feat: plan 16-01

AINative_OKR_CASAN5/.specify/tests/phase-sec16-tests.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN Plan-16 SEC-16 (ARCH-01) — signed harness + policy bundle.
+#
+# Editing a gate or policy file (security-check.sh, prompt-filter.yaml,
+# thresholds.yaml, *.pin, reviewers.registry) disables a control with no input
+# trace. The signed bundle manifest binds the harness code + policy; the harness
+# verifies its self-hash and refuses on drift. Proves:
+#   * intact bundle verifies (permissive + strict/signed),
+#   * a 1-byte edit to a gate script → verify FAIL (drift),
+#   * a new unmanifested policy file → verify FAIL,
+#   * a tampered manifest → verify FAIL (signature invalid),
+#   * casan-harness in prod REFUSES to run when the bundle has drifted.
+#
+# Deterministic; hermetic (temp bundle root + temp keys/manifest).
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+BASH_DIR="$PROJECT_ROOT/.specify/scripts/bash"
+BI="$BASH_DIR/bundle-integrity.py"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+PASS=0; FAIL=0
+pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
+fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
+rc_of() { set +e; "$@" >/dev/null 2>&1; echo $?; set -e 2>/dev/null || true; }
+
+echo "===== Plan-16 SEC-16: signed harness + policy bundle ====="
+
+# --- Tool-level (hermetic temp bundle) ---
+ROOT="$WORK/root"; mkdir -p "$ROOT/scripts/bash" "$ROOT/config"
+echo 'echo gate' > "$ROOT/scripts/bash/security-check.sh"
+echo 'block: [rm -rf]' > "$ROOT/config/prompt-filter.yaml"
+export CASAN_BUNDLE_ROOT="$ROOT" CASAN_BUNDLE_MANIFEST="$WORK/m.json"
+export CASAN_BUNDLE_KEY_DIR="$WORK/keys" CASAN_BUNDLE_PUB="$WORK/b.pub"
+
+python3 "$BI" generate >/dev/null 2>&1
+[[ "$(rc_of python3 "$BI" verify)" -eq 0 ]] && pass "intact bundle verifies" || fail "intact verify failed"
+[[ "$(rc_of python3 "$BI" verify --strict)" -eq 0 ]] && pass "intact bundle verifies (strict/signed)" || fail "strict verify failed"
+
+echo 'echo gate; echo BACKDOOR' > "$ROOT/scripts/bash/security-check.sh"
+[[ "$(rc_of python3 "$BI" verify)" -ne 0 ]] && pass "1-byte gate edit → FAIL (drift)" || fail "drift not detected"
+
+echo 'echo gate' > "$ROOT/scripts/bash/security-check.sh"   # restore
+echo 'x: 1' > "$ROOT/config/thresholds.yaml"                # add unmanifested policy
+[[ "$(rc_of python3 "$BI" verify)" -ne 0 ]] && pass "unmanifested policy file → FAIL" || fail "unmanifested not detected"
+
+rm -f "$ROOT/config/thresholds.yaml"; python3 "$BI" generate >/dev/null 2>&1
+python3 - "$WORK/m.json" <<'PY'
+import json, sys
+d = json.load(open(sys.argv[1])); k = list(d["files"]); d["files"][k[0]] = "0" * 64
+json.dump(d, open(sys.argv[1], "w"))
+PY
+[[ "$(rc_of python3 "$BI" verify)" -ne 0 ]] && pass "tampered manifest → FAIL (signature invalid)" || fail "manifest tamper not detected"
+
+unset CASAN_BUNDLE_ROOT CASAN_BUNDLE_MANIFEST CASAN_BUNDLE_KEY_DIR CASAN_BUNDLE_PUB
+
+# --- Harness-level: prod run refuses on bundle drift ---
+HROOT="$WORK/hroot"; mkdir -p "$HROOT/scripts/bash"
+echo 'echo gate' > "$HROOT/scripts/bash/security-check.sh"
+env CASAN_BUNDLE_ROOT="$HROOT" CASAN_BUNDLE_MANIFEST="$WORK/hm.json" \
+    CASAN_BUNDLE_KEY_DIR="$WORK/hkeys" CASAN_BUNDLE_PUB="$WORK/h.pub" \
+    python3 "$BI" generate >/dev/null 2>&1
+echo 'echo gate; echo BACKDOOR' > "$HROOT/scripts/bash/security-check.sh"   # drift the bundle
+
+echo "hi" > "$WORK/in.txt"
+OUT="$(set +e; env CASAN_PROFILE=prod CASAN_KILLSWITCH_DIR="$WORK/noks" \
+  CASAN_BUNDLE_ROOT="$HROOT" CASAN_BUNDLE_MANIFEST="$WORK/hm.json" \
+  CASAN_BUNDLE_KEY_DIR="$WORK/hkeys" CASAN_BUNDLE_PUB="$WORK/h.pub" \
+  bash "$BASH_DIR/casan-harness.sh" "$WORK/in.txt" "$WORK/o.txt" act -- bash -c 'echo x' 2>&1)"
+echo "$OUT" | grep -q "BUNDLE_INTEGRITY_DRIFT" \
+  && pass "casan-harness (prod) REFUSES to run on bundle drift" \
+  || fail "harness did not refuse on bundle drift"
+
+echo ""
+echo "===== SEC-16 SUMMARY: PASS=$PASS FAIL=$FAIL ====="
+[[ "$FAIL" -eq 0 ]] || exit 1