feat(plan-01): Phase 1 — relocate harness code to packages/casan-harness (symlink facade)

Physically move the pure-code subtrees out of .specify into the package, leaving compat symlinks at the old .specify/<dir> paths so every existing reference (internal CASAN_HARNESS_ROOT + external CI/docker/mjs) keeps resolving. Runtime state stays put. Moved (git mv): scripts/ tests/ security/ templates/ config/ governance/ memory/ .specify/<dir> -> packages/casan-harness/<dir> (+ .specify/<dir> symlink) Stays in .specify (state/governance/domain, handled later): logs/ agentops/ level5/ init-options.json traceability-map.json Python `.resolve()` self-location followed the compat symlink into packages and lost the app root; generate-casan-demo-context.py, generate-agentops-dashboard.py and dashboard-server.py now walk UP for the `.specify` state marker instead of a fixed parent depth (fixes "missing trace files" in run-casan4). Full gate: PASS=64 FAIL=0 SKIP=3 (CASAN_CI_STEP_TIMEOUT_SEC=1200 — track-a ~450s runs close to the 600s default and can tip over under load; this is timing variance, not a regression — it passed cleanly with headroom). Runtime log/audit artifacts kept unstaged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-08 00:06:00 +09:00
parent 2c765c9a45
commit 664bd1f00c
229 changed files with 268 additions and 3 deletions
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN Plan-16 SEC-09 (M-10) — input-size cap + fail-closed reads.
+#
+# security-check / drift-detect / context-compress ran superlinear passes (regex,
+# SequenceMatcher) with no size cap (DoS) and crashed on missing / non-UTF8 input
+# instead of returning a fail-closed verdict. This proves oversize input is blocked,
+# undecodable input degrades without a crash, and normal input is unaffected.
+# Cap overridable via CASAN_MAX_INPUT_BYTES.
+#
+# Deterministic; hermetic; no model/network.
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+BASH_DIR="$CASAN_HARNESS_ROOT/scripts/bash"
+WORK="$(mktemp -d)"
+# security-check / drift-detect touch shared logs; restore on exit.
+trap 'git -C "$PROJECT_ROOT" checkout -- .specify/logs/ .specify/level5/central-governance/ 2>/dev/null; rm -rf "$WORK"' EXIT
+
+PASS=0; FAIL=0
+pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
+fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
+rc_of() { set +e; "$@" >/dev/null 2>&1; echo $?; set -e 2>/dev/null || true; }
+
+echo "===== Plan-16 SEC-09: input caps + fail-closed reads ====="
+
+BIG="$WORK/big.txt"; head -c 200 /dev/zero | tr '\0' 'a' > "$BIG"
+SMALL="$WORK/small.txt"; echo "benign objective text" > "$SMALL"
+
+# --- security-check ---
+[[ "$(rc_of env CASAN_MAX_INPUT_BYTES=10 bash "$BASH_DIR/security-check.sh" "$BIG" "$WORK/o1.txt" input)" -ne 0 ]] \
+  && pass "security-check blocks oversize input" || fail "security-check allowed oversize input"
+[[ "$(rc_of bash "$BASH_DIR/security-check.sh" "$SMALL" "$WORK/o2.txt" input)" -eq 0 ]] \
+  && pass "security-check allows normal input (regression)" || fail "security-check rejected normal input"
+
+# --- drift-detect ---
+echo "golden reference" > "$WORK/golden.txt"
+[[ "$(rc_of bash "$BASH_DIR/drift-detect.sh" "$WORK/golden.txt" "$WORK/missing.txt" "$WORK/dr1.json")" -ne 0 ]] \
+  && pass "drift-detect blocks on missing candidate (fail-closed, no crash)" || fail "drift-detect did not block missing file"
+if [[ -f "$WORK/dr1.json" ]] && grep -q '"status": "fail"' "$WORK/dr1.json"; then
+  pass "drift-detect writes a fail verdict report (not a traceback)"
+else
+  fail "drift-detect did not emit a fail verdict report"
+fi
+[[ "$(rc_of env CASAN_MAX_INPUT_BYTES=10 bash "$BASH_DIR/drift-detect.sh" "$WORK/golden.txt" "$BIG" "$WORK/dr2.json")" -ne 0 ]] \
+  && pass "drift-detect blocks oversize candidate (DoS cap)" || fail "drift-detect allowed oversize"
+
+# --- context-compress ---
+[[ "$(set +e; head -c 200 /dev/zero | tr '\0' 'a' | env CASAN_MAX_INPUT_BYTES=10 python3 "$BASH_DIR/context-compress.py" >/dev/null 2>&1; echo $?)" -ne 0 ]] \
+  && pass "context-compress rejects oversize input (fail-closed)" || fail "context-compress allowed oversize input"
+
+RC="$(set +e; printf '\xff\xfe some error line\n' | python3 "$BASH_DIR/context-compress.py" --mode extractive >/dev/null 2>&1; echo $?)"
+[[ "$RC" -ne 2 ]] \
+  && pass "context-compress handles non-UTF8 without crashing (rc=$RC)" || fail "context-compress crashed on non-UTF8 (rc=$RC)"
+
+echo ""
+echo "===== SEC-09 SUMMARY: PASS=$PASS FAIL=$FAIL ====="
+[[ "$FAIL" -eq 0 ]] || exit 1