doc: update status

2026-07-06 10:36:27 +09:00
parent a832c40bdb
commit 571c2b7e80
2 changed files with 139 additions and 0 deletions
@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN — Model-digest pinning (Plan-07 B4 / V16, trust the model backend).
+#
+# An attacker who swaps or poisons the local model (e.g. re-tags a different
+# ornith:9b) changes CASAN's behaviour with no code change. This pins the
+# approved model's content digest and refuses (or warns) when the live digest
+# no longer matches — so a silent model swap is detected.
+#
+# Digest source: Ollama /api/tags (real) or CASAN_MODEL_DIGEST (override, for
+# CI/tests). If neither is available the check SKIPs (cannot verify).
+#
+# Usage:
+#   model-digest-check.sh pin    [model]   # record the current digest as approved
+#   model-digest-check.sh verify [model]   # compare live digest to the pinned one
+#   model-digest-check.sh show   [model]
+# Env: CASAN_MODEL (default ornith:9b) · CASAN_MODEL_DIGEST (override) ·
+#      CASAN_MODEL_DIGEST_PIN (pin file) · OLLAMA_HOST (default 127.0.0.1:11434)
+# Exit: 0 match/pinned · 2 MISMATCH (swap detected) · 3 unpinned/undeterminable.
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PIN_FILE="${CASAN_MODEL_DIGEST_PIN:-$PROJECT_ROOT/.specify/security/model-digest.pin}"
+mkdir -p "$(dirname "$PIN_FILE")"
+CMD="${1:-verify}"
+MODEL="${2:-${CASAN_MODEL:-ornith:9b}}"
+OLLAMA="${OLLAMA_HOST:-127.0.0.1:11434}"
+
+current_digest() {
+  # 1) explicit override (deterministic for CI/tests)
+  if [[ -n "${CASAN_MODEL_DIGEST:-}" ]]; then printf '%s' "$CASAN_MODEL_DIGEST"; return 0; fi
+  # 2) live Ollama
+  local d
+  d="$(curl -sf "http://$OLLAMA/api/tags" 2>/dev/null | \
+    python3 -c "import json,sys
+m=sys.argv[1]
+try: d=json.load(sys.stdin)
+except Exception: sys.exit(1)
+for x in d.get('models',[]):
+    if x.get('name')==m: print(x.get('digest','')); break" "$MODEL" 2>/dev/null)"
+  [[ -n "$d" ]] && { printf '%s' "$d"; return 0; }
+  return 1
+}
+
+pinned_digest() { awk -v m="$MODEL" '$1==m {print $2; exit}' "$PIN_FILE" 2>/dev/null; }
+
+case "$CMD" in
+  pin)
+    D="$(current_digest)" || { echo "MODEL_DIGEST_UNAVAILABLE model=$MODEL (Ollama down + no CASAN_MODEL_DIGEST)" >&2; exit 3; }
+    tmp="$(mktemp)"; grep -v "^$MODEL	" "$PIN_FILE" 2>/dev/null > "$tmp" || true
+    printf '%s\t%s\n' "$MODEL" "$D" >> "$tmp"; mv "$tmp" "$PIN_FILE"
+    echo "MODEL_DIGEST_PINNED model=$MODEL digest=${D:0:24}…"
+    ;;
+  verify)
+    P="$(pinned_digest)"
+    [[ -n "$P" ]] || { echo "MODEL_DIGEST_UNPINNED model=$MODEL (run: model-digest-check.sh pin)" >&2; exit 3; }
+    D="$(current_digest)" || { echo "MODEL_DIGEST_UNAVAILABLE model=$MODEL — cannot verify" >&2; exit 3; }
+    if [[ "$D" == "$P" ]]; then
+      echo "MODEL_DIGEST_OK model=$MODEL digest=${D:0:24}…"
+      exit 0
+    fi
+    echo "MODEL_DIGEST_MISMATCH model=$MODEL pinned=${P:0:24}… live=${D:0:24}… — model may have been swapped/poisoned" >&2
+    exit 2
+    ;;
+  show)
+    echo "model=$MODEL pinned=$(pinned_digest || echo none) live=$(current_digest || echo unavailable)"
+    ;;
+  *)
+    echo "Usage: model-digest-check.sh {pin|verify|show} [model]" >&2; exit 64 ;;
+esac