gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: plan 16 P1 complete (SEC-07 approval + SEC-10 agent identity)

Browse Source 
- SEC-07 (M-08): real approval verification via approval-verify.sh in enforced mode
  (CASAN_PROFILE=prod / CASAN_APPROVAL_STRICT=1) for control-plane `set` (sensitive
  keys), kill-switch `clear`, and self-improve (inherits control-plane). A bare or
  forged approval string is now denied; dev mode stays backward-compatible.
- SEC-10 (M-05): non-spoofable agent identity. tool-registry-gate least-privilege no
  longer trusts CASAN_AGENT env in enforced mode (CASAN_IDENTITY_STRICT=1) — the
  caller must present a signed token (agent-identity-sign.sh) bound to agent id +
  run id, verified against agent-identities.registry. Blocks env spoofing + replay.

Verify: SEC+integrity gate 18/0, run-casan4 0-FAIL, adversarial 44/44 (H2 intact),
control-plane 9/0, h5-approval 12/0, c7-incident 15/0, self-improve 7/0, track-c 29/0.

Plan-16 P0 + P1 now complete; remaining: P2 (SEC-12/13/14/15/22..30).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
2026-07-06 22:31:57 +09:00
co-authored by Claude Opus 4.8
parent e70f0815ab
commit 3432ae59e1
11 changed files with 295 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AINative_OKR_CASAN5/.specify/scripts/bash/tool-registry-gate.sh
+27 -1
View File
@@ -25,7 +25,33 @@ source "$SCRIPT_DIR/tool-audit-lib.sh"
AUDIT_TMP="$(mktemp)"
trap 'rm -f "$AUDIT_TMP"' EXIT
DECISION_LINE="$(python - "$REGISTRY" "$TOOL_ID" "${CASAN_IDEMPOTENCY_KEY:-}" "$LOG_DIR/tool-registry.jsonl" "$TRACE_ID" "${CASAN_AGENT:-}" "$AUDIT_TMP" "${CASAN_RUN_ID:-adhoc-$$}" <<'PY'
# SEC-10 (M-05): the effective agent identity used for least-privilege authz.
# Dev (default) trusts CASAN_AGENT (backward compatible). In enforced mode the env
# is NOT trusted — the caller must present a signed token proving it is that agent
# (bound to agent id + run id); otherwise it is treated as UNAUTHENTICATED (empty),
# which denies any restricted tool. This stops `CASAN_AGENT=release-manager` spoofing.
RUN_ID="${CASAN_RUN_ID:-adhoc-$$}"
EFFECTIVE_AGENT="${CASAN_AGENT:-}"
if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_IDENTITY_STRICT:-}" == "1" ]]; then
EFFECTIVE_AGENT="" # unauthenticated until a valid token proves otherwise
CLAIM="${CASAN_AGENT:-}"
SIG="${CASAN_AGENT_SIG:-}"
REG="${CASAN_AGENT_REGISTRY:-$PROJECT_ROOT/.specify/level5/central-governance/agent-identities.registry}"
KEYS_DIR="${CASAN_AGENT_KEYS_DIR:-$PROJECT_ROOT/.specify/level5/central-governance/agents}"
if [[ -n "$CLAIM" && -n "$SIG" && -f "$SIG" && -f "$REG" ]] && command -v openssl >/dev/null 2>&1; then
PUB_REL="$(awk -v id="$CLAIM" '$1=="agent" && $2==id {print $3; exit}' "$REG")"
if [[ -n "$PUB_REL" ]]; then
PUB="$PUB_REL"; [[ "$PUB" = /* ]] || PUB="$KEYS_DIR/$PUB_REL"
TMPM="$(mktemp)"; printf '%s' "casan-agent|v1|$CLAIM|$RUN_ID" > "$TMPM"
if [[ -f "$PUB" ]] && openssl dgst -sha256 -verify "$PUB" -signature "$SIG" "$TMPM" >/dev/null 2>&1; then
EFFECTIVE_AGENT="$CLAIM"
fi
rm -f "$TMPM"
fi
fi
fi
DECISION_LINE="$(python - "$REGISTRY" "$TOOL_ID" "${CASAN_IDEMPOTENCY_KEY:-}" "$LOG_DIR/tool-registry.jsonl" "$TRACE_ID" "$EFFECTIVE_AGENT" "$AUDIT_TMP" "$RUN_ID" <<'PY'
import json
import os
import re