feat: update plan 16 sec14-26

casan-next-plans/CASAN_HARDENING_STATUS.md

@@ -74,6 +74,34 @@
 |---|---|---|---|
 | Docker Compose lab for Vault KMS, OIDC/JWKS IdP, MinIO Object Lock WORM, dashboard behind nginx basic auth, alert webhook, and provider billing API mock | [implemented+tested] (local-prod emulation; managed prod services still required for Strong claim) | `infra/local-prod/docker-compose.yml`, `infra-lab.sh` | phase-prod-infra-lab (2); `infra-lab verify` internal 7/0 |
 
+### Phase 8 — Plan-16 security-audit remediation (P0/P1/P2) — mixed
+
+> Adversarial audit of the harness scripts (`CASAN_PLAN_16`) turned into fixes.
+> Each control listed has an executable fail-able test in `.specify/tests/phase-sec*`
+> wired into `ci-harness-gate.sh`. **24 SEC suites = 118 checks, 0 fail (WSL).**
+
+| ID | Control | Status | Where | Test |
+|---|---|---|---|---|
+| SEC-01 | **Unsigned = FAIL** in enforced mode (verify-audit-chain / verify-tool-audit / telemetry-integrity / evidence-pack): tamper→recompute→strip-sig no longer passes | [implemented+tested] | those verifiers (`CASAN_VERIFY_STRICT`/prod) | phase-sec01 (10) |
+| SEC-02 | **KMS-anchor** for heads, no local auto-gen key in enforced mode | [implemented+tested] | `vault-kms.sh`, `sign-audit-head.sh` | phase-sec02 (3) |
+| SEC-03 | **rollback-manager**: no `bash -c`, structured argv only (RCE closed) | [implemented+tested] | `rollback-manager.sh` | phase-sec03 (3) |
+| SEC-04 | **action-gate fail-closed**: Python RC checked, default DENY | [implemented+tested] | `action-gate.sh` | phase-sec04 (4) |
+| SEC-05 | **JSON-safe writers** (no log-injection forged records) | [implemented+tested] | `governance-check.sh`, `agent-metrics.sh`, `incident.sh` | phase-sec05 (4) |
+| SEC-06 | **Control-plane / governance-report signed head** (no false CERTIFIED) | [implemented+tested] | `control-plane-settings.py`, `governance-report.py` | phase-sec06 (5) |
+| SEC-07..10 | **Approval-JWT**, **pii fail-closed**, **input-caps/fail-closed read**, **non-spoofable identity** | [implemented+tested] | supply-chain/self-improve/CP · `pii-mask.py` · security-check/drift/compress · tool-registry/agent-metrics | phase-sec07/08/09/10 (7/4/7/5) |
+| SEC-11 | **Enforce-by-default** (tool-output-scan/kill-switch/preflight) | ✅ **consolidated into SEC-17** | `CASAN_PROFILE=prod` | phase-sec17 |
+| SEC-12..15 | **drift-invariant**, **SSRF allowlist**, **model-digest env-override ignored in prod** (SEC-14), **low-cluster** (typosquat≤2 / tool-exec fail-closed / nested schema recursion) | [implemented+tested] | drift-detect · provider-usage-fetch/JWKS/dashboard · `model-digest-check.sh` · supply-chain-scan/tool-exec/validate-tool-input | phase-sec12/13/14/15 (5/6/5/7) |
+| SEC-16..21 | **bundle-integrity** (ARCH-01), **prod-profile enforce-by-default** (ARCH-03), **test-integrity** (ARCH-02), **atomic-store flock** (ARCH-05), **toolchain path-pin** (ARCH-04), **model/run budget** (ARCH-07) | [implemented+tested] | `bundle-integrity.py`, `test-integrity.py`, atomic writes, `toolchain-verify.sh`, budget checks | phase-sec16..21 (6/6/5/4/5/4) |
+| SEC-27..30 | **log control-char strip** (X-02), **path-traversal realpath** (X-04), **audit fail-closed on disk-fail** (X-05), **approval-replay nonce/jti** (X-06) | [implemented+tested] | log writers, path-guard, audit append, `approval-verify.sh` | phase-sec27..30 (3/4/3/3) |
+| SEC-26 | **stored / second-order injection** (X-01): scan golden-runs/red-team corpus/traceability-map/requirement with H4 before prompt-load; stored injection → BLOCK, missing source → fail-closed | [implemented+tested] | `stored-content-scan.sh` (→ `artifact-scan.sh`) | phase-sec26 (5) |
+| SEC-22 | ARCH-06 **trusted-time for `exp`** (clock-skew defeated; file error fail-closed) + ARCH-08 **untrusted-telemetry tag** in self-improve (unsigned metrics → untrusted; enforced apply of an untrusted proposal BLOCKED). ARCH-10 external attestation is an external track (like TIER-2) | [implemented+tested] | `approval-verify.sh`, `self-improve.py` | phase-sec22 (9) |
+| SEC-23 | MT-01/02/03/04 **multi-tenant partition** (Phase 1–5 offline): tenant-store + cross-tenant guard + secure-by-default; per-tenant control-plane settings/audit-chain + telemetry; RBAC data-boundary + casan-harness tenant-scoping; tenant kill-switch + per-tenant cost/quota; **signed tenant registry** (unsigned/tampered/forged → refuse); **per-tenant encryption at rest** (local-key; tenant B cannot read tenant A's plaintext). Only 23.11 (Vault Transit non-exportable) needs infra | [implemented+tested] (offline; 23.11 KMS planned) | `tenant-store.sh`, `tenant-paths.sh`, `tenant-registry-verify.sh`, `tenant-crypt.sh`, `control-plane-settings.py`, `rbac-check.py`, `casan-harness.sh`, `kill-switch.sh`, `cost-spike-detect.sh` | phase-sec23-tenant-store (10), -state-isolation (9), -rbac-tenant (6), -scope (4), -registry-crypt (7) |
+| SEC-24 | SC-05/06 (offline): **image digest-pin lint** (reject floating tags) + **signed/verified CI workflow** (unsigned/tampered/forged → refuse). Live CVE/OSV + real image scan need infra | [partial] | `supply-chain-integrity.sh` | phase-sec24 (8) |
+| SEC-25 | SC-07 (offline): **build-artifact attestation** — sign artifact hash + verify tested==deployed (swap/forged/unsigned → refuse). Signed-commit enrollment + full SLSA chain need CI/key infra | [partial] | `artifact-attest.sh` | phase-sec25 (5) |
+| SEC-24 | SC-04/05/06: SCA + pin runner/base-image + signed workflow | [planned] | — | — |
+| SEC-25 | SC-07: signed commits + SLSA-style attestation | [planned] | — | — |
+| SEC-26 | X-01: scan golden/corpus/map with H4 on prompt-load (stored injection) | [implemented+tested] | `stored-content-scan.sh` | phase-sec26 (5) |
+
 ## 2. Test inventory (all suites)
 
 | Suite | Checks | Purpose |
@@ -94,12 +122,14 @@
 | `phase08-compression-tests.sh` | 9 | **New** — Plan-08 CASAN-native token-killer: dedup/extractive/structural + must-keep preserve + tee raw-passthrough + fail-able must-keep gate + **settings-govern-harness** (compression.enabled) |
 | `phase-control-plane-tests.sh` | 9 | **New** — Plan-13 harness-owned governed settings: deny-by-default + approval gate + versioning/rollback + audit hash-chain tamper detection + effective-setting resolver |
 | `phase-rbac-tests.sh` | 12 | **New** — Plan-14 harness-owned RBAC: deny-by-default + action gating + tenant isolation + sensitive-requires-org-admin + Separation of Duties + IdP-claim→role mapping |
+| `phase-rbac-audit-tests.sh` | 5 | **New** — Plan-14 RBAC decision audit into an H5-style oversight log (ALLOW/DENY recorded, append-only, cross-tenant reason; opt-in `CASAN_RBAC_AUDIT_LOG`) |
 | `phase-rai-tests.sh` | 12 | **New** — Plan-15 harness-owned Responsible AI & Data Governance: data classification + PII→cloud denial without approval + model-card enforcement + retention gate/purge-audit + RAI aggregate report |
 | `phase-selfimprove-tests.sh` | 7 | **New** — Plan-04 self-improve core: telemetry→proposal (dry-run) + apply-requires-approval + governed-store application + sensitive-needs-approval |
 | `phase-governance-report-tests.sh` | 5 | **New** — Plan-09 tie-in: unified governance evidence report (traceability+RBAC+RAI+audit+self-improve) + certified-run gate (tampered audit ⇒ NOT_CERTIFIED) |
 | `phase-preflight-tests.sh` | 5 | **New** — Plan-15/13 enforcement wiring: harness preflight blocks PII→cloud without approval BEFORE the model call; `model-router` honors `CASAN_PREFLIGHT` (opt-in, short-circuits) |
 | `phase-prod-infra-lab-tests.sh` | 2 | **New optional/local-prod** — Docker Compose infra lab starts + verifies Vault/IdP/MinIO/dashboard/alert/billing |
-| **Total** | **280 core + 2 local-prod infra lab** | Baseline 79 preserved; +201 new checks across traceability/compression/control-plane/RBAC/RAI/self-improve/governance-report/preflight (phase10 3→6; phase08 7→9; phase-control-plane 7→9; phase-rbac 10→12; phase-rai 9→12; +7 phase-selfimprove; +5 phase-governance-report; +5 phase-preflight). Full-suite green xác minh trên CI/Mac có Ollama+Docker; các suite deterministic mới verify **trong WSL** (msys+Python Windows lệch path). Preflight wiring là opt-in (`CASAN_PREFLIGHT` default off) ⇒ không đổi luồng model cũ. Direct `phase3-model-router-tests.sh` adds 11/0 including deterministic cloud provider parser coverage; `infra-lab verify` adds 7 internal infra checks. |
+| `phase-sec{01..30}` + `phase-sec23-tenant-store/-state-isolation/-rbac-tenant/-scope/-registry-crypt` + `phase-sec24` + `phase-sec25` (33 suites) | 181 | **New — Plan-16 security-audit remediation P0/P1/P2** (each control has a fail-able adversarial test; wired into `ci-harness-gate.sh`): SEC-01..21 P0/P1/arch controls; trusted-time for JWT exp + untrusted-telemetry tag (SEC-22, ARCH-06/08); **multi-tenant partition (SEC-23 Phase 1–5 offline, MT-01/02/03/04)**; **supply-chain image-pin + signed workflow (SEC-24 offline)**; **build-artifact attestation tested==deployed (SEC-25 offline)**; stored/second-order injection scan (SEC-26); log control-char strip, path-traversal, audit fail-closed, approval-replay nonce (SEC-27..30) |
+| **Total** | **466 core + 2 local-prod infra lab** | Baseline 79 preserved; +206 governance checks (traceability/compression/control-plane/RBAC/RBAC-audit/RAI/self-improve/governance-report/preflight) + **+181 Plan-16 SEC-remediation checks across 33 suites** (all fail-able; SEC-11⊂SEC-17; SEC-22 done ARCH-06/08 — ARCH-10 external; **SEC-23 Phase 1–5 offline done — only 23.11 Vault-KMS planned**; **SEC-24/25 offline slice done — live-CVE/image-scan + signed-commit/SLSA need infra**). Full-suite green verified on CI/Mac with Ollama+Docker; the deterministic new suites verify **in WSL** (msys+Python Windows path skew). Preflight wiring is opt-in (`CASAN_PREFLIGHT` default off). Direct `phase3-model-router-tests.sh` adds 11/0 (3 cases need live Ollama); `infra-lab verify` adds 7 internal infra checks. |
 
 Run order note: `run-casan4-harness-tests.sh` does `rm -rf .specify/logs`, so run it
 **first** and never concurrently with the other suites.