diff --git a/AINative_OKR_CASAN5/.specify/level5/central-governance/agent-identities.registry b/AINative_OKR_CASAN5/.specify/level5/central-governance/agent-identities.registry new file mode 100644 index 0000000..dc39935 --- /dev/null +++ b/AINative_OKR_CASAN5/.specify/level5/central-governance/agent-identities.registry @@ -0,0 +1,22 @@ +# CASAN Plan-16 SEC-10 — agent-identity registry (non-spoofable least-privilege). +# +# tool-registry-gate.sh least-privilege used to trust CASAN_AGENT (a plain env var +# anyone can set). Under CASAN_PROFILE=prod (or CASAN_IDENTITY_STRICT=1) the caller +# must instead present a signed token proving it is that agent — verified against +# one of the PUBLIC keys below. Private keys live OFF-REPO (with the agent runner / +# issued by an IdP); only public keys are provisioned here (same policy as the audit +# and reviewer signing keys). +# +# Line format (no yaml dependency): +# agent # pubkey-file relative to the agents/ dir +# +# Token minted with: agent-identity-sign.sh +# Presented via: CASAN_AGENT= CASAN_AGENT_SIG= CASAN_RUN_ID= +# +# NOTE: pubkeys under agents/ are provisioned out-of-band by ops. Until then, +# enforced mode fails CLOSED (an unproven agent is denied every restricted tool). + +agent release-manager release-manager.pub.pem +agent implement-agent implement-agent.pub.pem +agent design-agent design-agent.pub.pem +agent review-agent review-agent.pub.pem diff --git a/AINative_OKR_CASAN5/.specify/scripts/bash/agent-identity-sign.sh b/AINative_OKR_CASAN5/.specify/scripts/bash/agent-identity-sign.sh new file mode 100644 index 0000000..05d9ce5 --- /dev/null +++ b/AINative_OKR_CASAN5/.specify/scripts/bash/agent-identity-sign.sh @@ -0,0 +1,24 @@ +#!/usr/bin/env bash +set -euo pipefail + +# CASAN Plan-16 SEC-10 — mint a signed agent-identity token. +# +# Proves a caller really IS a given agent (instead of just setting CASAN_AGENT). +# The signed assertion is bound to the agent id AND the run id, so a token cannot +# be replayed for a different run: +# casan-agent|v1|| +# +# Usage: agent-identity-sign.sh +# The matching PUBLIC key must be registered in agent-identities.registry. + +AGENT="${1:-}"; RUN="${2:-}"; PRIV="${3:-}"; SIG_OUT="${4:-}" +if [[ -z "$AGENT" || -z "$RUN" || -z "$PRIV" || -z "$SIG_OUT" ]]; then + echo "Usage: agent-identity-sign.sh " >&2 + exit 64 +fi +command -v openssl >/dev/null 2>&1 || { echo "openssl_unavailable" >&2; exit 1; } + +TMP="$(mktemp)"; trap 'rm -f "$TMP"' EXIT +printf '%s' "casan-agent|v1|$AGENT|$RUN" > "$TMP" +openssl dgst -sha256 -sign "$PRIV" -out "$SIG_OUT" "$TMP" +echo "AGENT_IDENTITY_SIGNED agent=$AGENT run=$RUN sig=$SIG_OUT" diff --git a/AINative_OKR_CASAN5/.specify/scripts/bash/ci-harness-gate.sh b/AINative_OKR_CASAN5/.specify/scripts/bash/ci-harness-gate.sh index 99f9305..501b75b 100755 --- a/AINative_OKR_CASAN5/.specify/scripts/bash/ci-harness-gate.sh +++ b/AINative_OKR_CASAN5/.specify/scripts/bash/ci-harness-gate.sh @@ -102,6 +102,8 @@ run "phase-sec09-input-caps" bash "$TESTS/phase-sec09-tests.sh" run "phase-sec19-atomic-store" bash "$TESTS/phase-sec19-tests.sh" run "phase-sec20-toolchain" bash "$TESTS/phase-sec20-tests.sh" run "phase-sec21-model-budget" bash "$TESTS/phase-sec21-tests.sh" +run "phase-sec07-approval" bash "$TESTS/phase-sec07-tests.sh" +run "phase-sec10-agent-identity" bash "$TESTS/phase-sec10-tests.sh" # ARCH-02: coverage cannot silently drop; ARCH-01: harness/policy cannot silently # drift. Both SKIP cleanly when no manifest is provisioned (non-strict dev/CI). diff --git a/AINative_OKR_CASAN5/.specify/scripts/bash/control-plane-settings.py b/AINative_OKR_CASAN5/.specify/scripts/bash/control-plane-settings.py index 247b897..5babb29 100644 --- a/AINative_OKR_CASAN5/.specify/scripts/bash/control-plane-settings.py +++ b/AINative_OKR_CASAN5/.specify/scripts/bash/control-plane-settings.py @@ -187,14 +187,51 @@ def verify_signature(store): return ("signed", "ok") if res.returncode == 0 else ("invalid", "signature verify failed") +def _approval_enforced() -> bool: + return os.environ.get("CASAN_PROFILE") == "prod" or os.environ.get("CASAN_APPROVAL_STRICT") == "1" + + +def check_approval(key, actor, approval): + """SEC-07 (M-08): a security-sensitive setting change needs a REAL approval. + Dev (default) keeps the backward-compatible "any non-empty --approval" gate; + enforced mode requires a REGISTERED reviewer to cryptographically sign this + change (verified by approval-verify.sh), so a bare string can no longer approve. + Env contract mirrors governance-check: CASAN_APPROVER + CASAN_APPROVAL_SIG (or + CASAN_APPROVAL_JWT). The signed assertion is bound to the key being changed.""" + if not _approval_enforced(): + return bool((approval or "").strip()), "dev_nonstrict" + approver = os.environ.get("CASAN_APPROVER", "") + if not approver: + return False, "no_registered_approver" + verifier = os.path.join(os.path.dirname(__file__), "approval-verify.sh") + if not os.path.isfile(verifier): + return False, "approval_verifier_missing" + import tempfile + fd, inp = tempfile.mkstemp(suffix=".approval-input") + try: + with os.fdopen(fd, "w", encoding="utf-8") as fh: + fh.write(key) # the approval is bound to the key under change + sig = os.environ.get("CASAN_APPROVAL_SIG", "-") + rc = subprocess.run(["bash", verifier, "policy_change", actor, inp, approver, sig], + capture_output=True).returncode + finally: + try: + os.unlink(inp) + except OSError: + pass + return rc == 0, f"approval_verify_rc={rc}" + + def do_set(key, value, actor, reason, approval): policy = SETTINGS_POLICY.get(key) if policy is None: print(f"SETTING_NOT_ALLOWED {key}", file=sys.stderr) return 2 - if policy["securitySensitive"] and not (approval or "").strip(): - print(f"APPROVAL_REQUIRED {key}", file=sys.stderr) - return 3 + if policy["securitySensitive"]: + ok, reason_ = check_approval(key, actor, approval) + if not ok: + print(f"APPROVAL_REQUIRED {key} ({reason_})", file=sys.stderr) + return 3 with store_lock(): # SEC-19: atomic read-modify-write store = load_store() prev = store["settings"].get(key) diff --git a/AINative_OKR_CASAN5/.specify/scripts/bash/kill-switch.sh b/AINative_OKR_CASAN5/.specify/scripts/bash/kill-switch.sh index 9120269..dd5c965 100755 --- a/AINative_OKR_CASAN5/.specify/scripts/bash/kill-switch.sh +++ b/AINative_OKR_CASAN5/.specify/scripts/bash/kill-switch.sh @@ -34,6 +34,21 @@ case "$CMD" in ;; clear) [[ -n "$SCOPE" && -n "$ID" ]] || { echo "usage: kill-switch.sh clear [reason]" >&2; exit 64; } + # SEC-07 (M-08): clearing an emergency stop is a high-trust action. In enforced + # mode it needs a REGISTERED reviewer's verified approval (approval-verify.sh), + # not just "anyone who can run the script". Dev (default) stays unchanged. + if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_APPROVAL_STRICT:-}" == "1" ]]; then + APPROVER="${CASAN_APPROVER:-}" + KS_INP="$(mktemp)"; printf '%s/%s' "$SCOPE" "$ID" > "$KS_INP" + if [[ -z "$APPROVER" ]] || \ + ! bash "$SCRIPT_DIR/approval-verify.sh" kill_switch "${CASAN_ACTOR:-system}" \ + "$KS_INP" "$APPROVER" "${CASAN_APPROVAL_SIG:--}" >/dev/null 2>&1; then + rm -f "$KS_INP" + echo "KILL_SWITCH_CLEAR_DENIED scope=$SCOPE id=$ID reason=approval_required" >&2 + exit 3 + fi + rm -f "$KS_INP" + fi f="$KS_DIR/$(safe "$SCOPE")-$(safe "$ID").on" if [[ -f "$f" ]]; then printf '%s cleared_by=%s reason=%s at=%s\n' "$(cat "$f")" "${CASAN_ACTOR:-system}" "$REASON" "$(ts)" \ diff --git a/AINative_OKR_CASAN5/.specify/scripts/bash/tool-registry-gate.sh b/AINative_OKR_CASAN5/.specify/scripts/bash/tool-registry-gate.sh index 65eb9fb..bd22824 100755 --- a/AINative_OKR_CASAN5/.specify/scripts/bash/tool-registry-gate.sh +++ b/AINative_OKR_CASAN5/.specify/scripts/bash/tool-registry-gate.sh @@ -25,7 +25,33 @@ source "$SCRIPT_DIR/tool-audit-lib.sh" AUDIT_TMP="$(mktemp)" trap 'rm -f "$AUDIT_TMP"' EXIT -DECISION_LINE="$(python - "$REGISTRY" "$TOOL_ID" "${CASAN_IDEMPOTENCY_KEY:-}" "$LOG_DIR/tool-registry.jsonl" "$TRACE_ID" "${CASAN_AGENT:-}" "$AUDIT_TMP" "${CASAN_RUN_ID:-adhoc-$$}" <<'PY' +# SEC-10 (M-05): the effective agent identity used for least-privilege authz. +# Dev (default) trusts CASAN_AGENT (backward compatible). In enforced mode the env +# is NOT trusted — the caller must present a signed token proving it is that agent +# (bound to agent id + run id); otherwise it is treated as UNAUTHENTICATED (empty), +# which denies any restricted tool. This stops `CASAN_AGENT=release-manager` spoofing. +RUN_ID="${CASAN_RUN_ID:-adhoc-$$}" +EFFECTIVE_AGENT="${CASAN_AGENT:-}" +if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_IDENTITY_STRICT:-}" == "1" ]]; then + EFFECTIVE_AGENT="" # unauthenticated until a valid token proves otherwise + CLAIM="${CASAN_AGENT:-}" + SIG="${CASAN_AGENT_SIG:-}" + REG="${CASAN_AGENT_REGISTRY:-$PROJECT_ROOT/.specify/level5/central-governance/agent-identities.registry}" + KEYS_DIR="${CASAN_AGENT_KEYS_DIR:-$PROJECT_ROOT/.specify/level5/central-governance/agents}" + if [[ -n "$CLAIM" && -n "$SIG" && -f "$SIG" && -f "$REG" ]] && command -v openssl >/dev/null 2>&1; then + PUB_REL="$(awk -v id="$CLAIM" '$1=="agent" && $2==id {print $3; exit}' "$REG")" + if [[ -n "$PUB_REL" ]]; then + PUB="$PUB_REL"; [[ "$PUB" = /* ]] || PUB="$KEYS_DIR/$PUB_REL" + TMPM="$(mktemp)"; printf '%s' "casan-agent|v1|$CLAIM|$RUN_ID" > "$TMPM" + if [[ -f "$PUB" ]] && openssl dgst -sha256 -verify "$PUB" -signature "$SIG" "$TMPM" >/dev/null 2>&1; then + EFFECTIVE_AGENT="$CLAIM" + fi + rm -f "$TMPM" + fi + fi +fi + +DECISION_LINE="$(python - "$REGISTRY" "$TOOL_ID" "${CASAN_IDEMPOTENCY_KEY:-}" "$LOG_DIR/tool-registry.jsonl" "$TRACE_ID" "$EFFECTIVE_AGENT" "$AUDIT_TMP" "$RUN_ID" <<'PY' import json import os import re diff --git a/AINative_OKR_CASAN5/.specify/tests/phase-sec07-tests.sh b/AINative_OKR_CASAN5/.specify/tests/phase-sec07-tests.sh new file mode 100644 index 0000000..b4eafbd --- /dev/null +++ b/AINative_OKR_CASAN5/.specify/tests/phase-sec07-tests.sh @@ -0,0 +1,83 @@ +#!/usr/bin/env bash +set -uo pipefail + +# CASAN Plan-16 SEC-07 (M-08) — real approval on the remaining approval sites. +# +# control-plane `set` (sensitive), self-improve `apply`, and kill-switch `clear` +# used to accept ANY non-empty approval string. In enforced mode they now require a +# REGISTERED reviewer to cryptographically sign the request (verified by +# approval-verify.sh) — a bare/forged string is denied. Dev mode stays unchanged. +# +# Self-contained: ephemeral reviewer keypair into a temp reviewers dir, using the +# committed reviewers.registry (security-lead → security role; policy_change needs +# security; kill_switch falls back to the default roles). + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)" +S="$PROJECT_ROOT/.specify/scripts/bash" +REG="$PROJECT_ROOT/.specify/level5/central-governance/reviewers.registry" +WORK="$(mktemp -d)"; RV="$WORK/reviewers"; mkdir -p "$RV" +trap 'rm -rf "$WORK"' EXIT + +# Ephemeral keys: a registered reviewer (security-lead) and an unregistered attacker. +openssl genrsa -out "$WORK/sl.priv" 2048 2>/dev/null +openssl rsa -in "$WORK/sl.priv" -pubout -out "$RV/security-lead.pub.pem" 2>/dev/null +openssl genrsa -out "$WORK/atk.priv" 2048 2>/dev/null + +export CASAN_REVIEWERS_FILE="$REG" CASAN_REVIEWERS_DIR="$RV" +export CASAN_CP_STORE_FILE="$WORK/store.json" CASAN_CP_KEY_DIR="$WORK/cpk" CASAN_CP_PUB="$WORK/cp.pub" + +PASS=0; FAIL=0 +pass() { echo "PASS: $1"; PASS=$((PASS + 1)); } +fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); } +rc_of() { set +e; "$@" >/dev/null 2>&1; echo $?; set -e 2>/dev/null || true; } + +echo "===== Plan-16 SEC-07: real approval verification =====" + +# ---- control-plane set (security-sensitive) ---- +CP="$S/control-plane-settings.py" + +# Backward compat: dev (non-strict) accepts a plain --approval string. +[[ "$(rc_of python3 "$CP" set security.strict true --actor alice --reason r --approval tok)" -eq 0 ]] \ + && pass "dev mode: plain --approval string still works (backward compatible)" \ + || fail "dev-mode approval broke" + +# Enforced: bare string is NOT enough. +[[ "$(rc_of env CASAN_APPROVAL_STRICT=1 python3 "$CP" set security.strict true --actor alice --reason r --approval bogus)" -eq 3 ]] \ + && pass "enforced: bare approval string is DENIED" \ + || fail "enforced mode accepted a bare approval string" + +# Enforced: a valid signed approval by the registered reviewer is accepted. +printf 'security.strict' > "$WORK/keyin" +bash "$S/approval-sign.sh" policy_change alice "$WORK/keyin" security-lead "$WORK/sl.priv" "$WORK/ok.sig" >/dev/null 2>&1 +[[ "$(rc_of env CASAN_APPROVAL_STRICT=1 CASAN_ACTOR=alice CASAN_APPROVER=security-lead CASAN_APPROVAL_SIG="$WORK/ok.sig" \ + python3 "$CP" set security.strict true --actor alice --reason r --approval x)" -eq 0 ]] \ + && pass "enforced: valid reviewer signature is ACCEPTED" \ + || fail "enforced mode rejected a valid signed approval" + +# Enforced: a forged signature (attacker key claiming to be the reviewer) is denied. +bash "$S/approval-sign.sh" policy_change alice "$WORK/keyin" security-lead "$WORK/atk.priv" "$WORK/forged.sig" >/dev/null 2>&1 +[[ "$(rc_of env CASAN_APPROVAL_STRICT=1 CASAN_ACTOR=alice CASAN_APPROVER=security-lead CASAN_APPROVAL_SIG="$WORK/forged.sig" \ + python3 "$CP" set security.strict true --actor alice --reason r --approval x)" -eq 3 ]] \ + && pass "enforced: forged signature is DENIED" \ + || fail "enforced mode accepted a forged signature" + +# ---- kill-switch clear ---- +export CASAN_KILLSWITCH_DIR="$WORK/ks" +bash "$S/kill-switch.sh" engage project ks7 "t" >/dev/null 2>&1 +[[ "$(rc_of env CASAN_APPROVAL_STRICT=1 bash "$S/kill-switch.sh" clear project ks7 r)" -eq 3 ]] \ + && pass "enforced: kill-switch clear without approval is DENIED" \ + || fail "enforced kill-switch clear allowed without approval" +[[ "$(rc_of bash "$S/kill-switch.sh" check project ks7)" -eq 2 ]] \ + && pass "kill-switch remained engaged after denied clear" || fail "switch cleared despite denial" + +printf 'project/ks7' > "$WORK/ksin" +bash "$S/approval-sign.sh" kill_switch admin "$WORK/ksin" security-lead "$WORK/sl.priv" "$WORK/ks.sig" >/dev/null 2>&1 +[[ "$(rc_of env CASAN_APPROVAL_STRICT=1 CASAN_ACTOR=admin CASAN_APPROVER=security-lead CASAN_APPROVAL_SIG="$WORK/ks.sig" \ + bash "$S/kill-switch.sh" clear project ks7 r)" -eq 0 ]] \ + && pass "enforced: kill-switch clear WITH valid approval succeeds" \ + || fail "enforced kill-switch clear rejected a valid approval" + +echo "" +echo "===== SEC-07 SUMMARY: PASS=$PASS FAIL=$FAIL =====" +[[ "$FAIL" -eq 0 ]] || exit 1 diff --git a/AINative_OKR_CASAN5/.specify/tests/phase-sec10-tests.sh b/AINative_OKR_CASAN5/.specify/tests/phase-sec10-tests.sh new file mode 100644 index 0000000..dbfcdbd --- /dev/null +++ b/AINative_OKR_CASAN5/.specify/tests/phase-sec10-tests.sh @@ -0,0 +1,70 @@ +#!/usr/bin/env bash +set -uo pipefail + +# CASAN Plan-16 SEC-10 (M-05) — non-spoofable agent identity. +# +# tool-registry-gate least-privilege trusted CASAN_AGENT (a plain env var anyone can +# set → privilege spoofing). In enforced mode the caller must present a signed token +# proving it is that agent (bound to agent id + run id). Proves: +# * dev mode still trusts CASAN_AGENT (backward compatible), +# * enforced mode denies an env-only claim (no token), +# * a valid token is accepted, +# * a forged token (unregistered key) is denied, +# * a token minted for a different run is denied (no replay). +# +# Self-contained: ephemeral agent keypair + temp registry. + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)" +S="$PROJECT_ROOT/.specify/scripts/bash" +GATE="$S/tool-registry-gate.sh" +WORK="$(mktemp -d)" +trap 'git -C "$PROJECT_ROOT" checkout -- .specify/logs/ 2>/dev/null; rm -rf "$WORK"' EXIT + +AK="$WORK/agents"; mkdir -p "$AK" +openssl genrsa -out "$WORK/rm.priv" 2048 2>/dev/null +openssl rsa -in "$WORK/rm.priv" -pubout -out "$AK/release-manager.pub.pem" 2>/dev/null +openssl genrsa -out "$WORK/atk.priv" 2048 2>/dev/null +printf 'agent release-manager release-manager.pub.pem\n' > "$WORK/reg" + +export CASAN_AGENT_REGISTRY="$WORK/reg" CASAN_AGENT_KEYS_DIR="$AK" CASAN_RUN_ID=run-sec10 +export CASAN_IDEMPOTENCY_KEY=k # deploy is side-effecting + idempotency-required + +PASS=0; FAIL=0 +pass() { echo "PASS: $1"; PASS=$((PASS + 1)); } +fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); } +rc_of() { set +e; "$@" >/dev/null 2>&1; echo $?; set -e 2>/dev/null || true; } + +echo "===== Plan-16 SEC-10: non-spoofable agent identity =====" + +# Dev (default): CASAN_AGENT is trusted (backward compatible). +[[ "$(rc_of env CASAN_AGENT=release-manager bash "$GATE" deploy)" -eq 0 ]] \ + && pass "dev mode: authorized CASAN_AGENT approved (backward compatible)" \ + || fail "dev-mode agent authz broke" + +# Enforced: env-only claim (no token) is denied. +[[ "$(rc_of env CASAN_IDENTITY_STRICT=1 CASAN_AGENT=release-manager bash "$GATE" deploy)" -ne 0 ]] \ + && pass "enforced: env-only agent claim DENIED (spoof blocked)" \ + || fail "enforced mode trusted a bare CASAN_AGENT env" + +# Enforced: a valid signed token is accepted. +bash "$S/agent-identity-sign.sh" release-manager run-sec10 "$WORK/rm.priv" "$WORK/rm.sig" >/dev/null 2>&1 +[[ "$(rc_of env CASAN_IDENTITY_STRICT=1 CASAN_AGENT=release-manager CASAN_AGENT_SIG="$WORK/rm.sig" bash "$GATE" deploy)" -eq 0 ]] \ + && pass "enforced: valid signed agent token ACCEPTED" \ + || fail "enforced mode rejected a valid agent token" + +# Enforced: a forged token (attacker key claiming to be release-manager) is denied. +bash "$S/agent-identity-sign.sh" release-manager run-sec10 "$WORK/atk.priv" "$WORK/forged.sig" >/dev/null 2>&1 +[[ "$(rc_of env CASAN_IDENTITY_STRICT=1 CASAN_AGENT=release-manager CASAN_AGENT_SIG="$WORK/forged.sig" bash "$GATE" deploy)" -ne 0 ]] \ + && pass "enforced: forged agent token DENIED" \ + || fail "enforced mode accepted a forged agent token" + +# Enforced: a token minted for a DIFFERENT run cannot be replayed. +bash "$S/agent-identity-sign.sh" release-manager other-run "$WORK/rm.priv" "$WORK/replay.sig" >/dev/null 2>&1 +[[ "$(rc_of env CASAN_IDENTITY_STRICT=1 CASAN_AGENT=release-manager CASAN_AGENT_SIG="$WORK/replay.sig" bash "$GATE" deploy)" -ne 0 ]] \ + && pass "enforced: token bound to another run DENIED (no replay)" \ + || fail "enforced mode allowed a cross-run token replay" + +echo "" +echo "===== SEC-10 SUMMARY: PASS=$PASS FAIL=$FAIL =====" +[[ "$FAIL" -eq 0 ]] || exit 1 diff --git a/AINative_OKR_CASAN5/.specify/tests/test-integrity-manifest.json b/AINative_OKR_CASAN5/.specify/tests/test-integrity-manifest.json index e9077dd..ab20156 100644 --- a/AINative_OKR_CASAN5/.specify/tests/test-integrity-manifest.json +++ b/AINative_OKR_CASAN5/.specify/tests/test-integrity-manifest.json @@ -80,6 +80,10 @@ "sha256": "71e04cba738f501e79dd6b2c02aa86c7434c5ce541af5c7e512a2c94219f1c33", "checks": 5 }, + "phase-sec07-tests.sh": { + "sha256": "9d8857bbfb374eb4db130344fb00da1c13801d90b092253725d7f63f45edea81", + "checks": 7 + }, "phase-sec08-tests.sh": { "sha256": "ae4df77eed43cf235198c2489cc89a9fa083a66133137b3eb61b42fd021fd3c3", "checks": 4 @@ -88,6 +92,10 @@ "sha256": "7d98d0a5a646d1500e4701710ceb4009eea22deb266c3b27b5f7b2850efc2f4a", "checks": 7 }, + "phase-sec10-tests.sh": { + "sha256": "099c81a0a37b51137dbf328dbe2ef778226d0716b97660d083c1fcc6a4aecd19", + "checks": 5 + }, "phase-sec16-tests.sh": { "sha256": "3d826ca4f5c8f98837cc70846b8e2f2f83d5a598c2a5907795e8b9cc9db448c2", "checks": 6 @@ -153,6 +161,6 @@ "checks": 10 } }, - "total_checks": 331, - "suite_count": 38 + "total_checks": 343, + "suite_count": 40 } diff --git a/AINative_OKR_CASAN5/.specify/tests/test-integrity-manifest.json.head b/AINative_OKR_CASAN5/.specify/tests/test-integrity-manifest.json.head index a9b6c5e..22b79fc 100644 --- a/AINative_OKR_CASAN5/.specify/tests/test-integrity-manifest.json.head +++ b/AINative_OKR_CASAN5/.specify/tests/test-integrity-manifest.json.head @@ -1 +1 @@ -30124645ed601ca08017707be27592b23c98c35dff08cb419362d585cffa0daf \ No newline at end of file +5a25c53485019236dc7383f714812f2ed455c09dde2316e7ce6a9f4a4c58a852 \ No newline at end of file diff --git a/AINative_OKR_CASAN5/.specify/tests/test-integrity-manifest.json.sig b/AINative_OKR_CASAN5/.specify/tests/test-integrity-manifest.json.sig index 6ac2d51..f81c3b2 100644 --- a/AINative_OKR_CASAN5/.specify/tests/test-integrity-manifest.json.sig +++ b/AINative_OKR_CASAN5/.specify/tests/test-integrity-manifest.json.sig @@ -1,3 +1 @@ -4,FN>2