gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: plan 16 P1 complete (SEC-07 approval + SEC-10 agent identity)

Browse Source 
- SEC-07 (M-08): real approval verification via approval-verify.sh in enforced mode
  (CASAN_PROFILE=prod / CASAN_APPROVAL_STRICT=1) for control-plane `set` (sensitive
  keys), kill-switch `clear`, and self-improve (inherits control-plane). A bare or
  forged approval string is now denied; dev mode stays backward-compatible.
- SEC-10 (M-05): non-spoofable agent identity. tool-registry-gate least-privilege no
  longer trusts CASAN_AGENT env in enforced mode (CASAN_IDENTITY_STRICT=1) — the
  caller must present a signed token (agent-identity-sign.sh) bound to agent id +
  run id, verified against agent-identities.registry. Blocks env spoofing + replay.

Verify: SEC+integrity gate 18/0, run-casan4 0-FAIL, adversarial 44/44 (H2 intact),
control-plane 9/0, h5-approval 12/0, c7-incident 15/0, self-improve 7/0, track-c 29/0.

Plan-16 P0 + P1 now complete; remaining: P2 (SEC-12/13/14/15/22..30).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
2026-07-06 22:31:57 +09:00
co-authored by Claude Opus 4.8
parent e70f0815ab
commit 3432ae59e1
11 changed files with 295 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AINative_OKR_CASAN5/.specify/level5/central-governance/agent-identities.registry
+22
View File
@@ -0,0 +1,22 @@
# CASAN Plan-16 SEC-10 — agent-identity registry (non-spoofable least-privilege).
#
# tool-registry-gate.sh least-privilege used to trust CASAN_AGENT (a plain env var
# anyone can set). Under CASAN_PROFILE=prod (or CASAN_IDENTITY_STRICT=1) the caller
# must instead present a signed token proving it is that agent — verified against
# one of the PUBLIC keys below. Private keys live OFF-REPO (with the agent runner /
# issued by an IdP); only public keys are provisioned here (same policy as the audit
# and reviewer signing keys).
#
# Line format (no yaml dependency):
# agent <agent-id> <pubkey-file> # pubkey-file relative to the agents/ dir
#
# Token minted with: agent-identity-sign.sh <agent-id> <run-id> <priv> <sig-out>
# Presented via: CASAN_AGENT=<id> CASAN_AGENT_SIG=<sig> CASAN_RUN_ID=<run>
#
# NOTE: pubkeys under agents/ are provisioned out-of-band by ops. Until then,
# enforced mode fails CLOSED (an unproven agent is denied every restricted tool).
agent release-manager release-manager.pub.pem
agent implement-agent implement-agent.pub.pem
agent design-agent design-agent.pub.pem
agent review-agent review-agent.pub.pem