feat(plan-01): Phase 1 — relocate harness code to packages/casan-harness (symlink facade)

Physically move the pure-code subtrees out of .specify into the package, leaving compat symlinks at the old .specify/<dir> paths so every existing reference (internal CASAN_HARNESS_ROOT + external CI/docker/mjs) keeps resolving. Runtime state stays put. Moved (git mv): scripts/ tests/ security/ templates/ config/ governance/ memory/ .specify/<dir> -> packages/casan-harness/<dir> (+ .specify/<dir> symlink) Stays in .specify (state/governance/domain, handled later): logs/ agentops/ level5/ init-options.json traceability-map.json Python `.resolve()` self-location followed the compat symlink into packages and lost the app root; generate-casan-demo-context.py, generate-agentops-dashboard.py and dashboard-server.py now walk UP for the `.specify` state marker instead of a fixed parent depth (fixes "missing trace files" in run-casan4). Full gate: PASS=64 FAIL=0 SKIP=3 (CASAN_CI_STEP_TIMEOUT_SEC=1200 — track-a ~450s runs close to the 600s default and can tip over under load; this is timing variance, not a regression — it passed cleanly with headroom). Runtime log/audit artifacts kept unstaged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-08 00:06:00 +09:00
parent 2c765c9a45
commit 664bd1f00c
229 changed files with 268 additions and 3 deletions
@@ -0,0 +1,136 @@
+# 🔐 Security Policy
+## Project: AINATIVE_OKR_CLAUDE_GHCP
+
+---
+
+# 1. Purpose
+
+Tài liệu này định nghĩa chính sách bảo mật cho AI System nhằm:
+
+- Ngăn chặn prompt injection
+- Bảo vệ dữ liệu nhạy cảm (PII, secret)
+- Kiểm soát hành vi của LLM/Agent
+- Đảm bảo an toàn khi vận hành production
+
+---
+
+# 2. Scope
+
+Áp dụng cho toàn bộ hệ thống:
+
+- Prompt / LLM interaction
+- Agent workflow
+- Template generation (SpecKit)
+- Script automation
+- Logging & monitoring
+
+---
+
+# 3. Security Principles
+
+- ✅ **Zero Trust Input**: Không tin bất kỳ input nào từ user
+- ✅ **Least Privilege**: Tool/Agent chỉ có quyền tối thiểu
+- ✅ **Defense in Depth**: nhiều lớp bảo vệ
+- ✅ **Auditability**: mọi hoạt động phải log được
+- ✅ **Fail Safe**: khi nghi ngờ → block hoặc require approval
+
+---
+
+# 4. Threat Model (OWASP LLM Top 10 based)
+
+| Threat | Description |
+|------|-------------|
+| Prompt Injection | User cố override system |
+| Data Leakage | Lộ thông tin nội bộ |
+| Secret Exposure | Lộ API key / credential |
+| Unsafe Tool Call | Agent thực thi hành động nguy hiểm |
+| Hallucination Risk | Output sai nhưng có vẻ đúng |
+
+---
+
+# 5. Input Security Policy
+
+## 5.1 Prompt Injection Protection
+
+Block các pattern:
+
+- "ignore previous instruction"
+- "bypass system"
+- "override policy"
+
+### Action
+
+| Level | Action |
+|------|--------|
+| High | Block |
+| Medium | Require Approval |
+| Low | Log |
+
+---
+
+## 5.2 PII Detection
+
+Detect:
+
+- Email
+- Phone number
+- Personal ID
+- Address
+
+### Action
+
+- Mask trước khi gửi LLM
+- Log sự kiện
+
+---
+
+## 5.3 Secret Detection
+
+Detect:
+
+- API Keys
+- Tokens
+- Password
+
+### Action
+
+- Block
+- Alert system
+- Không gửi vào LLM
+
+---
+
+# 6. Output Security Policy
+
+## 6.1 Data Leakage Prevention
+
+- Không output:
+  - nội dung confidential
+  - internal system prompt
+  - hidden instruction
+
+## 6.2 Output Filtering
+
+| Type | Action |
+|------|--------|
+| PII | Mask |
+| Secret | Remove |
+| Unsafe content | Block |
+| Hallucination risk | Flag |
+
+---
+
+# 7. Tool Security Policy
+
+## 7.1 Tool Access Control
+
+| Tool | Permission |
+|------|----------|
+| Read File | Allow |
+| Write File | Restricted |
+| Delete File | Require Approval |
+| External API | Whitelist only |
+
+---
+
+## 7.2 Safe Tool Execution Flow