gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: prepare CASAN paid PoC release package

Browse Source
This commit is contained in:
thanhnv
2026-07-18 00:07:04 +07:00
parent c818eaf8b0
commit 881ee01691
55 changed files with 5992 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/packaging/CASAN_PACKAGING_PLAN.md
+13 -7
View File
@@ -11,8 +11,8 @@ contents + maturity: [`packaging/levels.json`](../../packaging/levels.json).
|---|---|:--:|---|
| **1 — Core Harness** | `casan-core`, `casan-harness` | ✅ implemented | H1–H7 harness, security + action gates, evidence pack, audit, cost/telemetry, hardening tests, policy/config defaults, `bin/casan` CLI |
| **2 — DevKit / Adoption Kit** | `casan-devkit`, `casan-project-kit` | ✅ implemented | Level 1 + project templates, domain-pack scaffold, Gitea workflow template, harness Dockerfile, install script, adoption/CI/domain-pack guides |
| **3 — Platform Components** | `casan-platform`, `casan-control-panel` | 🟡 preview | Control Panel, Dashboard, Evidence/Attack/Run-History viewers, read-only Ask CASAN, Gitea webhook. **AgentOps dashboard + Plan-13 Control Panel Track 1/2/3 + FinOps/SLO + Command Center + local-prod TLS/OIDC smoke exist today.** |
| **4 — Enterprise / Governed Console** | `casan-enterprise`, `casan-governed-console` | 📋 future | Governed Chat Console, Prompt Router, Model-Provider Mgmt, Operator/Codegen modes, Agent/Skill Registry, RBAC, approval, tenant isolation, KMS/WORM, policy versioning |
| **3 — Platform Components** | `casan-platform`, `casan-control-panel` | 🟡 preview | Control Panel, Dashboard, Run History, governed chat MVP and **Evidence Pack Viewer**. Attack Battery Viewer, Gitea evidence publishing, and managed rollout are still pending. |
| **4 — Enterprise / Governed Console** | `casan-enterprise`, `casan-governed-console` | 📋 future | Promotion layer requiring managed deployment, KMS/Object Lock operations, HA/DR/SLA, external review and compliance/support evidence. |
Levels are cumulative: DevKit extends Core, Platform extends DevKit, Enterprise extends
Platform.
@@ -60,8 +60,14 @@ docs/packaging/ # this plan + adoption/CI/domain-pack/gitea/docker g
## Implemented now vs future
- **Implemented now:** Level 1 Core packaging, Level 2 DevKit packaging, release script,
`bin/casan`, templates, docs, all-in-one-demo bundle.
- **Structure + docs only:** Level 3 Platform (dashboard exists; rest scaffolded),
Level 4 Enterprise (RBAC/tenant/KMS/WORM/approval exist in core; governed console not built).
- **Not built in this task (do not assume present):** Governed Chat Console, Prompt Mode
Router, Model Provider Management, Operator/Codegen modes, Agent/Skill Registry, RBAC/
tenant *console* UX.
- **Platform preview:** a shipped preview bundle containing the Control Panel,
governed-chat MVP, and Evidence Pack Viewer. It is explicitly incomplete.
- **Structure + docs only:** Level 4 Enterprise. RBAC/tenant/KMS/WORM/approval
building blocks exist, but no Enterprise artifact is shipped.
- **Not built in this task (do not assume present):** Attack Battery Viewer,
Gitea webhook evidence publishing, enterprise managed deployment, HA/DR/SLA,
external security assessment and compliance certification.
For customer claims and limitations, use
[`EDITION_FEATURE_LIMITATION_MATRIX.md`](EDITION_FEATURE_LIMITATION_MATRIX.md),
not this overview alone.
docs/packaging/EDITION_FEATURE_LIMITATION_MATRIX.md
+40
View File
@@ -0,0 +1,40 @@
# CASAN Edition Feature and Limitation Matrix
This matrix is the customer-facing source of truth for edition claims. A check
means the capability is packaged and has repository evidence; it does not imply
an enterprise SLA, managed operation, or certification unless explicitly noted.
| Capability | Core | DevKit | Platform Preview | Enterprise |
|---|---:|---:|---:|---:|
| H1–H7 harness, policy/action gates | Included | Included | Included | Building blocks only |
| CLI and evidence pack creation/verification | Included | Included | Included | Building blocks only |
| Project/domain templates and CI adoption guides | — | Included | Included | — |
| Gitea CI gate template | — | Included | Included | — |
| Control Panel: runs, governance, security, cost, approvals | — | — | Included | Not a shipped edition |
| Evidence Pack Viewer | — | — | Included | Not a shipped edition |
| Governed chat/operator/codegen MVP | — | — | Included, preview | Not a shipped edition |
| Gitea webhook evidence publishing | — | — | Not yet available | Not available |
| Enterprise OIDC/CA/private-network deployment | — | — | Local smoke only | Not available |
| Vault/KMS enforced, immutable object storage | Harness building blocks | Harness building blocks | Not production packaged | Not available |
| HA, DR, RPO/RTO, production SLA | — | — | Not available | Not available |
| External pentest / ISO/SOC/ISMAP claim | — | — | Not available | Not available |
| Commercial license / support agreement | Required for paid use | Required for paid use | Required for paid use | Future contract only |
## Edition rules
- **Core** is the first paid-PoC product: use it with the customer’s existing
AI coding tools and CI. It is self-hosted and evidence-oriented.
- **DevKit** adds repeatable adoption material. It does not add a managed
service or a security certification.
- **Platform Preview** includes the Control Panel and the Evidence Pack Viewer,
but is not production enterprise software. The bundle has a
`PREVIEW-INCOMPLETE.txt` marker by design.
- **Enterprise** remains `future` and `package-release.sh enterprise` refuses
to generate an artifact. Do not advertise it as a purchasable edition.
## Claim guardrails
Do not claim “enterprise-ready”, “production HA”, “ISMAP compliant”, “APPI
compliant”, “immutable storage”, “signed evidence”, or “sandboxed codegen”
unless the corresponding deployment and verification evidence exists for that
customer environment.