign-audit-head.sh"
run "audit hash-chain (signed)" bash "$ROOT/.specify/scripts/bash/verify-audit-chain.sh"
run "tool-call audit (signed)" bash "$ROOT/.specify/scripts/bash/verify-tool-audit.sh"
run "sign audit-chain head (KMS)" bash "$CASAN_HARNESS_ROOT/scripts/bash/sign-audit-head.sh"
run "audit hash-chain (signed)" bash "$CASAN_HARNESS_ROOT/scripts/bash/verify-audit-chain.sh"
run "tool-call audit (signed)" bash "$CASAN_HARNESS_ROOT/scripts/bash/verify-tool-audit.sh"
# Wave 3 additions
run "secrets scan (WP-S4)" bash "$ROOT/.specify/scripts/bash/secrets-scan.sh"
run "no-bypass + circuit breaker" bash "$ROOT/.specify/scripts/bash/circuit-breaker-check.sh"
run "secrets scan (WP-S4)" bash "$CASAN_HARNESS_ROOT/scripts/bash/secrets-scan.sh"
run "no-bypass + circuit breaker" bash "$CASAN_HARNESS_ROOT/scripts/bash/circuit-breaker-check.sh"
if curl -sS -m 5 http://127.0.0.1:11434/api/tags >/dev/null 2>&1; then
run "model router tests" bash "$ROOT/.specify/tests/phase3-model-router-tests.sh"
run "red-team H4 metrics (30 samples)" bash "$ROOT/.specify/tests/phase3-redteam-metrics.sh"
run "judge gate tests (WP-B)" bash "$ROOT/.specify/tests/phase3-judge-gate-tests.sh"
run "model router tests" bash "$CASAN_HARNESS_ROOT/tests/phase3-model-router-tests.sh"
run "red-team H4 metrics (30 samples)" bash "$CASAN_HARNESS_ROOT/tests/phase3-redteam-metrics.sh"
run "judge gate tests (WP-B)" bash "$CASAN_HARNESS_ROOT/tests/phase3-judge-gate-tests.sh"
else
echo " GATE SKIP model router + red-team + judge-gate (Ollama tunnel down)"; SKIP=$((SKIP+1))
fi