gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(plan-01): Phase 1 — relocate harness code to packages/casan-harness (symlink facade)

Browse Source 
Physically move the pure-code subtrees out of .specify into the package, leaving
compat symlinks at the old .specify/<dir> paths so every existing reference (internal
CASAN_HARNESS_ROOT + external CI/docker/mjs) keeps resolving. Runtime state stays put.

Moved (git mv): scripts/ tests/ security/ templates/ config/ governance/ memory/
  .specify/<dir>  ->  packages/casan-harness/<dir>   (+ .specify/<dir> symlink)
Stays in .specify (state/governance/domain, handled later): logs/ agentops/ level5/
  init-options.json traceability-map.json

Python `.resolve()` self-location followed the compat symlink into packages and lost
the app root; generate-casan-demo-context.py, generate-agentops-dashboard.py and
dashboard-server.py now walk UP for the `.specify` state marker instead of a fixed
parent depth (fixes "missing trace files" in run-casan4).

Full gate: PASS=64 FAIL=0 SKIP=3 (CASAN_CI_STEP_TIMEOUT_SEC=1200 — track-a ~450s runs
close to the 600s default and can tip over under load; this is timing variance, not a
regression — it passed cleanly with headroom). Runtime log/audit artifacts kept unstaged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
2026-07-08 00:06:00 +09:00
co-authored by Claude Opus 4.8
parent 2c765c9a45
commit 664bd1f00c
229 changed files with 268 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AINative_OKR_CASAN5/packages/casan-harness/scripts/bash/approval-sign.sh
Executable
+39
View File
@@ -0,0 +1,39 @@
#!/usr/bin/env bash
set -uo pipefail
# CASAN H5 — Reviewer-side approval signer (Approval-identity MVP · C4 / V20).
#
# A reviewer runs this to APPROVE a specific high-risk request by signing the
# canonical assertion with THEIR OWN private key. The resulting signature is
# handed to governance-check.sh via CASAN_APPROVAL_SIG (with CASAN_APPROVER=<id>
# and CASAN_APPROVAL_STRICT=1). The private key stays with the reviewer / in an
# IdP-issued credential — never in the pipeline env.
#
# Assertion (must match approval-verify.sh):
# casan-approval|v1|<action>|<actor>|<input_sha256>|<approver_id>
#
# Usage:
# approval-sign.sh <action> <actor> <input-file> <approver-id> <privkey> <out-sig>
# Exit: 0 signed, 64 usage, 1 sign error.
ACTION="${1:-}"; ACTOR="${2:-}"; INPUT_FILE="${3:-}"; APPROVER="${4:-}"; PRIV="${5:-}"; OUT="${6:-}"
if [[ -z "$ACTION" || -z "$ACTOR" || -z "$INPUT_FILE" || -z "$APPROVER" || -z "$PRIV" || -z "$OUT" ]]; then
echo "Usage: approval-sign.sh <action> <actor> <input-file> <approver-id> <privkey> <out-sig>" >&2
exit 64
fi
[[ -f "$INPUT_FILE" ]] || { echo "approval-sign: input file not found: $INPUT_FILE" >&2; exit 1; }
[[ -f "$PRIV" ]] || { echo "approval-sign: private key not found: $PRIV" >&2; exit 1; }
command -v openssl >/dev/null 2>&1 || { echo "approval-sign: openssl required" >&2; exit 1; }
hash_file() {
if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | awk '{print $1}'
else shasum -a 256 "$1" | awk '{print $1}'; fi
}
INPUT_SHA="$(hash_file "$INPUT_FILE")"
MSG="casan-approval|v1|$ACTION|$ACTOR|$INPUT_SHA|$APPROVER"
TMP="$(mktemp)"; trap 'rm -f "$TMP"' EXIT
printf '%s' "$MSG" > "$TMP"
openssl dgst -sha256 -sign "$PRIV" -out "$OUT" "$TMP" \
|| { echo "approval-sign: signing failed" >&2; exit 1; }
echo "APPROVAL_SIGNED approver=$APPROVER action=$ACTION sig=$OUT"