refactor(structure): promote app to repo root + remove redundant workspace cruft

Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now the repository root. No more wrapper directory. - Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/ .specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands + launch.json), .github moved up. - Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md, tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review..., README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning artifacts — roadmap + design history preserved in git log / commit messages). - Update all references to the old layout: - .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml: working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts} -> packages/casan-harness/... (.specify/logs state kept) - .claude/launch.json, .gitea/*-runbook.md: path prefixes - CLAUDE.md, README.md: docs/input -> apps/okr/domain/input - policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed - secrets-scan.sh: fixture excludes -> new package/domain paths. Full gate from the new root: PASS=64 FAIL=0 SKIP=3. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-08 13:26:36 +09:00
parent 7101af9fd4
commit 36a4812ef3
925 changed files with 410 additions and 18001 deletions
@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# CASAN H5 — Sign the audit chain head hash via Vault KMS (or local key fallback).
+#
+# Called by CI after harness tests rebuild audit.jsonl, so that
+# verify-audit-chain.sh produces "anchor=signed" (not "anchor=unsigned").
+#
+# Usage:
+#   sign-audit-head.sh [audit-jsonl]
+#
+# Writes:
+#   <audit-dir>/audit-head.txt  — the head hash (plain text)
+#   <audit-dir>/audit-head.sig  — RSA signature of audit-head.txt
+#
+# After this script, verify-audit-chain.sh reports:
+#   AUDIT_CHAIN_VALID anchor=signed
+#
+# Environment (KMS path):
+#   VAULT_ADDR   — e.g. http://vault:8200
+#   VAULT_TOKEN  — token with transit/sign/casan-audit-key capability
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/casan-paths.sh"
+PROJECT_ROOT="$CASAN_APP_ROOT"
+
+AUDIT_LOG="${1:-$CASAN_STATE_ROOT/logs/audit/audit.jsonl}"
+AUDIT_DIR="$(dirname "$AUDIT_LOG")"
+HEAD_FILE="$AUDIT_DIR/audit-head.txt"
+HEAD_SIG="$AUDIT_DIR/audit-head.sig"
+AUDIT_PUB="$CASAN_GOVERNANCE_ROOT/audit-public.pem"
+
+if [[ ! -f "$AUDIT_LOG" ]]; then
+  echo "SIGN_AUDIT_HEAD_SKIP audit.jsonl not found" >&2
+  exit 0
+fi
+
+# ── Compute the current chain head ────────────────────────────────────────
+HEAD_HASH="$(python - "$AUDIT_LOG" <<'PY'
+import hashlib, json, sys
+path = sys.argv[1]
+previous = ""
+with open(path, encoding="utf-8") as f:
+    for line in f:
+        if not line.strip():
+            continue
+        record = json.loads(line)
+        core = "|".join([
+            record.get("timestamp",""), record.get("trace_id",""),
+            record.get("action",""), record.get("actor",""),
+            record.get("risk_level",""), record.get("decision",""),
+            record.get("approval_status",""), record.get("approver",""),
+            record.get("input_hash",""), record.get("output_hash",""),
+            previous,
+        ])
+        previous = hashlib.sha256(core.encode()).hexdigest()
+print(previous)
+PY
+)"
+
+if [[ -z "$HEAD_HASH" ]]; then
+  echo "SIGN_AUDIT_HEAD_SKIP empty chain" >&2
+  exit 0
+fi
+
+printf '%s' "$HEAD_HASH" > "$HEAD_FILE"
+
+# ── Sign the head file ────────────────────────────────────────────────────
+VAULT_KMS="$SCRIPT_DIR/vault-kms.sh"
+
+if [[ -n "${VAULT_ADDR:-}" && -n "${VAULT_TOKEN:-}" ]] && \
+   curl -sf "$VAULT_ADDR/v1/sys/health" >/dev/null 2>&1; then
+  # KMS path — sign via Vault Transit, export public key
+  bash "$VAULT_KMS" enable-transit
+  bash "$VAULT_KMS" sign   "$HEAD_FILE" "$HEAD_SIG" "casan-audit-key"
+  bash "$VAULT_KMS" pubkey "$AUDIT_PUB"              "casan-audit-key"
+  echo "SIGN_AUDIT_HEAD_OK head=$HEAD_HASH anchor=vault-kms"
+
+  # Also re-sign the tool-calls chain head with the same Vault key so that
+  # verify-tool-audit.sh can verify using the same audit-public.pem.
+  TOOL_LOG="$AUDIT_DIR/tool-calls.jsonl"
+  if [[ -f "$TOOL_LOG" ]]; then
+    TOOL_HEAD="$(python - "$TOOL_LOG" <<'PY'
+import hashlib, json, sys
+prev = ""
+with open(sys.argv[1], encoding="utf-8") as f:
+    for line in f:
+        if not line.strip(): continue
+        rec = json.loads(line)
+        stored = rec.pop("record_hash", "")
+        core = json.dumps(rec, sort_keys=True, separators=(",", ":"))
+        if hashlib.sha256((prev + "|" + core).encode()).hexdigest() != stored:
+            raise SystemExit("TOOL_CHAIN_BROKEN")
+        prev = stored
+sys.stdout.write(prev)
+PY
+)"
+    if [[ -n "$TOOL_HEAD" ]]; then
+      printf '%s' "$TOOL_HEAD" > "$AUDIT_DIR/tool-calls-head.txt"
+      bash "$VAULT_KMS" sign "$AUDIT_DIR/tool-calls-head.txt" "$AUDIT_DIR/tool-calls-head.sig" "casan-audit-key"
+      echo "SIGN_TOOL_AUDIT_HEAD_OK head=$TOOL_HEAD anchor=vault-kms"
+    fi
+  fi
+else
+  # Fallback — local key (dev environment without Vault)
+  AUDIT_PRIV="$CASAN_GOVERNANCE_ROOT/audit-private.pem"
+  if [[ ! -f "$AUDIT_PRIV" ]]; then
+    echo "SIGN_AUDIT_HEAD_SKIP no private key and VAULT_ADDR not set — verify will show anchor=unsigned" >&2
+    exit 0
+  fi
+  openssl dgst -sha256 -sign "$AUDIT_PRIV" -out "$HEAD_SIG" "$HEAD_FILE"
+  echo "SIGN_AUDIT_HEAD_OK head=$HEAD_HASH anchor=local-file"
+fi
+
+# A4/V9: also bind token/cost telemetry to a signed manifest so tampering with
+# provider-usage.jsonl / metrics.jsonl is detectable. Best-effort — never fails
+# the audit signing step (verify-telemetry-integrity.sh is the gate).
+bash "$SCRIPT_DIR/telemetry-integrity.sh" sign >/dev/null 2>&1 || true