feat: plan 16-01

2026-07-06 21:47:38 +09:00
parent 4419cd9eae
commit 8c3c5e8bff
30 changed files with 1646 additions and 66 deletions
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN Plan-16 SEC-17 (ARCH-03) — CASAN_PROFILE=prod is secure-by-default.
+#
+# Many strong controls were opt-in env flags (off unless explicitly set), so a
+# lazy operator ran permissively. Under CASAN_PROFILE=prod they now default ON —
+# while an explicit `=0` still wins (internal scans that disable a flag on purpose
+# must stay disabled). Proven across three real controls:
+#   * verify-audit-chain: unsigned chain fails under prod,
+#   * control-plane verify-audit: unsigned store fails under prod,
+#   * casan-harness kill-switch: engaged switch is enforced under prod, but an
+#     explicit CASAN_KILLSWITCH_ENFORCE=0 overrides.
+#
+# Deterministic; hermetic (temp dirs); no model/network.
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+BASH_DIR="$PROJECT_ROOT/.specify/scripts/bash"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+PASS=0; FAIL=0
+pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
+fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
+rc_of() { set +e; "$@" >/dev/null 2>&1; echo $?; set -e 2>/dev/null || true; }
+
+echo "===== Plan-16 SEC-17: CASAN_PROFILE=prod secure-by-default ====="
+
+# --- Control 1: verify-audit-chain (unsigned) ---
+AUD="$WORK/audit"; mkdir -p "$AUD"
+python3 - "$AUD/audit.jsonl" <<'PY'
+import hashlib, json, sys
+core = "|".join(["2026-07-06T00:00:00Z","t1","act","a@x","low","ALLOW","n/a","","ih","oh",""])
+h = hashlib.sha256(core.encode()).hexdigest()
+open(sys.argv[1],"w").write(json.dumps({"timestamp":"2026-07-06T00:00:00Z","trace_id":"t1","action":"act",
+  "actor":"a@x","risk_level":"low","decision":"ALLOW","approval_status":"n/a","approver":"",
+  "input_hash":"ih","output_hash":"oh","previous_record_hash":"","record_hash":h})+"\n")
+PY
+[[ "$(rc_of bash "$BASH_DIR/verify-audit-chain.sh" "$AUD/audit.jsonl")" -eq 0 ]] \
+  && pass "verify-audit-chain: permissive default allows unsigned" || fail "permissive should allow unsigned"
+[[ "$(rc_of env CASAN_PROFILE=prod bash "$BASH_DIR/verify-audit-chain.sh" "$AUD/audit.jsonl")" -ne 0 ]] \
+  && pass "verify-audit-chain: prod profile enforces (unsigned FAILS)" || fail "prod did not enforce audit-chain"
+
+# --- Control 2: control-plane verify-audit (unsigned store) ---
+export CASAN_CP_STORE_FILE="$WORK/cp.json" CASAN_CP_KEY_DIR="$WORK/cpkeys" CASAN_CP_PUB="$WORK/cp.pub"
+python3 "$BASH_DIR/control-plane-settings.py" set compression.enabled true --actor a --reason r >/dev/null 2>&1
+rm -f "$WORK/cp.json.head" "$WORK/cp.json.head.sig" "$WORK/cp.pub"   # strip the signature -> unsigned store
+[[ "$(rc_of python3 "$BASH_DIR/control-plane-settings.py" verify-audit)" -eq 0 ]] \
+  && pass "control-plane: permissive default allows unsigned store" || fail "permissive should allow unsigned store"
+[[ "$(rc_of env CASAN_PROFILE=prod python3 "$BASH_DIR/control-plane-settings.py" verify-audit)" -ne 0 ]] \
+  && pass "control-plane: prod profile enforces (unsigned store FAILS)" || fail "prod did not enforce control-plane"
+unset CASAN_CP_STORE_FILE CASAN_CP_KEY_DIR CASAN_CP_PUB
+
+# --- Control 3: casan-harness kill-switch (prod-on + explicit-0-wins) ---
+export CASAN_KILLSWITCH_DIR="$WORK/ks"
+echo "hi" > "$WORK/in.txt"
+bash "$BASH_DIR/kill-switch.sh" engage project sec17 "test" >/dev/null 2>&1
+
+OUT="$(set +e; CASAN_PROFILE=prod CASAN_KILLSWITCH_SCOPE=project CASAN_KILLSWITCH_ID=sec17 \
+  bash "$BASH_DIR/casan-harness.sh" "$WORK/in.txt" "$WORK/o.txt" act -- bash -c 'echo x' 2>&1)"
+echo "$OUT" | grep -q "KILL_SWITCH_ACTIVE" \
+  && pass "kill-switch: prod profile enforces an engaged switch (no explicit flag)" \
+  || fail "prod profile did not enforce kill-switch"
+
+OUT="$(set +e; CASAN_PROFILE=prod CASAN_KILLSWITCH_ENFORCE=0 CASAN_KILLSWITCH_SCOPE=project CASAN_KILLSWITCH_ID=sec17 \
+  bash "$BASH_DIR/casan-harness.sh" "$WORK/in.txt" "$WORK/o2.txt" act -- bash -c 'echo x' 2>&1)"
+echo "$OUT" | grep -q "KILL_SWITCH_ACTIVE" \
+  && fail "explicit CASAN_KILLSWITCH_ENFORCE=0 was overridden by prod (should win)" \
+  || pass "kill-switch: explicit =0 overrides prod default (internal opt-out preserved)"
+
+echo ""
+echo "===== SEC-17 SUMMARY: PASS=$PASS FAIL=$FAIL ====="
+[[ "$FAIL" -eq 0 ]] || exit 1