gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: plan 16 P1 complete (SEC-07 approval + SEC-10 agent identity)

Browse Source 
- SEC-07 (M-08): real approval verification via approval-verify.sh in enforced mode
  (CASAN_PROFILE=prod / CASAN_APPROVAL_STRICT=1) for control-plane `set` (sensitive
  keys), kill-switch `clear`, and self-improve (inherits control-plane). A bare or
  forged approval string is now denied; dev mode stays backward-compatible.
- SEC-10 (M-05): non-spoofable agent identity. tool-registry-gate least-privilege no
  longer trusts CASAN_AGENT env in enforced mode (CASAN_IDENTITY_STRICT=1) — the
  caller must present a signed token (agent-identity-sign.sh) bound to agent id +
  run id, verified against agent-identities.registry. Blocks env spoofing + replay.

Verify: SEC+integrity gate 18/0, run-casan4 0-FAIL, adversarial 44/44 (H2 intact),
control-plane 9/0, h5-approval 12/0, c7-incident 15/0, self-improve 7/0, track-c 29/0.

Plan-16 P0 + P1 now complete; remaining: P2 (SEC-12/13/14/15/22..30).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
2026-07-06 22:31:57 +09:00
co-authored by Claude Opus 4.8
parent e70f0815ab
commit 3432ae59e1
11 changed files with 295 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AINative_OKR_CASAN5/.specify/scripts/bash/kill-switch.sh
+15
View File
@@ -34,6 +34,21 @@ case "$CMD" in
;;
clear)
[[ -n "$SCOPE" && -n "$ID" ]] || { echo "usage: kill-switch.sh clear <scope> <id> [reason]" >&2; exit 64; }
# SEC-07 (M-08): clearing an emergency stop is a high-trust action. In enforced
# mode it needs a REGISTERED reviewer's verified approval (approval-verify.sh),
# not just "anyone who can run the script". Dev (default) stays unchanged.
if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_APPROVAL_STRICT:-}" == "1" ]]; then
APPROVER="${CASAN_APPROVER:-}"
KS_INP="$(mktemp)"; printf '%s/%s' "$SCOPE" "$ID" > "$KS_INP"
if [[ -z "$APPROVER" ]] || \
! bash "$SCRIPT_DIR/approval-verify.sh" kill_switch "${CASAN_ACTOR:-system}" \
"$KS_INP" "$APPROVER" "${CASAN_APPROVAL_SIG:--}" >/dev/null 2>&1; then
rm -f "$KS_INP"
echo "KILL_SWITCH_CLEAR_DENIED scope=$SCOPE id=$ID reason=approval_required" >&2
exit 3
fi
rm -f "$KS_INP"
fi
f="$KS_DIR/$(safe "$SCOPE")-$(safe "$ID").on"
if [[ -f "$f" ]]; then
printf '%s cleared_by=%s reason=%s at=%s\n' "$(cat "$f")" "${CASAN_ACTOR:-system}" "$REASON" "$(ts)" \