feat: ship production local assurance viewer in core
This commit is contained in:
thanhnv
@@ -20,6 +20,17 @@ The project defaults to Level 1/Core with runtime mode `managed`. Core remains
|
||||
under `$CASAN_HOME`; the repository receives `.casan` config/lock/bootstrap and
|
||||
the selected client hooks. The CLI output states the resolved runtime path.
|
||||
|
||||
After any prompt, visual assurance is available from Core itself:
|
||||
|
||||
```bash
|
||||
casan report latest
|
||||
casan view
|
||||
```
|
||||
|
||||
The viewer is single-project, offline-capable and read-only. It starts lazily on
|
||||
`127.0.0.1`, so projects do not need Platform, Node/npm or an always-running
|
||||
service merely to inspect H1–H7 and H6.
|
||||
|
||||
Use this for developer workstations and managed CI runners. CI must install the
|
||||
same release recorded by `.casan/version.lock` before running gates.
|
||||
|
||||
@@ -88,6 +99,8 @@ bin/casan pipeline --manifest apps/<project>/domain/project.manifest.json
|
||||
- **Project lock/config** → `.casan/config.json` and `.casan/version.lock`.
|
||||
- **Your domain data** → `apps/<project>/domain/` (via `CASAN_DOMAIN_ROOT`).
|
||||
- **Runtime state** → `.specify/` (logs, audit, governance — created on first run).
|
||||
- **Local viewer state** → `.specify/state/local-viewer.json` (`0600` on POSIX,
|
||||
project ACL on Windows; ephemeral loopback port/session token; removed on stop).
|
||||
The bootstrap resolves the mode/path from the project lock and verifies the live
|
||||
Core hash before dispatch.
|
||||
|
||||
|
||||
@@ -9,7 +9,7 @@ contents + maturity: [`packaging/levels.json`](../../packaging/levels.json).
|
||||
|
||||
| Edition | Package names | Status | What it is |
|
||||
|---|---|:--:|---|
|
||||
| **1 — Core Harness** | `casan-core`, `casan-harness` | ✅ implemented | Minimal H1–H7 production runtime: security + action gates, evidence pack, audit, cost/telemetry, policy/config defaults, adapters, `bin/casan` CLI |
|
||||
| **1 — Core Harness** | `casan-core`, `casan-harness` | ✅ implemented | Minimal H1–H7 production runtime plus zero-dependency Local Assurance Viewer: latest/history, interactive H1–H7, H6 and on-demand export |
|
||||
| **2 — DevKit / Adoption Kit** | `casan-devkit`, `casan-project-kit` | ✅ implemented | Level 1 + project templates, domain-pack scaffold, Gitea workflow template, harness Dockerfile, install script, adoption/CI/domain-pack guides |
|
||||
| **3 — Platform Components** | `casan-platform`, `casan-control-panel` | 🟡 preview | Control Panel, Dashboard, Run History, governed chat MVP and **Evidence Pack Viewer**. Attack Battery Viewer, Gitea evidence publishing, and managed rollout are still pending. |
|
||||
| **4 — Enterprise / Governed Console** | `casan-enterprise`, `casan-governed-console` | 📋 future | Promotion layer requiring managed deployment, KMS/Object Lock operations, HA/DR/SLA, external review and compliance/support evidence. |
|
||||
@@ -53,7 +53,7 @@ Production Core/DevKit artifacts never include:
|
||||
- internal CI/adversarial runners (`ci-harness-gate.sh`, `security-gate.sh`,
|
||||
`test-integrity.py`, cloud smoke);
|
||||
- the legacy `packages/casan-harness/level5/` directory;
|
||||
- Platform-only dashboard/local-infrastructure helpers;
|
||||
- Platform-only centralized Control Plane/local-infrastructure helpers;
|
||||
- source documentation, installer copies, Dockerfiles, caches, or release tooling
|
||||
inside the installed version directory.
|
||||
|
||||
@@ -63,10 +63,11 @@ its tests so CASAN itself remains verifiable; only the install/release boundary
|
||||
minimal.
|
||||
|
||||
## Who adopts what
|
||||
- **Governance-harness-only / BJT initial / CI gate** → `casan-core`.
|
||||
- **Governance-harness-only / BJT initial / CI gate / single-project visual assurance** → `casan-core`.
|
||||
- **New project adopting CASAN** → `casan-devkit` (install.sh scaffolds domain + CI).
|
||||
- **Want dashboards/visibility** → `casan-platform` (preview; live H1–H7,
|
||||
H6 coverage and on-demand run/H6 exports today).
|
||||
- **Want centralized multi-project operations, RBAC and approvals** →
|
||||
`casan-platform` (preview). Core already provides single-project H1–H7, H6,
|
||||
history and on-demand run/H6 exports.
|
||||
- **Enterprise governed console** → future; building blocks (RBAC/tenant/KMS/WORM/approval)
|
||||
already live in core.
|
||||
|
||||
|
||||
@@ -0,0 +1,99 @@
|
||||
# CASAN Core Local Assurance Viewer
|
||||
|
||||
## Product decision
|
||||
|
||||
A project that installs only CASAN Core can inspect production-quality visual
|
||||
reports. Platform is not a prerequisite for basic visibility.
|
||||
|
||||
Core owns the single-project review loop:
|
||||
|
||||
- latest assurance receipt and run history;
|
||||
- interactive H1→H7 evidence spine;
|
||||
- H6 runtime, reliability, token/cost coverage, freshness and findings;
|
||||
- loading, empty, error, legacy and partial-telemetry states;
|
||||
- self-contained HTML and machine-auditable JSON export on demand.
|
||||
|
||||
Platform remains the centralized operations layer: multi-project fleet views,
|
||||
organization RBAC, shared approval queues, remote ingestion, governed settings
|
||||
and managed retention.
|
||||
|
||||
## Lifecycle
|
||||
|
||||
```text
|
||||
Prompt finishes
|
||||
└─ hook writes canonical trace/events/H6 + latest-run receipt
|
||||
└─ no server, no HTML export, no second model call
|
||||
|
||||
Developer runs `casan view`
|
||||
└─ Core starts or reuses a loopback viewer
|
||||
├─ reads bounded evidence projections
|
||||
├─ opens latest/specified trace
|
||||
└─ generates HTML/JSON only when Export is selected
|
||||
```
|
||||
|
||||
Do not run `casan report export` after every prompt. Export is an independent
|
||||
review artifact, not the evidence source of truth.
|
||||
|
||||
## Commands
|
||||
|
||||
```bash
|
||||
casan report latest
|
||||
casan view [trace-id] [--no-open]
|
||||
|
||||
casan report export [trace-id] --format html|json [-o path]
|
||||
casan report export --h6 --format html|json [-o path]
|
||||
|
||||
casan dashboard start [--port 0]
|
||||
casan dashboard open
|
||||
casan dashboard status
|
||||
casan dashboard stop
|
||||
```
|
||||
|
||||
When Platform code is installed, `casan dashboard` manages the centralized
|
||||
Control Plane. `casan view` remains the predictable Core single-project viewer.
|
||||
|
||||
## Runtime and packaging contract
|
||||
|
||||
- Python standard library only; no Node/npm or network dependency.
|
||||
- Static HTML/CSS/JS ships inside `casan-core`.
|
||||
- System fonts only; no CDN, analytics or external asset requests.
|
||||
- Managed and vendored Core use the same runtime allowlist.
|
||||
- Runtime tests and source-only tooling do not cross the release boundary.
|
||||
- Evidence remains under the project's `.specify/` tree.
|
||||
|
||||
## Security model
|
||||
|
||||
- binds only to `127.0.0.1` on an ephemeral port by default;
|
||||
- rejects non-loopback clients and non-loopback `Host` headers;
|
||||
- requires a high-entropy session token for every API/export request;
|
||||
- stores viewer state as `0600` on POSIX and under the project ACL on Windows;
|
||||
- exposes GET-only evidence APIs; mutation verbs return `405`;
|
||||
- sends CSP, `no-store`, `nosniff`, frame denial and no-referrer headers;
|
||||
- validates trace/project filters and never resolves a request path as a file;
|
||||
- bounds source reads, record counts and response size;
|
||||
- rotates the non-evidence request log at 1 MiB and never logs the session token;
|
||||
- redacts prompt bodies, credentials, tool input/output and authorization data;
|
||||
- keeps missing token/cost values `null`, never fabricated as zero.
|
||||
|
||||
The UI shell itself is non-sensitive and may load without a token. All project
|
||||
metadata, evidence and exports require the session token.
|
||||
|
||||
## Production acceptance gate
|
||||
|
||||
The Core viewer is releasable only when all of these pass:
|
||||
|
||||
1. unit contracts for empty, legacy, partial, certified and unsafe-input states;
|
||||
2. clean-project test from the built `casan-core` tarball;
|
||||
3. no `packages/casan-control-panel`, `package.json` or Node dependency in Core;
|
||||
4. unauthorized API, mutation and Host-header checks fail closed;
|
||||
5. run/H6 HTML and JSON export work offline;
|
||||
6. browser validation covers the report hierarchy, interaction and responsive
|
||||
navigation;
|
||||
7. existing harness, DevKit installation and packaging suites remain green.
|
||||
|
||||
## Maturity statement
|
||||
|
||||
This viewer improves evidence usability; it does not grant CASAN Maturity L4.
|
||||
Maturity is assessed from real operational evidence, ownership, controls and
|
||||
repeatability. The interface must show the recorded maturity status and must
|
||||
not infer a level from the installed edition.
|
||||
@@ -15,9 +15,11 @@ CASAN Maturity L1–L5 describes evidence-backed operational adoption.
|
||||
| Gitea CI gate template | — | Included | Included | — |
|
||||
| Control Panel: runs, governance, security, cost, approvals | — | — | Included | Not a shipped edition |
|
||||
| Prompt assurance receipt + latest-run discovery | Included | Included | Included | Building blocks only |
|
||||
| Clickable trace deep link when enrolled | Included | Included | Included | Building blocks only |
|
||||
| One-command local Control Plane launcher | — | — | Included | Not a shipped edition |
|
||||
| H1–H7 live assurance rail + per-run HTML/JSON export | — | — | Included | Not a shipped edition |
|
||||
| Core Local Assurance Viewer (single project, offline, read-only) | Included | Included | Included | Building blocks only |
|
||||
| H1–H7 assurance rail + per-run HTML/JSON export | Included | Included | Included | Building blocks only |
|
||||
| H6 AgentOps dossier + history + filters + HTML/JSON export | Included | Included | Included | Building blocks only |
|
||||
| Clickable local trace deep link; central link when enrolled | Included | Included | Included | Building blocks only |
|
||||
| One-command centralized Control Plane launcher | — | — | Included | Not a shipped edition |
|
||||
| Async HMAC telemetry delivery with durable local spool | Included | Included | Included | Building blocks only |
|
||||
| Evidence Pack Viewer | — | — | Included | Not a shipped edition |
|
||||
| Governed chat/operator/codegen MVP | — | — | Included, preview | Not a shipped edition |
|
||||
@@ -31,11 +33,13 @@ CASAN Maturity L1–L5 describes evidence-backed operational adoption.
|
||||
## Edition rules
|
||||
|
||||
- **Core** is the first paid-PoC product: use it with the customer’s existing
|
||||
AI coding tools and CI. It is self-hosted and evidence-oriented.
|
||||
AI coding tools and CI. It includes a production-quality single-project
|
||||
Local Assurance Viewer without Node/npm or a Platform dependency.
|
||||
- **DevKit** adds repeatable adoption material. It does not add a managed
|
||||
service or a security certification.
|
||||
- **Platform Preview** includes the Control Panel and the Evidence Pack Viewer,
|
||||
but is not production enterprise software. The bundle has a
|
||||
- **Platform Preview** includes the Control Panel and Evidence Pack Viewer,
|
||||
plus centralized multi-project operations, RBAC and approvals. It is not
|
||||
production enterprise software. The bundle has a
|
||||
`PREVIEW-INCOMPLETE.txt` marker by design.
|
||||
- **Enterprise** remains `future` and `package-release.sh enterprise` refuses
|
||||
to generate an artifact. Do not advertise it as a purchasable edition.
|
||||
|
||||
Reference in New Issue
Block a user