feat: update plan 17

casan-next-plans/CASAN_BACKLOG_STATUS.md

@@ -59,6 +59,7 @@
 | **14 RBAC** | � core done+test | RBAC decision engine trong harness: `.specify/scripts/bash/rbac-check.py` (role×resource:action, scope org/project, deny-by-default, tenant isolation, sensitive→org-admin, SoD), `phase-rbac-tests.sh` 10/0 (WSL), nối CI. **Đã thêm:** tenant data-boundary (SEC-23 23.13, org-admin A không đụng B) + **audit quyết định vào H5** (`CASAN_RBAC_AUDIT_LOG`, `phase-rbac-audit` 5/0). Còn: enforcement trong web app (13), ánh xạ IdP claim→role thật (07-C4). |
 | **15 Responsible AI & Data Gov** | 🟡 core done+test+enforced | `rai-guard.py` (classify; PII→cloud deny; model-card; **retention** gate/purge-audit; **report** aggregate) + **enforcement** `harness-preflight.sh` chặn PII→cloud trước model-call, `model-router` opt-in `CASAN_PREFLIGHT`. `phase-rai` 12/0 + `phase-preflight` 5/0 (WSL), nối CI. Còn: view trên Control Plane. |
 | Future B1–B6 | 💤 vision | `CASAN_PLAN_FUTURE_PHASES.md` — approval workflow nâng cao · state machine · model benchmark · governed memory · auto-remediation · platform KPI. |
+| **17 Loop Engineering** | � T1–T6 done+test (offline) | **Agentic Loop Governance** — đủ 5 primitive + orchestrator (97/0 WSL, nối CI). T1 **Governor** (`loop-governor.py`; deny-by-default, no/corrupt policy→strict/HALT, on_exceed halt/escalate) 15/0; T2 **Convergence** (`loop-convergence.py`; repeat/thrash→OSCILLATING, flat→STALLED, fail-closed) 15/0; T3 **Verify Contract** (`loop-gate.py`; H4→DENY, unmet→FAIL, correction bounded→ESCALATE, no self-declared DONE) 20/0; T4 **Trace/Replay** (`loop-trace.py`; append-only hash-linked, edited→BREAK, tampered artifact→replay DRIFT) 16/0; T5 **Meta-loop** (`loop-metaloop.py`; propose≠apply, SoD, loosen>org_ceiling refused, apply qua governed CP store→đổi thật ceiling + rollback) 15/0; T6 **Orchestrator** (`loop-run.sh`; gate→governor→convergence→trace/turn, secure-by-default opt-out, nén giữa vòng) 16/0. State qua `CASAN_LOOP_STATE_ROOT` (repo `.specify/state` sạch). **Còn (infra):** T4 KMS-anchor head (A7 Vault), T6 widget Command Center (17.22, C5), live H3-judge. Chi tiết: `CASAN_PLAN_17_LOOP_ENGINEERING.md`. |
 | **16 Security audit remediation** | � P0/P1/P2 phần lớn done+test | **Remediation đã thực thi:** 28 SEC suite (151/0 WSL, nối `ci-harness-gate.sh`). Done: SEC-01..10, 12, 13, **14** (model-digest bỏ env-override ở prod/strict), 15, 16..21, **22** (trusted-time JWT `exp` ARCH-06 + tag proposal nguồn-không-tin ARCH-08), **26** (stored/second-order injection scan), 27..30, **23 Phase 1–5 offline** (multi-tenant: tenant-store+guard · per-tenant CP/audit/telemetry · RBAC data-boundary · tenant kill-switch/quota · ký registry · crypt at-rest per-tenant), **24 offline** (image digest-pin + ký workflow), **25 offline** (artifact attestation tested==deployed); **SEC-11 gộp vào SEC-17** (`CASAN_PROFILE=prod` enforce-by-default). **Còn 📋 planned (hạ tầng/process):** SEC-22 ARCH-10 (attestation ngoài) · SEC-23 23.11 (crypt qua Vault Transit) · **SEC-24 còn** (live CVE/OSV + scan image thật — offline image-pin/ký-workflow đã done) · **SEC-25 còn** (signed-commit enrollment + SLSA chain — offline artifact-attestation đã done). Chi tiết: `CASAN_PLAN_16` §0a/§2d. |
 | **18 Chat Console** | 📋 target arch xong · MVP-0 làm ngay | **Governed Chat Console** (cắt lát MVP chống lan man). **MVP-0 = Ask CASAN read-only** (Prompt Router `READ_ONLY/BLOCK`, context whitelist, H4 in/out, H5 audit, H6 token, trả lời kèm nguồn) — **không phụ thuộc Plan-17/14/SEC-23**, làm được ngay trên H4/H5/H6. Sau: MVP-1 operator (action-gate) → MVP-2 chat-as-loop + agent/skill (**cần Plan-17+14**) → MVP-3 multi-tenant (**cần SEC-23**). Bắt đầu: Track 0/1/2 (router+read-only+audit, WSL). Chi tiết: `CASAN_PLAN_18_CHAT_CONSOLE.md` §1b. |
 ---

casan-next-plans/CASAN_HARDENING_STATUS.md

@@ -129,7 +129,8 @@
 | `phase-preflight-tests.sh` | 5 | **New** — Plan-15/13 enforcement wiring: harness preflight blocks PII→cloud without approval BEFORE the model call; `model-router` honors `CASAN_PREFLIGHT` (opt-in, short-circuits) |
 | `phase-prod-infra-lab-tests.sh` | 2 | **New optional/local-prod** — Docker Compose infra lab starts + verifies Vault/IdP/MinIO/dashboard/alert/billing |
 | `phase-sec{01..30}` + `phase-sec23-tenant-store/-state-isolation/-rbac-tenant/-scope/-registry-crypt` + `phase-sec24` + `phase-sec25` (33 suites) | 181 | **New — Plan-16 security-audit remediation P0/P1/P2** (each control has a fail-able adversarial test; wired into `ci-harness-gate.sh`): SEC-01..21 P0/P1/arch controls; trusted-time for JWT exp + untrusted-telemetry tag (SEC-22, ARCH-06/08); **multi-tenant partition (SEC-23 Phase 1–5 offline, MT-01/02/03/04)**; **supply-chain image-pin + signed workflow (SEC-24 offline)**; **build-artifact attestation tested==deployed (SEC-25 offline)**; stored/second-order injection scan (SEC-26); log control-char strip, path-traversal, audit fail-closed, approval-replay nonce (SEC-27..30) |
-| **Total** | **466 core + 2 local-prod infra lab** | Baseline 79 preserved; +206 governance checks (traceability/compression/control-plane/RBAC/RBAC-audit/RAI/self-improve/governance-report/preflight) + **+181 Plan-16 SEC-remediation checks across 33 suites** (all fail-able; SEC-11⊂SEC-17; SEC-22 done ARCH-06/08 — ARCH-10 external; **SEC-23 Phase 1–5 offline done — only 23.11 Vault-KMS planned**; **SEC-24/25 offline slice done — live-CVE/image-scan + signed-commit/SLSA need infra**). Full-suite green verified on CI/Mac with Ollama+Docker; the deterministic new suites verify **in WSL** (msys+Python Windows path skew). Preflight wiring is opt-in (`CASAN_PREFLIGHT` default off). Direct `phase3-model-router-tests.sh` adds 11/0 (3 cases need live Ollama); `infra-lab verify` adds 7 internal infra checks. |
+| `phase-loop-governor` + `phase-loop-convergence` + `phase-loop-gate` + `phase-loop-trace` + `phase-loop-metaloop` + `phase-loop-run` (6 suites) | 97 | **New — Plan-17 Agentic Loop Governance T1–T6** (deny-by-default, fail-closed; wired into `ci-harness-gate.sh`; state redirected via `CASAN_LOOP_STATE_ROOT`, repo `.specify/state` stays clean): **Loop Budget Governor** (loop-breaker: no/corrupt policy → strict ceiling/HALT, on_exceed halt/escalate) 15; **Convergence detector** (repeat/thrash → OSCILLATING, flat progress → STALLED, fail-closed) 15; **Per-iteration Verify Contract** (H4 block → DENY, unmet → FAIL, bounded correction → ESCALATE, no self-declared DONE) 20; **Loop Trace/Replay** (append-only hash-linked; edited record → chain BREAK; tampered artifact → replay DRIFT; KMS-anchor is TIER-2/A7) 16; **Meta-loop** (propose≠apply; SoD proposer≠approver; loosen>org-ceiling refused; applied via governed CP store → actually changes governor; rollback reverts) 15; **Orchestrator** `loop-run.sh` (gate→governor→convergence→trace per turn; DONE/HALT/ESCALATE; secure-by-default prod opt-out refused; between-turn compaction) 16 |
+| **Total** | **563 core + 2 local-prod infra lab** | Baseline 79 preserved; +206 governance checks (traceability/compression/control-plane/RBAC/RBAC-audit/RAI/self-improve/governance-report/preflight) + **+181 Plan-16 SEC-remediation checks across 33 suites** (all fail-able; SEC-11⊂SEC-17; SEC-22 done ARCH-06/08 — ARCH-10 external; **SEC-23 Phase 1–5 offline done — only 23.11 Vault-KMS planned**; **SEC-24/25 offline slice done — live-CVE/image-scan + signed-commit/SLSA need infra**) + **+97 Plan-17 loop-engineering checks across 6 suites** (Governor/Convergence/Verify-contract/Trace-Replay/Meta-loop/Orchestrator — all 5 loop primitives + orchestrator, fail-closed; remaining infra-gated: T4 KMS-anchor head [A7], T6 Command Center widget 17.22 [C5], live H3-judge). Full-suite green verified on CI/Mac with Ollama+Docker; the deterministic new suites verify **in WSL** (msys+Python Windows path skew). Preflight wiring is opt-in (`CASAN_PREFLIGHT` default off). Direct `phase3-model-router-tests.sh` adds 11/0 (3 cases need live Ollama); `infra-lab verify` adds 7 internal infra checks. |
 
 Run order note: `run-casan4-harness-tests.sh` does `rm -rf .specify/logs`, so run it
 **first** and never concurrently with the other suites.

casan-next-plans/CASAN_PLAN_17_LOOP_ENGINEERING.md

@@ -1,7 +1,19 @@
 # KẾ HOẠCH 17 — Loop Engineering / Agentic Loop Governance
 
-> Status 2026-07-06: **📋 planned — CHƯA implement.** Đây là plan thiết kế; không có
-> code trong đợt này. Mục tiêu: nâng CASAN từ "governance rời rạc" thành **Agentic
+> Status 2026-07-07: **🟢 T1–T6 implemented+tested (offline), 97/0 in WSL, wired into
+> CI — all 5 loop primitives + orchestrator.** Governor (T1), Convergence (T2),
+> Verify Contract (T3), Trace/Replay (T4 offline slice), Meta-loop (T5),
+> Orchestrator `loop-run.sh` (T6, 17.20–17.21) are done as deny-by-default,
+> fail-closed harness primitives (`loop-governor.py`, `loop-convergence.py`,
+> `loop-gate.py`, `loop-trace.py`, `loop-metaloop.py`, `loop-run.sh` +
+> `.specify/config/loop-policy.yaml`/`loop-policy.schema.json` + `loop_common.py`).
+> Suites: governor 15/0 · convergence 15/0 · gate 20/0 · trace 16/0 · metaloop 15/0 ·
+> loop-run 16/0. Meta-loop changes route through the governed CP store
+> (versioned + audit + rollback + SoD) and **actually change the governor's ceiling**;
+> a loosen above `org_ceiling` is refused (17.19). **Remaining (infra-gated): T4
+> chain KMS-anchor (A7 Vault), T6 Command Center widget 17.22 (C5), live H3-judge.**
+>
+> Mục tiêu: nâng CASAN từ "governance rời rạc" thành **Agentic
 > Loop Governance** — kỹ thuật hoá **vòng lặp agent** (không chỉ prompt).
 >
 > Nhãn trạng thái: xem legend ở `CASAN_BACKLOG_STATUS.md`.
@@ -191,7 +203,13 @@ Chạy trong **WSL Ubuntu** (deterministic, không cần model/docker/mạng). N
 ---
 
 ## 7. Ghi chú trung thực
-- Đây là **[mới] — 📋 chưa implement**. Plan mô tả thiết kế; chưa có script nào được viết trong đợt này.
+- **T1–T6 đã implement+tested (offline, 97/0 WSL, nối CI)** — đủ 5 loop primitive +
+  orchestrator. T4 mới là **offline slice** (hash-chain local; KMS-anchor head 17.16
+  còn chờ A7). T5 meta-loop apply đi qua **governed CP store thật** (versioned +
+  audit + rollback + SoD) và **đổi được ceiling của governor**; loosen vượt org_ceiling
+  bị chặn (17.19). Còn lại (infra-gated): T4 KMS-anchor, T6 widget Command Center
+  (17.22, dep C5), live H3-judge. Không over-claim: primitive "thật" nhờ Plan-16 đã
+  vá (approval JWT SEC-07 ✅, fail-closed SEC-04/09 ✅, tamper-evidence SEC-01/02 ✅).
 - **Không phải làm lại từ đầu:** nền tảng (H3/H4/H5/H6/H7 + `self-improve.py` + `context-compress.py` + audit chain) đã có và test xanh. Plan-17 = **đặt tên "loop engineering" + bổ sung 5 primitive** bọc lên nền đó.
 - **Phụ thuộc cứng vào Plan-16:** các primitive chỉ "thật" khi approval JWT thật (SEC-07), fail-closed (SEC-04/09), tamper-evidence (SEC-01/02), secure-by-default (SEC-17/ARCH-03) đã vá. Nếu Plan-16 chưa xong, Track 1/3/5 vẫn viết được nhưng **enforcement còn hở** — phải ghi rõ khi báo cáo, không over-claim.
 - **Rẻ + verify offline trước:** khuyến nghị bắt đầu bằng **17.1–17.2 (Governor)** và **17.5–17.6 (Convergence)** — thuần Python/bash, deterministic, verify WSL ngay, không cần model/infra.

casan-next-plans/CASAN_TEAM_ALLOCATION_3DEV.md

@@ -59,12 +59,12 @@ approval JWT thật ([16 SEC-07](CASAN_PLAN_16_SECURITY_AUDIT_REMEDIATION.md)),
 ### 3.1 Loop Engineering ([Plan-17](CASAN_PLAN_17_LOOP_ENGINEERING.md))
 | ID | Task nhỏ | Plan | Effort | Cờ | Dep |
 |---|---|---|:--:|:--:|---|
-| B1 | **Loop Budget Governor** `loop-governor.py` + `loop-policy.yaml` (deny-by-default, fail-closed) | [17 T1 (17.1–17.4)](CASAN_PLAN_17_LOOP_ENGINEERING.md) | M | 🟦 | — |
-| B2 | **Convergence detector** `loop-convergence.py` (oscillation/no-progress/thrash) | [17 T2 (17.5–17.8)](CASAN_PLAN_17_LOOP_ENGINEERING.md) | M | 🟦 | — |
-| B3 | **Per-iteration Verify Contract** `loop-gate.py` (bọc H3+H4, correction bounded) | [17 T3 (17.9–17.12)](CASAN_PLAN_17_LOOP_ENGINEERING.md) | M | 🟦 | — |
-| B4 | **Loop Trace/Replay** `loop-trace.py` (append-only hash-linked, replay, verify-chain) | [17 T4 (17.13–17.16)](CASAN_PLAN_17_LOOP_ENGINEERING.md) | M | 🔗 | A7 |
-| B5 | **Meta-loop** mở `self-improve.py` sang loop-policy (propose≠apply, approval+SoD) | [17 T5 (17.17–17.19)](CASAN_PLAN_17_LOOP_ENGINEERING.md) · [04](CASAN_PLAN_04_SELFIMPROVE.md) | M | 🔗 | B1, A(SEC-07) |
-| B6 | **Orchestrator** `loop-run.sh` (gate→governor→convergence→trace) + nén giữa vòng | [17 T6 (17.20–17.21)](CASAN_PLAN_17_LOOP_ENGINEERING.md) | M | 🔗 | B1,B2,B3,B7 |
+| B1 | ✅ **done** — **Loop Budget Governor** `loop-governor.py` + `loop-policy.yaml`/`.schema.json` + `loop_common.py` (deny-by-default, fail-closed; no/corrupt policy → strict ceiling/HALT; on_exceed halt/escalate; HALT audited hash-linked). `phase-loop-governor` 15/0, nối CI | [17 T1 (17.1–17.4)](CASAN_PLAN_17_LOOP_ENGINEERING.md) | M | 🟦 | — |
+| B2 | ✅ **done** — **Convergence detector** `loop-convergence.py` (repeat/thrash → OSCILLATING; flat-progress window → STALLED; on_stall halt/escalate; corrupt stream fail-closed; verdict audited). `phase-loop-convergence` 15/0, nối CI | [17 T2 (17.5–17.8)](CASAN_PLAN_17_LOOP_ENGINEERING.md) | M | 🟦 | — |
+| B3 | ✅ **done** — **Per-iteration Verify Contract** `loop-gate.py` (bọc H4 security-check + H3 success-criteria; injection → DENY; unmet → FAIL; correction bounded by `max_corrections_per_step` → ESCALATE; no self-declared DONE; artifact/gate error fail-closed). `phase-loop-gate` 20/0, nối CI | [17 T3 (17.9–17.12)](CASAN_PLAN_17_LOOP_ENGINEERING.md) | M | 🟦 | — |
+| B4 | 🟡 **offline done** — **Loop Trace/Replay** `loop-trace.py` (append-only hash-linked per-run trace · `record`/`show`/`replay`/`verify-chain`; edited record → chain BREAK · tampered artifact → replay DRIFT · corrupt trace fail-closed). `phase-loop-trace` 16/0, nối CI. **Còn 17.16 KMS-anchor head** (🔌 Vault, dep A7) | [17 T4 (17.13–17.16)](CASAN_PLAN_17_LOOP_ENGINEERING.md) | M | 🟦 offline (KMS 🔌) | A7 (chỉ KMS-anchor) |
+| B5 | ✅ **done (offline)** — **Meta-loop** `loop-metaloop.py` (propose≠apply dry-run; **SoD** proposer≠approver; loosen>`org_ceiling` refused 17.19; apply qua governed CP store → versioned+audit+rollback + **đổi thật ceiling governor**). `phase-loop-metaloop` 15/0, nối CI | [17 T5 (17.17–17.19)](CASAN_PLAN_17_LOOP_ENGINEERING.md) · [04](CASAN_PLAN_04_SELFIMPROVE.md) | M | 🟦 (SEC-07 ✅) | B1, A(SEC-07) ✅ |
+| B6 | 🟡 **offline done** — **Orchestrator** `loop-run.sh` (mỗi turn: gate→governor→convergence→trace; DONE/HALT/ESCALATE; secure-by-default prod opt-out bị từ chối nếu thiếu lý do; nén giữa vòng qua `context-compress.py` 17.21). `phase-loop-run` 16/0, nối CI. **Còn widget Command Center (17.22 = B12, dep C5)** | [17 T6 (17.20–17.21)](CASAN_PLAN_17_LOOP_ENGINEERING.md) | M | 🟦 | B1,B2,B3,B7 (B7 opt) |
 
 ### 3.2 Context compression ([Plan-08](CASAN_PLAN_08_CONTEXT_COMPRESSION.md))
 | ID | Task nhỏ | Plan | Effort | Cờ | Dep |