feat: prepare CASAN paid PoC release package

2026-07-18 00:07:04 +07:00
parent c818eaf8b0
commit 881ee01691
55 changed files with 5992 additions and 44 deletions
@@ -0,0 +1,44 @@
+# CASAN Commercial License and IP Decision
+
+## Decision
+
+CASAN is offered as **proprietary commercial software**. No rights to use,
+copy, modify, distribute, host, or sublicense CASAN are granted except under a
+written evaluation, PoC, subscription, or enterprise agreement signed by the
+copyright owner and the customer.
+
+For a paid PoC, the default grant is a non-exclusive, non-transferable,
+time-limited right to deploy the delivered CASAN bundle in the customer’s
+approved environment for the agreed evaluation scope. Production use, managed
+service operation, redistribution, and source access require separate terms.
+
+This decision applies to CASAN-authored material only. It does not override
+third-party license obligations.
+
+## Release controls
+
+1. Regenerate `THIRD_PARTY_SOFTWARE.json` from the committed lockfile before
+   each paid-PoC or release candidate: `node scripts/generate-license-inventory.mjs`.
+2. Review every `UNKNOWN`, copyleft, source-available, model, dataset, font,
+   icon, container-base-image, or copied-script license before shipment.
+3. Include required notices and source-offer material in the release bundle
+   whenever a dependency license requires it.
+4. Record the review owner, release version, decision, and exceptions in the
+   release Evidence Pack or legal review record.
+5. Do not claim ownership of customer source code, prompts, or Evidence Pack
+   data; ownership and permitted processing are defined by the customer
+   agreement and data-processing terms.
+
+## Known scope boundary
+
+The generated inventory is complete for root-lockfile npm packages only. It is
+not proof that Python tooling, operating-system packages, Docker base images,
+models, datasets, or bundled assets are cleared. Those sources are release
+blockers until separately inventoried and approved.
+
+## Required legal review before external sale
+
+Confirm copyright ownership/assignment for CASAN-authored code, trademark use,
+customer contract templates, export-control applicability, open-source notices,
+and country-specific privacy terms. This document records the product decision;
+it is not a substitute for counsel.
@@ -0,0 +1,16 @@
+{
+  "schema_version": "1.0",
+  "purpose": "Manual license-review findings for packages whose committed lockfile does not contain license metadata.",
+  "exceptions": {
+    "busboy@1.6.0": {
+      "reviewed_license": "MIT",
+      "evidence": "https://github.com/mscdex/busboy/blob/master/LICENSE",
+      "review_status": "requires-release-notice"
+    },
+    "streamsearch@1.1.0": {
+      "reviewed_license": "MIT",
+      "evidence": "https://github.com/mscdex/streamsearch/blob/master/LICENSE",
+      "review_status": "requires-release-notice"
+    }
+  }
+}
@@ -0,0 +1,32 @@
+# 製品概要
+
+## 提供価値
+
+CASAN は、既存の AI コーディングツールを置き換える製品ではありません。
+開発者、AI モデル、リポジトリ、CI の間に配置される独立した統制レイヤーです。
+AI が生成・提案した変更を、ポリシー、テスト、セキュリティ検査、承認、監査証跡で確認し、根拠を Evidence Pack として残します。
+
+## PoC の対象ユースケース
+
+「Claude Code、Codex、Copilot 等を利用する開発チームで、AI が関与した変更を
+merge 前に検査し、誰が何を行ったかを証明する。」
+
+PoC では、1〜2 プロジェクト、1 つの Git リポジトリ連携、1 つの Domain Pack を対象とします。
+
+## 提供範囲（CASAN Core + Control Center Lite）
+
+- H1〜H7 のハーネス実行、アクションゲート、セキュリティ検査
+- Gitea CI からの検査起動と PASS/BLOCK 判定
+- Evidence Pack の作成、ハッシュ manifest の検証、Control Panel での閲覧
+- 監査ログ、ツール呼出記録、コスト/トークンの可視化
+- 承認が必要な変更を apply 前に停止するワークフロー
+
+## PoC では提供しないもの
+
+- 高可用性、RPO/RTO を伴う本番運用
+- 本番用 SSO/OIDC、顧客 CA、マネージド運用
+- KMS 必須運用、S3 Object Lock、外部ペネトレーションテスト
+- GitHub/GitLab/Jenkins の本番コネクタ保証
+- 自律エージェントによる無承認の変更適用
+
+これらは Enterprise Pilot / Production の後続条件です。
@@ -0,0 +1,30 @@
+# システム構成・データフロー
+
+## 推奨配置
+
+PoC では顧客管理のネットワーク内、または顧客クラウドアカウント内への self-hosted 配置を推奨します。
+
+```text
+Developer / AI coding tool
+        │ patch / PR
+        ▼
+Gitea ──► CASAN Runner ──► test / security / policy gates
+               │
+               ├── Evidence Pack（manifest + reports）
+               └── Control Panel（run、承認、証跡表示）
+```
+
+## データフロー
+
+1. 開発者が既存の AI ツールで変更を作成し、PR を作成します。
+2. Gitea workflow が CASAN を呼び出します。
+3. CASAN は許可されたワークスペースでポリシー、テスト、セキュリティを実行します。
+4. 判定、実行記録、ハッシュを Evidence Pack に保存します。
+5. Control Panel は Evidence Pack の manifest を再検証して表示します。
+6. PASS でない変更は、顧客定義のマージ/承認ルールに従って停止します。
+
+## データの扱い
+
+ソースコード、ログ、Evidence Pack は顧客環境内に保存する構成を基本とします。
+クラウドモデルへ送信するデータは、顧客が選択したモデル設定とポリシーに依存します。
+PoC 開始時に、送信対象、保存場所、保持期間、マスキング方針を Data Flow Sheet に記録します。
@@ -0,0 +1,28 @@
+# 導入・運用・制限事項
+
+## 導入手順（PoC）
+
+1. 顧客と対象リポジトリ、担当者、承認ルールを確定します。
+2. CASAN bundle を顧客環境へ配置し、Docker Compose または提供手順で起動します。
+3. Gitea workflow に CASAN gate を接続します。
+4. Domain Pack と閾値を対象プロジェクトに合わせます。
+5. テスト PR を用いて PASS/BLOCK/Evidence Pack を確認します。
+6. 運用開始後、週次で KPI と誤検知をレビューします。
+
+## 日常運用
+
+- 開発者: PR の CASAN verdict と必要な修正を確認します。
+- QA/セキュリティ: ブロック理由、Evidence Pack、例外承認を確認します。
+- 管理者: ポリシー変更、ロール、バックアップ、障害連絡を管理します。
+
+## 既知の制限
+
+- Evidence Pack の署名は、PoC 環境では鍵未設定の場合に unsigned となります。
+- テレメトリ完全性未検証またはコストスパイクがある場合、pack は certified になりません。
+- 実際の隔離強度は配置する runner/container 設定に依存します。Production 用 hardened sandbox は PoC の範囲外です。
+- Enterprise SSO、HA、DR、外部監査は PoC 完了条件には含みません。
+
+## 障害時
+
+モデル、runner、検査、または証跡生成が失敗した場合、CASAN は PASS を生成せず、失敗理由を記録します。
+復旧判断とマージ例外の承認は顧客の責任者が行います。
@@ -0,0 +1,29 @@
+# PoC計画（8〜12週間）
+
+## 成功条件
+
+- 対象リポジトリで CASAN gate が PR ごとに実行されること
+- PASS/BLOCK の理由と Evidence Pack を担当者が確認できること
+- AI が関与した変更のテスト/セキュリティ/承認記録を追跡できること
+- 顧客と合意した KPI を最終報告書で提示できること
+
+## 進め方
+
+| 期間 | 内容 | 成果物 |
+|---|---|---|
+| 1〜2週 | キックオフ、対象選定、リスク確認 | PoC 設計、Data Flow Sheet |
+| 3〜4週 | 環境配置、Gitea 連携、Domain Pack | 導入記録、テスト PR |
+| 5〜8週 | 実運用、閾値調整、Evidence 確認 | 週次 KPI、課題一覧 |
+| 9〜12週 | 最終評価、次フェーズ判断 | PoC 結果報告、Pilot 提案 |
+
+## KPI（開始時に基準値を合意）
+
+- CASAN が実行された PR 比率
+- ブロックされたセキュリティ/ポリシー違反数
+- Evidence Pack が完全性検証に成功した比率
+- 誤検知レビュー件数と解決時間
+- AI 関連の変更に対する承認・追跡可能比率
+
+## 顧客に必要な協力
+
+対象リポジトリ、テスト環境、Gitea 管理者、セキュリティ/QA 窓口、承認ルール、及びクラウドモデル利用時のデータ送信判断を提供してください。
@@ -0,0 +1,26 @@
+# セキュリティ・責任分界
+
+## CASAN が提供する統制
+
+- AI 出力/ツール実行に対するポリシーとセキュリティ検査
+- 実行・判定・承認の監査記録
+- Evidence Pack の SHA-256 manifest 検証
+- 失敗時に PASS を出さない fail-closed 動作
+
+## 顧客の責任
+
+- ネットワーク、ホスト、ID、リポジトリ権限、バックアップの管理
+- モデル provider と送信データの選定
+- 個人情報、秘密情報、保持期間、例外承認の決定
+- PoC 環境のアクセス権とログ閲覧権の管理
+
+## 提供者の責任
+
+- 合意した CASAN bundle、導入支援、障害一次切り分けを提供すること
+- 既知の制限、重大な脆弱性、PoC スコープ外の事項を明示すること
+- 顧客データを合意外の目的に使用しないこと
+
+## 事前確認事項
+
+APPI を含む適用法令、個人情報の有無、海外移転、subprocessor、データ削除/export、インシデント通知窓口は契約・Data Flow Sheet で合意します。
+この資料は法的助言ではありません。
@@ -0,0 +1,19 @@
+# SLA / サポート条件ドラフト（PoC）
+
+## 適用範囲
+
+本ドラフトは PoC 期間の導入支援と障害対応の目安です。Production SLA ではありません。
+
+| 区分 | 例 | 初回応答目標 |
+|---|---|---|
+| P1 | CASAN が全 PR で実行不能、証跡が作成不能 | 営業時間内 4 時間 |
+| P2 | 一部 gate/表示機能の不具合、回避策あり | 営業時間内 1 営業日 |
+| P3 | 質問、設定調整、改善要望 | 3 営業日以内 |
+
+## 連絡とエスカレーション
+
+顧客の PoC 責任者と提供者の技術窓口をキックオフ時に指定します。P1 の場合、run ID、発生時刻、影響範囲、表示された理由を添えて連絡します。
+
+## 除外
+
+顧客ネットワーク、顧客提供モデル、Gitea 自体、外部クラウド障害、未承認の構成変更は本ドラフトの保証対象外です。
@@ -0,0 +1,16 @@
+# CASAN Japanese PoC Pack（最小版）
+
+このパックは、有償 PoC の開始前に顧客へ提示する最小限の説明資料です。
+実装済みの機能と未提供の機能を分け、未検証のエンタープライズ機能を約束しません。
+
+| 資料 | 用途 |
+|---|---|
+| [01_製品概要](01_製品概要.md) | 課題、提供価値、対象範囲 |
+| [02_システム構成・データフロー](02_システム構成・データフロー.md) | 配置、データ境界、証跡フロー |
+| [03_導入・運用・制限事項](03_導入・運用・制限事項.md) | 導入手順、運用、既知の制限 |
+| [04_PoC計画](04_PoC計画.md) | 8〜12 週間の評価計画と KPI |
+| [05_セキュリティ・責任分界](05_セキュリティ・責任分界.md) | セキュリティ仕様と顧客・提供者の責任 |
+| [06_SLAドラフト](06_SLAドラフト.md) | PoC 中の支援条件（ドラフト） |
+
+製品名（提案）: **CASAN AI-SDLC Governance Platform**
+（生成AIによるソフトウェア開発を、セキュリティ・品質・コスト・監査証跡の観点から統制するプラットフォーム）
@@ -0,0 +1,17 @@
+{
+  "files": {
+    "benign-fp-report.json": "52d3911e7b539f07391e187e3212f198f25e55d08396e2ab0e75d9db3178848b",
+    "decision-log.md": "6975cabd29baff1fbc1c9ceca8a44323832ecc28eafe6bdd30fbe94981563d70",
+    "h1-context-report.json": "64a1bbcdf38672eb1efcb8742e258850709297bd848a443fcf11b94b0f165d9d",
+    "h2-tool-audit.json": "095b369ae21d47ecfcbc38387f3255118bc32a4c28327f19b27e0bfcd7c945ae",
+    "h3-eval-scorecard.json": "b0e779fb219c4d9d38e55eefb15cd4370b4f0760e0a3bf70b5d22923407c8e47",
+    "h4-security-report.json": "2828cf13b2f4edba852c9da77e1397b3b44933a3bd6d04c81b4ac96e31026e9d",
+    "h5-audit-chain-proof.json": "f9918cc45311097be05ab852c36ed99170c65962f8c0f0e71b91d7468f9f2ba4",
+    "h6-cost-telemetry.json": "e01cc551016f3d4b7d525e11cf9556481cb1376408daca6e2314aba9a3ddd088",
+    "h7-orchestration-report.json": "9dd45a16004bd705c7307fae6c74975049a156a3dc1e14fc439ad816d5400066",
+    "redteam-result.json": "341f7985a8cceb2cb3cc7705e644a4407ab27f7203c148abb98788dcca5e5c8e",
+    "run-summary.json": "16cf96c55fa7b899e7b021b52a88cf3fa160366ab03e2361e431b0639196af29",
+    "traceability-matrix.json": "011ac8ac6ab008f1048e3bce1e3f7b5b28bc969de7a1574fed86af16e259de27"
+  },
+  "manifest_head": "c55972046b1fe12b6bc538fde0ab31ad62e0c9e4b20003e5f1370f104d849f47"
+}
@@ -0,0 +1,41 @@
+{
+  "generated": "deterministic (semantic OFF)",
+  "policy": {
+    "fp_max_pct": 3.0,
+    "adv_block_min_pct": 95.0,
+    "critical_block_pct": 100.0
+  },
+  "benign": {
+    "by_lang": {
+      "en": {
+        "total": 32,
+        "false_positives": 0
+      },
+      "vi": {
+        "total": 32,
+        "false_positives": 0
+      },
+      "ja": {
+        "total": 31,
+        "false_positives": 0
+      }
+    },
+    "total": 95,
+    "false_positives": 0,
+    "false_positive_rate_pct": 0.0,
+    "examples": []
+  },
+  "adversarial": {
+    "total": 12,
+    "blocked": 12,
+    "block_rate_pct": 100.0,
+    "missed": []
+  },
+  "critical": {
+    "total": 4,
+    "blocked": 4,
+    "block_rate_pct": 100.0
+  },
+  "within_budget": true,
+  "breaches": []
+}
@@ -0,0 +1,17 @@
+# CASAN Evidence Pack — Decision Log
+
+Run: `9534d91f-4518-41c5-a7c4-56e22a56c2a4`  
+Certified: **False**  
+Reasons: telemetry_integrity_not_verified, unresolved_cost_spike
+
+## Gate outcomes
+
+- H4 security: 186 records, 38 blocked
+- H5 audit chain: AUDIT_CHAIN_VALID anchor=signed last_hash=e715767a0d5ec67a8955c0e8e87262b5ca8c0f5826f1dee6583014ede8032bbe (ok=True)
+- H5 telemetry integrity: none (ok=False)
+- H6 cost: spike_detected, 56519 provider tokens
+- H2 tool audit: 24 records, chain_ok=True
+- H3 traceability: ok=True
+- Red-team: 16 vectors (block_rate=100.0%)
+
+_Summaries only — no raw secret/PII content is copied into the pack._
@@ -0,0 +1,6 @@
+{
+  "harness": "H1-context",
+  "run_id": "9534d91f-4518-41c5-a7c4-56e22a56c2a4",
+  "context_yaml": true,
+  "note": "path/artifact validation performed by context-validate.sh at run time"
+}
@@ -0,0 +1,9 @@
+{
+  "harness": "H2-tool",
+  "run_id": "9534d91f-4518-41c5-a7c4-56e22a56c2a4",
+  "records": 24,
+  "denied": 6,
+  "approved": 5,
+  "chain_status": "TOOL_AUDIT_VALID anchor=signed last_hash=dda5685f038e171c7fdd8bb36b00793c3de7b14be7295fdfe34fff5e6a03c443",
+  "chain_ok": true
+}
@@ -0,0 +1,6 @@
+{
+  "harness": "H3-eval",
+  "run_id": "9534d91f-4518-41c5-a7c4-56e22a56c2a4",
+  "judge_gate_tests": true,
+  "note": "judge-gate fail-before/fix cycle proven by phase3-judge-gate-tests.sh"
+}
@@ -0,0 +1,10 @@
+{
+  "harness": "H4-security",
+  "run_id": "9534d91f-4518-41c5-a7c4-56e22a56c2a4",
+  "records": 186,
+  "by_status": {
+    "blocked": 38,
+    "pass": 148
+  },
+  "blocked": 38
+}
@@ -0,0 +1,8 @@
+{
+  "harness": "H5-governance",
+  "run_id": "9534d91f-4518-41c5-a7c4-56e22a56c2a4",
+  "audit_chain": "AUDIT_CHAIN_VALID anchor=signed last_hash=e715767a0d5ec67a8955c0e8e87262b5ca8c0f5826f1dee6583014ede8032bbe",
+  "audit_chain_ok": true,
+  "telemetry_integrity": "none",
+  "telemetry_ok": false
+}
@@ -0,0 +1,9 @@
+{
+  "harness": "H6-agentops",
+  "run_id": "9534d91f-4518-41c5-a7c4-56e22a56c2a4",
+  "provider_records": 56,
+  "metric_records": 40,
+  "total_provider_tokens": 56519,
+  "cost_spike_rc": 2,
+  "cost_spike_status": "spike_detected"
+}
@@ -0,0 +1,6 @@
+{
+  "harness": "H7-orchestration",
+  "run_id": "9534d91f-4518-41c5-a7c4-56e22a56c2a4",
+  "rollback_log": true,
+  "note": "rollback/fallback/drift proven by adversarial + run-casan4 suites"
+}
@@ -0,0 +1 @@
+c55972046b1fe12b6bc538fde0ab31ad62e0c9e4b20003e5f1370f104d849f47
@@ -0,0 +1,8 @@
+{
+  "run_id": "9534d91f-4518-41c5-a7c4-56e22a56c2a4",
+  "vectors_defined": 16,
+  "critical_vectors": 4,
+  "adversarial_block_rate_pct": 100.0,
+  "critical_block_rate_pct": 100.0,
+  "note": "block rates from benign-fp-report (deterministic layer); full suites: phase1-track-a + phase2-track-c"
+}
@@ -0,0 +1,28 @@
+{
+  "run_id": "9534d91f-4518-41c5-a7c4-56e22a56c2a4",
+  "pack_version": "1.0-mvp",
+  "certified": false,
+  "certification_reasons": [
+    "telemetry_integrity_not_verified",
+    "unresolved_cost_spike"
+  ],
+  "required_gates": [
+    "H3-traceability",
+    "H4-security",
+    "H5-audit-chain",
+    "H5-telemetry",
+    "H6-cost",
+    "benign-fp-budget"
+  ],
+  "harness_reports": [
+    "benign-fp-report.json",
+    "h1-context-report.json",
+    "h2-tool-audit.json",
+    "h3-eval-scorecard.json",
+    "h4-security-report.json",
+    "h5-audit-chain-proof.json",
+    "h6-cost-telemetry.json",
+    "h7-orchestration-report.json",
+    "redteam-result.json"
+  ]
+}
@@ -0,0 +1,168 @@
+{
+  "generated_at": "2026-07-17T16:57:32Z",
+  "requirements_source": "apps/okr/domain/input/okr-requirement.md",
+  "mapping_source": "apps/okr/domain/traceability-map.json",
+  "summary": {
+    "requirements": 5,
+    "passed": 5,
+    "failed": 0,
+    "symbol_refs": 9,
+    "symbols_found": 9,
+    "symbols_missing": 0,
+    "orphan_mappings": []
+  },
+  "matrix": [
+    {
+      "id": "FR-01",
+      "name": "Login",
+      "status": "PASS",
+      "code": [
+        "apps/okr/backend/src/auth/auth.controller.ts",
+        "apps/okr/backend/src/auth/auth.service.ts",
+        "apps/okr/frontend/src/pages/Login.tsx",
+        "apps/okr/frontend/src/hooks/useAuth.tsx"
+      ],
+      "tests": [
+        "apps/okr/backend/test/services.test.ts",
+        "apps/okr/backend/test/e2e.test.ts"
+      ],
+      "missing_code": [],
+      "missing_tests": [],
+      "symbol_refs": [
+        {
+          "file": "apps/okr/backend/src/auth/auth.service.ts",
+          "symbol": "AuthService",
+          "found": true
+        },
+        {
+          "file": "apps/okr/backend/src/auth/auth.service.ts",
+          "symbol": "login",
+          "found": true
+        }
+      ],
+      "missing_symbols": [],
+      "missing_lines": []
+    },
+    {
+      "id": "FR-02",
+      "name": "Create Objective",
+      "status": "PASS",
+      "code": [
+        "apps/okr/backend/src/objectives/objectives.controller.ts",
+        "apps/okr/backend/src/objectives/objectives.service.ts",
+        "apps/okr/frontend/src/pages/CreateObjective.tsx",
+        "apps/okr/frontend/src/schemas/objective.schema.ts"
+      ],
+      "tests": [
+        "apps/okr/backend/test/services.test.ts",
+        "apps/okr/backend/test/e2e.test.ts",
+        "apps/okr/frontend/src/__tests__/okr.test.tsx"
+      ],
+      "missing_code": [],
+      "missing_tests": [],
+      "symbol_refs": [
+        {
+          "file": "apps/okr/backend/src/objectives/objectives.service.ts",
+          "symbol": "ObjectivesService",
+          "found": true
+        },
+        {
+          "file": "apps/okr/backend/src/objectives/objectives.service.ts",
+          "symbol": "create",
+          "found": true
+        }
+      ],
+      "missing_symbols": [],
+      "missing_lines": []
+    },
+    {
+      "id": "FR-03",
+      "name": "Create Key Result",
+      "status": "PASS",
+      "code": [
+        "apps/okr/backend/src/key-results/key-results.controller.ts",
+        "apps/okr/backend/src/key-results/key-results.service.ts",
+        "apps/okr/backend/src/key-results/dto/create-key-result.dto.ts"
+      ],
+      "tests": [
+        "apps/okr/backend/test/services.test.ts",
+        "apps/okr/backend/test/e2e.test.ts"
+      ],
+      "missing_code": [],
+      "missing_tests": [],
+      "symbol_refs": [
+        {
+          "file": "apps/okr/backend/src/key-results/key-results.service.ts",
+          "symbol": "KeyResultsService",
+          "found": true
+        },
+        {
+          "file": "apps/okr/backend/src/key-results/key-results.service.ts",
+          "symbol": "create",
+          "found": true
+        }
+      ],
+      "missing_symbols": [],
+      "missing_lines": []
+    },
+    {
+      "id": "FR-04",
+      "name": "Update Progress",
+      "status": "PASS",
+      "code": [
+        "apps/okr/backend/src/key-results/key-results.controller.ts",
+        "apps/okr/backend/src/key-results/key-results.service.ts",
+        "apps/okr/backend/src/key-results/dto/update-progress.dto.ts",
+        "apps/okr/frontend/src/pages/KeyResultDetail.tsx"
+      ],
+      "tests": [
+        "apps/okr/backend/test/services.test.ts",
+        "apps/okr/backend/test/e2e.test.ts",
+        "apps/okr/frontend/src/__tests__/okr.test.tsx"
+      ],
+      "missing_code": [],
+      "missing_tests": [],
+      "symbol_refs": [
+        {
+          "file": "apps/okr/backend/src/key-results/key-results.service.ts",
+          "symbol": "updateProgress",
+          "found": true
+        }
+      ],
+      "missing_symbols": [],
+      "missing_lines": []
+    },
+    {
+      "id": "FR-05",
+      "name": "Dashboard",
+      "status": "PASS",
+      "code": [
+        "apps/okr/backend/src/objectives/objectives.controller.ts",
+        "apps/okr/backend/src/objectives/objectives.service.ts",
+        "apps/okr/frontend/src/pages/Dashboard.tsx",
+        "apps/okr/frontend/src/hooks/useObjectives.ts"
+      ],
+      "tests": [
+        "apps/okr/backend/test/services.test.ts",
+        "apps/okr/backend/test/e2e.test.ts",
+        "apps/okr/frontend/src/__tests__/okr.test.tsx"
+      ],
+      "missing_code": [],
+      "missing_tests": [],
+      "symbol_refs": [
+        {
+          "file": "apps/okr/backend/src/objectives/objectives.service.ts",
+          "symbol": "ObjectivesService",
+          "found": true
+        },
+        {
+          "file": "apps/okr/backend/src/objectives/objectives.service.ts",
+          "symbol": "list",
+          "found": true
+        }
+      ],
+      "missing_symbols": [],
+      "missing_lines": []
+    }
+  ]
+}
@@ -11,8 +11,8 @@ contents + maturity: [`packaging/levels.json`](../../packaging/levels.json).
 |---|---|:--:|---|
 | **1 — Core Harness** | `casan-core`, `casan-harness` | ✅ implemented | H1–H7 harness, security + action gates, evidence pack, audit, cost/telemetry, hardening tests, policy/config defaults, `bin/casan` CLI |
 | **2 — DevKit / Adoption Kit** | `casan-devkit`, `casan-project-kit` | ✅ implemented | Level 1 + project templates, domain-pack scaffold, Gitea workflow template, harness Dockerfile, install script, adoption/CI/domain-pack guides |
-| **3 — Platform Components** | `casan-platform`, `casan-control-panel` | 🟡 preview | Control Panel, Dashboard, Evidence/Attack/Run-History viewers, read-only Ask CASAN, Gitea webhook. **AgentOps dashboard + Plan-13 Control Panel Track 1/2/3 + FinOps/SLO + Command Center + local-prod TLS/OIDC smoke exist today.** |
-| **4 — Enterprise / Governed Console** | `casan-enterprise`, `casan-governed-console` | 📋 future | Governed Chat Console, Prompt Router, Model-Provider Mgmt, Operator/Codegen modes, Agent/Skill Registry, RBAC, approval, tenant isolation, KMS/WORM, policy versioning |
+| **3 — Platform Components** | `casan-platform`, `casan-control-panel` | 🟡 preview | Control Panel, Dashboard, Run History, governed chat MVP and **Evidence Pack Viewer**. Attack Battery Viewer, Gitea evidence publishing, and managed rollout are still pending. |
+| **4 — Enterprise / Governed Console** | `casan-enterprise`, `casan-governed-console` | 📋 future | Promotion layer requiring managed deployment, KMS/Object Lock operations, HA/DR/SLA, external review and compliance/support evidence. |

 Levels are cumulative: DevKit extends Core, Platform extends DevKit, Enterprise extends
 Platform.
@@ -60,8 +60,14 @@ docs/packaging/             # this plan + adoption/CI/domain-pack/gitea/docker g
 ## Implemented now vs future
 - **Implemented now:** Level 1 Core packaging, Level 2 DevKit packaging, release script,
  `bin/casan`, templates, docs, all-in-one-demo bundle.
- **Structure + docs only:** Level 3 Platform (dashboard exists; rest scaffolded),
-  Level 4 Enterprise (RBAC/tenant/KMS/WORM/approval exist in core; governed console not built).
- **Not built in this task (do not assume present):** Governed Chat Console, Prompt Mode
-  Router, Model Provider Management, Operator/Codegen modes, Agent/Skill Registry, RBAC/
-  tenant *console* UX.
+- **Platform preview:** a shipped preview bundle containing the Control Panel,
+  governed-chat MVP, and Evidence Pack Viewer. It is explicitly incomplete.
+- **Structure + docs only:** Level 4 Enterprise. RBAC/tenant/KMS/WORM/approval
+  building blocks exist, but no Enterprise artifact is shipped.
+- **Not built in this task (do not assume present):** Attack Battery Viewer,
+  Gitea webhook evidence publishing, enterprise managed deployment, HA/DR/SLA,
+  external security assessment and compliance certification.
+
+For customer claims and limitations, use
+[`EDITION_FEATURE_LIMITATION_MATRIX.md`](EDITION_FEATURE_LIMITATION_MATRIX.md),
+not this overview alone.
@@ -0,0 +1,40 @@
+# CASAN Edition Feature and Limitation Matrix
+
+This matrix is the customer-facing source of truth for edition claims. A check
+means the capability is packaged and has repository evidence; it does not imply
+an enterprise SLA, managed operation, or certification unless explicitly noted.
+
+| Capability | Core | DevKit | Platform Preview | Enterprise |
+|---|---:|---:|---:|---:|
+| H1–H7 harness, policy/action gates | Included | Included | Included | Building blocks only |
+| CLI and evidence pack creation/verification | Included | Included | Included | Building blocks only |
+| Project/domain templates and CI adoption guides | — | Included | Included | — |
+| Gitea CI gate template | — | Included | Included | — |
+| Control Panel: runs, governance, security, cost, approvals | — | — | Included | Not a shipped edition |
+| Evidence Pack Viewer | — | — | Included | Not a shipped edition |
+| Governed chat/operator/codegen MVP | — | — | Included, preview | Not a shipped edition |
+| Gitea webhook evidence publishing | — | — | Not yet available | Not available |
+| Enterprise OIDC/CA/private-network deployment | — | — | Local smoke only | Not available |
+| Vault/KMS enforced, immutable object storage | Harness building blocks | Harness building blocks | Not production packaged | Not available |
+| HA, DR, RPO/RTO, production SLA | — | — | Not available | Not available |
+| External pentest / ISO/SOC/ISMAP claim | — | — | Not available | Not available |
+| Commercial license / support agreement | Required for paid use | Required for paid use | Required for paid use | Future contract only |
+
+## Edition rules
+
+- **Core** is the first paid-PoC product: use it with the customer’s existing
+  AI coding tools and CI. It is self-hosted and evidence-oriented.
+- **DevKit** adds repeatable adoption material. It does not add a managed
+  service or a security certification.
+- **Platform Preview** includes the Control Panel and the Evidence Pack Viewer,
+  but is not production enterprise software. The bundle has a
+  `PREVIEW-INCOMPLETE.txt` marker by design.
+- **Enterprise** remains `future` and `package-release.sh enterprise` refuses
+  to generate an artifact. Do not advertise it as a purchasable edition.
+
+## Claim guardrails
+
+Do not claim “enterprise-ready”, “production HA”, “ISMAP compliant”, “APPI
+compliant”, “immutable storage”, “signed evidence”, or “sandboxed codegen”
+unless the corresponding deployment and verification evidence exists for that
+customer environment.
@@ -4,7 +4,7 @@
 > bước tiếp theo cụ thể + cờ phụ-thuộc-hạ-tầng, để **bất kỳ AI/người nào tiếp quản
 > cũng làm tiếp được ngay**. Cập nhật mỗi khi hoàn thành một mục.
 >
-> Cập nhật lần cuối: 2026-07-08 · Nhánh làm tiếp từ handoff Claude/Codex.
+> Cập nhật lần cuối: 2026-07-17 · Nhánh làm tiếp từ handoff Claude/Codex.
 >
 > **Vai trò file (single source of truth):** file này là **nguồn chuẩn cho "còn
 > gì phải làm"**. Control **đã implement+test** → xem `CASAN_HARDENING_STATUS.md`.
@@ -30,6 +30,7 @@
 | T1.2 | **IdP/OIDC cho approval** (thay registry pubkey tĩnh) | 07 C4 / V20 | ✅ MVP done+test | `approval-verify.sh` chấp nhận `CASAN_APPROVAL_JWT` RS256 ký bởi mock IdP, verify chữ ký bằng pubkey, check `sub`/`role`/`exp` + bind `action`/`actor`/`input_sha256`. Test: JWT hợp lệ→APPROVED, hết hạn/sai role/chữ ký giả→DENY. Prod còn cần IdP/JWKS thật. |
 | T1.3 | **Traceability REQ→code→test** (khác biệt nhất) | 10 | ✅ MVP done+test | `traceability-matrix.py` parse FR-xx từ requirement, dùng `apps/okr/domain/traceability-map.json`, gate mọi FR có ≥1 code + ≥1 test; Evidence Pack thêm `traceability-matrix.json`. Test: FR đủ→PASS, FR thiếu test→FAIL. |
 | T1.4 | **Fix test-infra backend** (Prisma MySQL vs `setup-sqlite.mjs`) — gỡ chặn `npm test` để Plan-05 CI xanh | 05 | ✅ done+test | Đã fix: `scripts/make-sqlite-schema.mjs` sinh `schema.sqlite.prisma` từ schema.prisma (không drift), test dùng `prisma db push` thay migration MySQL thủ công; bỏ `setup-sqlite.mjs`; đổi `bcrypt`→`bcryptjs` (thuần JS, không cần native build); thêm `cross-env`. **Backend `npm test` = 46 pass / 0 fail / 3 skip** (llm-judge thiếu ANTHROPIC_API_KEY). Đã nối vào `ci-harness-gate.sh` (`backend-tests`). Build production (mysql) vẫn compile. Ghi chú: engine Prisma tải qua `NODE_OPTIONS=--use-system-ca` do corporate MITM. |
+| T1.5 | **Paid-PoC release package** | Commercial P0 | 🟡 partial, evidence-backed | Done locally: Control Panel tests/build in harness + release gates; Platform manifest includes console/deploy/docs; extracted-artifact smoke works; Evidence Pack Viewer + one sample pack; Japanese PoC pack; npm third-party inventory + proprietary commercial-license decision. Remaining before claiming P0 complete: run a real Gitea PR E2E and retain its Evidence Pack; resolve all six `UNKNOWN` npm licenses plus Python/container/model/dataset/assets inventory with legal review. |

 ## TIER 2 — Plan-07 gaps cần hạ tầng (Docker local-prod lab đã có; prod managed thật vẫn cần) 🔌
				`@@ -0,0 +1 @@`
				`c55972046b1fe12b6bc538fde0ab31ad62e0c9e4b20003e5f1370f104d849f47`