refactor(structure): promote app to repo root + remove redundant workspace cruft
Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.
- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
.specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
- .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
-> packages/casan-harness/... (.specify/logs state kept)
- .claude/launch.json, .gitea/*-runbook.md: path prefixes
- CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
- policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.
Full gate from the new root: PASS=64 FAIL=0 SKIP=3.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
7101af9fd4
commit
36a4812ef3
@@ -0,0 +1,135 @@
|
||||
#!/usr/bin/env pwsh
|
||||
# CASAN H5 Compliance Report Generator
|
||||
# Usage:
|
||||
# generate-compliance-report.ps1 -FeatureId <id> -OutputPath <path>
|
||||
|
||||
param(
|
||||
[Parameter(Mandatory=$true)][string]$FeatureId,
|
||||
[string]$OutputPath = ""
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
$scriptDir = Split-Path $MyInvocation.MyCommand.Path -Parent
|
||||
$projectRoot = (Resolve-Path (Join-Path $scriptDir "../../..")).Path
|
||||
$auditLog = Join-Path $projectRoot ".specify/logs/audit/audit.jsonl"
|
||||
$secAudit = Join-Path $projectRoot ".specify/logs/audit/security.jsonl"
|
||||
$toolAudit = Join-Path $projectRoot ".specify/logs/audit/tool-calls.jsonl"
|
||||
|
||||
if (!$OutputPath) {
|
||||
$outDir = Join-Path $projectRoot "docs/output/output_logs/$FeatureId"
|
||||
if (!(Test-Path $outDir)) { New-Item -ItemType Directory -Force -Path $outDir | Out-Null }
|
||||
$OutputPath = Join-Path $outDir "compliance-report.md"
|
||||
}
|
||||
|
||||
$timestamp = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
|
||||
|
||||
# ── Read audit records ─────────────────────────────────────────────────────
|
||||
function Read-Jsonl ([string]$path) {
|
||||
if (!(Test-Path $path)) { return @() }
|
||||
Get-Content $path | ForEach-Object {
|
||||
try { $_ | ConvertFrom-Json } catch { $null }
|
||||
} | Where-Object { $_ }
|
||||
}
|
||||
|
||||
$govRecords = Read-Jsonl $auditLog
|
||||
$secRecords = Read-Jsonl $secAudit
|
||||
$toolRecords = Read-Jsonl $toolAudit
|
||||
|
||||
# ── Statistics ─────────────────────────────────────────────────────────────
|
||||
$totalActions = $govRecords.Count
|
||||
$highRisk = $govRecords | Where-Object { $_.risk_level -eq "high" }
|
||||
$denied = $govRecords | Where-Object { $_.decision -eq "denied" }
|
||||
$humanApproved = $govRecords | Where-Object { $_.approval_status -eq "human_approved" }
|
||||
$secBlocked = $secRecords | Where-Object { $_.status -eq "blocked" }
|
||||
$piiMasked = $secRecords | Where-Object { $_.action -eq "allow" -and $_.matched_rules }
|
||||
$toolCalls = $toolRecords.Count
|
||||
$toolDenied = $toolRecords | Where-Object { $_.decision -eq "denied" }
|
||||
|
||||
# ── Audit chain validation ─────────────────────────────────────────────────
|
||||
$chainValid = $true
|
||||
$prevHash = ""
|
||||
foreach ($rec in $govRecords) {
|
||||
if ($prevHash -and $rec.previous_record_hash -ne $prevHash) { $chainValid = $false; break }
|
||||
$prevHash = $rec.record_hash
|
||||
}
|
||||
$chainStatus = if ($chainValid) { "VALID ✅" } else { "BROKEN ⚠️" }
|
||||
|
||||
# ── Report content ─────────────────────────────────────────────────────────
|
||||
$highRiskTable = if ($highRisk) {
|
||||
$highRisk | ForEach-Object { "| $($_.timestamp) | $($_.action) | $($_.decision) | $($_.approver) | $($_.approval_status) |" }
|
||||
} else { "| — | — | — | — | — |" }
|
||||
|
||||
$deniedTable = if ($denied) {
|
||||
$denied | ForEach-Object { "| $($_.timestamp) | $($_.action) | $($_.risk_level) | $($_.approval_status) |" }
|
||||
} else { "| — | — | — | — |" }
|
||||
|
||||
$report = @"
|
||||
# Compliance Report — $FeatureId
|
||||
|
||||
**Generated:** $timestamp
|
||||
**Pipeline:** $FeatureId
|
||||
**Audit chain status:** $chainStatus
|
||||
|
||||
---
|
||||
|
||||
## Action Summary
|
||||
|
||||
| Metric | Count |
|
||||
|--------|------:|
|
||||
| Total governance actions | $totalActions |
|
||||
| High-risk actions | $($highRisk.Count) |
|
||||
| Denied actions | $($denied.Count) |
|
||||
| Human-approved (identity verified) | $($humanApproved.Count) |
|
||||
| Security blocks (H4) | $($secBlocked.Count) |
|
||||
| PII-masked inputs | $($piiMasked.Count) |
|
||||
| Tool registry calls | $toolCalls |
|
||||
| Tool registry denials | $($toolDenied.Count) |
|
||||
|
||||
---
|
||||
|
||||
## High-Risk Actions
|
||||
|
||||
| Timestamp | Action | Decision | Approver | Approval Status |
|
||||
|-----------|--------|----------|----------|-----------------|
|
||||
$($highRiskTable -join "`n")
|
||||
|
||||
---
|
||||
|
||||
## Denied Actions
|
||||
|
||||
| Timestamp | Action | Risk Level | Approval Status |
|
||||
|-----------|--------|:----------:|-----------------|
|
||||
$($deniedTable -join "`n")
|
||||
|
||||
---
|
||||
|
||||
## Security Events (H4)
|
||||
|
||||
- Prompt injections blocked: **$($secRecords | Where-Object { $_.status -eq "blocked" -and $_.mode -eq "input" } | Measure-Object | Select-Object -ExpandProperty Count)**
|
||||
- Output redactions: **$($secRecords | Where-Object { $_.action -eq "redact" } | Measure-Object | Select-Object -ExpandProperty Count)**
|
||||
- Hallucination risk flags: **$($secRecords | Where-Object { $_.action -eq "flag" } | Measure-Object | Select-Object -ExpandProperty Count)**
|
||||
|
||||
---
|
||||
|
||||
## Audit Chain Status
|
||||
|
||||
- Records checked: **$totalActions**
|
||||
- Chain integrity: **$chainStatus**
|
||||
- Storage: hash-chain JSONL at `.specify/logs/audit/audit.jsonl`
|
||||
|
||||
---
|
||||
|
||||
## Tool Registry Compliance (H2)
|
||||
|
||||
- Total tool calls logged: **$toolCalls**
|
||||
- Denied (missing idempotency key): **$($toolDenied.Count)**
|
||||
- Side-effecting actions: **$($toolRecords | Where-Object { $_.decision -eq "approved" } | Measure-Object | Select-Object -ExpandProperty Count)**
|
||||
|
||||
---
|
||||
|
||||
*Report auto-generated by CASAN H5 Governance Harness*
|
||||
"@
|
||||
|
||||
Set-Content -Path $OutputPath -Value $report -Encoding UTF8
|
||||
Write-Output "COMPLIANCE_REPORT_GENERATED: $OutputPath"
|
||||
Reference in New Issue
Block a user