gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: update plan 16 sec14-26

Browse Source
This commit is contained in:
thanhnv
2026-07-07 15:46:36 +09:00
parent 0c60ed33e9
commit ae4fc7112c
64 changed files with 2231 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AINative_OKR_CASAN5/.specify/scripts/bash/model-digest-check.sh
+12 -2
View File
@@ -29,8 +29,18 @@ MODEL="${2:-${CASAN_MODEL:-ornith:9b}}"
OLLAMA="${OLLAMA_HOST:-127.0.0.1:11434}"
current_digest() {
# 1) explicit override (deterministic for CI/tests)
if [[ -n "${CASAN_MODEL_DIGEST:-}" ]]; then printf '%s' "$CASAN_MODEL_DIGEST"; return 0; fi
# 1) explicit override (deterministic for CI/tests) — DISABLED in enforced mode.
# SEC-14 / M-03 / SC-03: an attacker who swaps the local model could also set
# CASAN_MODEL_DIGEST to the pinned value and defeat the check. Under
# CASAN_PROFILE=prod (or CASAN_MODEL_DIGEST_STRICT=1) the override is never
# trusted — the digest must come from the live model backend.
if [[ -n "${CASAN_MODEL_DIGEST:-}" ]]; then
if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_MODEL_DIGEST_STRICT:-}" == "1" ]]; then
echo "MODEL_DIGEST_OVERRIDE_IGNORED enforced mode ignores CASAN_MODEL_DIGEST; using live digest" >&2
else
printf '%s' "$CASAN_MODEL_DIGEST"; return 0
fi
fi
# 2) live Ollama
local d
d="$(curl -sf "http://$OLLAMA/api/tags" 2>/dev/null | \