feat: plan 16 P1 complete (SEC-07 approval + SEC-10 agent identity)
- SEC-07 (M-08): real approval verification via approval-verify.sh in enforced mode (CASAN_PROFILE=prod / CASAN_APPROVAL_STRICT=1) for control-plane `set` (sensitive keys), kill-switch `clear`, and self-improve (inherits control-plane). A bare or forged approval string is now denied; dev mode stays backward-compatible. - SEC-10 (M-05): non-spoofable agent identity. tool-registry-gate least-privilege no longer trusts CASAN_AGENT env in enforced mode (CASAN_IDENTITY_STRICT=1) — the caller must present a signed token (agent-identity-sign.sh) bound to agent id + run id, verified against agent-identities.registry. Blocks env spoofing + replay. Verify: SEC+integrity gate 18/0, run-casan4 0-FAIL, adversarial 44/44 (H2 intact), control-plane 9/0, h5-approval 12/0, c7-incident 15/0, self-improve 7/0, track-c 29/0. Plan-16 P0 + P1 now complete; remaining: P2 (SEC-12/13/14/15/22..30). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
e70f0815ab
commit
3432ae59e1
@@ -0,0 +1,24 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
# CASAN Plan-16 SEC-10 — mint a signed agent-identity token.
|
||||
#
|
||||
# Proves a caller really IS a given agent (instead of just setting CASAN_AGENT).
|
||||
# The signed assertion is bound to the agent id AND the run id, so a token cannot
|
||||
# be replayed for a different run:
|
||||
# casan-agent|v1|<agent-id>|<run-id>
|
||||
#
|
||||
# Usage: agent-identity-sign.sh <agent-id> <run-id> <private-key> <sig-out>
|
||||
# The matching PUBLIC key must be registered in agent-identities.registry.
|
||||
|
||||
AGENT="${1:-}"; RUN="${2:-}"; PRIV="${3:-}"; SIG_OUT="${4:-}"
|
||||
if [[ -z "$AGENT" || -z "$RUN" || -z "$PRIV" || -z "$SIG_OUT" ]]; then
|
||||
echo "Usage: agent-identity-sign.sh <agent-id> <run-id> <private-key> <sig-out>" >&2
|
||||
exit 64
|
||||
fi
|
||||
command -v openssl >/dev/null 2>&1 || { echo "openssl_unavailable" >&2; exit 1; }
|
||||
|
||||
TMP="$(mktemp)"; trap 'rm -f "$TMP"' EXIT
|
||||
printf '%s' "casan-agent|v1|$AGENT|$RUN" > "$TMP"
|
||||
openssl dgst -sha256 -sign "$PRIV" -out "$SIG_OUT" "$TMP"
|
||||
echo "AGENT_IDENTITY_SIGNED agent=$AGENT run=$RUN sig=$SIG_OUT"
|
||||
@@ -102,6 +102,8 @@ run "phase-sec09-input-caps" bash "$TESTS/phase-sec09-tests.sh"
|
||||
run "phase-sec19-atomic-store" bash "$TESTS/phase-sec19-tests.sh"
|
||||
run "phase-sec20-toolchain" bash "$TESTS/phase-sec20-tests.sh"
|
||||
run "phase-sec21-model-budget" bash "$TESTS/phase-sec21-tests.sh"
|
||||
run "phase-sec07-approval" bash "$TESTS/phase-sec07-tests.sh"
|
||||
run "phase-sec10-agent-identity" bash "$TESTS/phase-sec10-tests.sh"
|
||||
|
||||
# ARCH-02: coverage cannot silently drop; ARCH-01: harness/policy cannot silently
|
||||
# drift. Both SKIP cleanly when no manifest is provisioned (non-strict dev/CI).
|
||||
|
||||
@@ -187,14 +187,51 @@ def verify_signature(store):
|
||||
return ("signed", "ok") if res.returncode == 0 else ("invalid", "signature verify failed")
|
||||
|
||||
|
||||
def _approval_enforced() -> bool:
|
||||
return os.environ.get("CASAN_PROFILE") == "prod" or os.environ.get("CASAN_APPROVAL_STRICT") == "1"
|
||||
|
||||
|
||||
def check_approval(key, actor, approval):
|
||||
"""SEC-07 (M-08): a security-sensitive setting change needs a REAL approval.
|
||||
Dev (default) keeps the backward-compatible "any non-empty --approval" gate;
|
||||
enforced mode requires a REGISTERED reviewer to cryptographically sign this
|
||||
change (verified by approval-verify.sh), so a bare string can no longer approve.
|
||||
Env contract mirrors governance-check: CASAN_APPROVER + CASAN_APPROVAL_SIG (or
|
||||
CASAN_APPROVAL_JWT). The signed assertion is bound to the key being changed."""
|
||||
if not _approval_enforced():
|
||||
return bool((approval or "").strip()), "dev_nonstrict"
|
||||
approver = os.environ.get("CASAN_APPROVER", "")
|
||||
if not approver:
|
||||
return False, "no_registered_approver"
|
||||
verifier = os.path.join(os.path.dirname(__file__), "approval-verify.sh")
|
||||
if not os.path.isfile(verifier):
|
||||
return False, "approval_verifier_missing"
|
||||
import tempfile
|
||||
fd, inp = tempfile.mkstemp(suffix=".approval-input")
|
||||
try:
|
||||
with os.fdopen(fd, "w", encoding="utf-8") as fh:
|
||||
fh.write(key) # the approval is bound to the key under change
|
||||
sig = os.environ.get("CASAN_APPROVAL_SIG", "-")
|
||||
rc = subprocess.run(["bash", verifier, "policy_change", actor, inp, approver, sig],
|
||||
capture_output=True).returncode
|
||||
finally:
|
||||
try:
|
||||
os.unlink(inp)
|
||||
except OSError:
|
||||
pass
|
||||
return rc == 0, f"approval_verify_rc={rc}"
|
||||
|
||||
|
||||
def do_set(key, value, actor, reason, approval):
|
||||
policy = SETTINGS_POLICY.get(key)
|
||||
if policy is None:
|
||||
print(f"SETTING_NOT_ALLOWED {key}", file=sys.stderr)
|
||||
return 2
|
||||
if policy["securitySensitive"] and not (approval or "").strip():
|
||||
print(f"APPROVAL_REQUIRED {key}", file=sys.stderr)
|
||||
return 3
|
||||
if policy["securitySensitive"]:
|
||||
ok, reason_ = check_approval(key, actor, approval)
|
||||
if not ok:
|
||||
print(f"APPROVAL_REQUIRED {key} ({reason_})", file=sys.stderr)
|
||||
return 3
|
||||
with store_lock(): # SEC-19: atomic read-modify-write
|
||||
store = load_store()
|
||||
prev = store["settings"].get(key)
|
||||
|
||||
@@ -34,6 +34,21 @@ case "$CMD" in
|
||||
;;
|
||||
clear)
|
||||
[[ -n "$SCOPE" && -n "$ID" ]] || { echo "usage: kill-switch.sh clear <scope> <id> [reason]" >&2; exit 64; }
|
||||
# SEC-07 (M-08): clearing an emergency stop is a high-trust action. In enforced
|
||||
# mode it needs a REGISTERED reviewer's verified approval (approval-verify.sh),
|
||||
# not just "anyone who can run the script". Dev (default) stays unchanged.
|
||||
if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_APPROVAL_STRICT:-}" == "1" ]]; then
|
||||
APPROVER="${CASAN_APPROVER:-}"
|
||||
KS_INP="$(mktemp)"; printf '%s/%s' "$SCOPE" "$ID" > "$KS_INP"
|
||||
if [[ -z "$APPROVER" ]] || \
|
||||
! bash "$SCRIPT_DIR/approval-verify.sh" kill_switch "${CASAN_ACTOR:-system}" \
|
||||
"$KS_INP" "$APPROVER" "${CASAN_APPROVAL_SIG:--}" >/dev/null 2>&1; then
|
||||
rm -f "$KS_INP"
|
||||
echo "KILL_SWITCH_CLEAR_DENIED scope=$SCOPE id=$ID reason=approval_required" >&2
|
||||
exit 3
|
||||
fi
|
||||
rm -f "$KS_INP"
|
||||
fi
|
||||
f="$KS_DIR/$(safe "$SCOPE")-$(safe "$ID").on"
|
||||
if [[ -f "$f" ]]; then
|
||||
printf '%s cleared_by=%s reason=%s at=%s\n' "$(cat "$f")" "${CASAN_ACTOR:-system}" "$REASON" "$(ts)" \
|
||||
|
||||
@@ -25,7 +25,33 @@ source "$SCRIPT_DIR/tool-audit-lib.sh"
|
||||
AUDIT_TMP="$(mktemp)"
|
||||
trap 'rm -f "$AUDIT_TMP"' EXIT
|
||||
|
||||
DECISION_LINE="$(python - "$REGISTRY" "$TOOL_ID" "${CASAN_IDEMPOTENCY_KEY:-}" "$LOG_DIR/tool-registry.jsonl" "$TRACE_ID" "${CASAN_AGENT:-}" "$AUDIT_TMP" "${CASAN_RUN_ID:-adhoc-$$}" <<'PY'
|
||||
# SEC-10 (M-05): the effective agent identity used for least-privilege authz.
|
||||
# Dev (default) trusts CASAN_AGENT (backward compatible). In enforced mode the env
|
||||
# is NOT trusted — the caller must present a signed token proving it is that agent
|
||||
# (bound to agent id + run id); otherwise it is treated as UNAUTHENTICATED (empty),
|
||||
# which denies any restricted tool. This stops `CASAN_AGENT=release-manager` spoofing.
|
||||
RUN_ID="${CASAN_RUN_ID:-adhoc-$$}"
|
||||
EFFECTIVE_AGENT="${CASAN_AGENT:-}"
|
||||
if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_IDENTITY_STRICT:-}" == "1" ]]; then
|
||||
EFFECTIVE_AGENT="" # unauthenticated until a valid token proves otherwise
|
||||
CLAIM="${CASAN_AGENT:-}"
|
||||
SIG="${CASAN_AGENT_SIG:-}"
|
||||
REG="${CASAN_AGENT_REGISTRY:-$PROJECT_ROOT/.specify/level5/central-governance/agent-identities.registry}"
|
||||
KEYS_DIR="${CASAN_AGENT_KEYS_DIR:-$PROJECT_ROOT/.specify/level5/central-governance/agents}"
|
||||
if [[ -n "$CLAIM" && -n "$SIG" && -f "$SIG" && -f "$REG" ]] && command -v openssl >/dev/null 2>&1; then
|
||||
PUB_REL="$(awk -v id="$CLAIM" '$1=="agent" && $2==id {print $3; exit}' "$REG")"
|
||||
if [[ -n "$PUB_REL" ]]; then
|
||||
PUB="$PUB_REL"; [[ "$PUB" = /* ]] || PUB="$KEYS_DIR/$PUB_REL"
|
||||
TMPM="$(mktemp)"; printf '%s' "casan-agent|v1|$CLAIM|$RUN_ID" > "$TMPM"
|
||||
if [[ -f "$PUB" ]] && openssl dgst -sha256 -verify "$PUB" -signature "$SIG" "$TMPM" >/dev/null 2>&1; then
|
||||
EFFECTIVE_AGENT="$CLAIM"
|
||||
fi
|
||||
rm -f "$TMPM"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
DECISION_LINE="$(python - "$REGISTRY" "$TOOL_ID" "${CASAN_IDEMPOTENCY_KEY:-}" "$LOG_DIR/tool-registry.jsonl" "$TRACE_ID" "$EFFECTIVE_AGENT" "$AUDIT_TMP" "$RUN_ID" <<'PY'
|
||||
import json
|
||||
import os
|
||||
import re
|
||||
|
||||
Reference in New Issue
Block a user