gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(plans): sync roadmap status + paths to post-restructure state

Browse Source 
- Plan-01 marked ✅ DONE (INDEX table + P3 tier + BACKLOG row + plan header).
- Plan-06 / Plan-12 dependency on 01 satisfied → 🔓 unblocked (headers + BACKLOG rows).
- Repoint command/path refs in all plans (except Plan-01's migration narrative):
  .specify/{scripts,tests,security,config,templates,governance} -> packages/casan-harness/...;
  golden-runs/traceability-map/docs-input -> apps/okr/domain/...; `cd AINative_OKR_CASAN5`
  -> `cd $(git rev-parse --show-toplevel)`; fix relative links + Plan-13 control-plane location.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
2026-07-08 14:57:01 +09:00
co-authored by Claude Opus 4.8
parent 09ac4c674d
commit 4918012199
19 changed files with 70 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plans/CASAN_HARDENING_STATUS.md
+3 -3
View File
@@ -65,8 +65,8 @@
| B1 | **Multilingual VI/JA injection (V2)**: VI/JA block-patterns (matched on raw UTF-8, anchored on the injection object) catch injections English regex missed, with 0 false positives on the benign VI/JA corpus | [implemented+tested] | `prompt-filter.yaml` (PI-VI-*, PI-JA-*) | phase-h4-multilingual (7) |
| C6 | **TRUE runtime isolation (V22)**: container sandbox (`--network=none --read-only --pids-limit --cap-drop=ALL`, workspace-only mount) — the kernel neutralises host-file reads / egress / out-of-workspace writes; upgrades the static scaffold | [implemented+tested] (live via Docker; skip-aware) | `sandbox-container.sh`, `sandbox-run.sh` (`CASAN_SANDBOX_MODE=container`) | phase-c6-sandbox (6) |
| B2 | **Split + classifier injection (V5,V6)**: `context-assemble-scan.sh` scans the concatenated context so a payload split across benign pieces is caught on assembly; verdict-steering patterns (PI-CLS-*) block content that tries to hijack the evaluator | [implemented+tested] | `context-assemble-scan.sh`, `prompt-filter.yaml` (PI-CLS-*) | phase-h4-split-inject (8) |
| B4 | **Model-digest pinning (V16)**: approved Ollama model digest pinned; router verifies live digest before generation/classify/judge; mismatch blocks by default with warn mode for rollout | [implemented+tested] | `model-digest-check.sh`, `model-call.py`, `.specify/security/model-digest.pin` | phase3-model-router (digest cases) |
| Plan-10 | **Traceability REQ→code→test**: parse `FR-*`, require code+test mapping per FR, generate matrix, include it in Evidence Pack, **plus symbol/line-level refs** (object form `{file,symbols,lines}`; missing symbol/line ⇒ gate FAIL) | [implemented+tested] | `traceability-matrix.py`, `.specify/traceability-map.json`, `docs/output/casan/traceability-matrix.json` | phase10-traceability (6) |
| B4 | **Model-digest pinning (V16)**: approved Ollama model digest pinned; router verifies live digest before generation/classify/judge; mismatch blocks by default with warn mode for rollout | [implemented+tested] | `model-digest-check.sh`, `model-call.py`, `packages/casan-harness/security/model-digest.pin` | phase3-model-router (digest cases) |
| Plan-10 | **Traceability REQ→code→test**: parse `FR-*`, require code+test mapping per FR, generate matrix, include it in Evidence Pack, **plus symbol/line-level refs** (object form `{file,symbols,lines}`; missing symbol/line ⇒ gate FAIL) | [implemented+tested] | `traceability-matrix.py`, `apps/okr/domain/traceability-map.json`, `docs/output/casan/traceability-matrix.json` | phase10-traceability (6) |
### Phase 7 — Local production-like infra lab (Tier-2 emulation) — [implemented+tested]
@@ -77,7 +77,7 @@
### Phase 8 — Plan-16 security-audit remediation (P0/P1/P2) — mixed
> Adversarial audit of the harness scripts (`CASAN_PLAN_16`) turned into fixes.
> Each control listed has an executable fail-able test in `.specify/tests/phase-sec*`
> Each control listed has an executable fail-able test in `packages/casan-harness/tests/phase-sec*`
> wired into `ci-harness-gate.sh`. **24 SEC suites = 118 checks, 0 fail (WSL).**
| ID | Control | Status | Where | Test |