diff --git a/casan-next-plans/CASAN_PLAN_00_INDEX.md b/casan-next-plans/CASAN_PLAN_00_INDEX.md index 9e4560a..6ebfe31 100644 --- a/casan-next-plans/CASAN_PLAN_00_INDEX.md +++ b/casan-next-plans/CASAN_PLAN_00_INDEX.md @@ -1,72 +1,114 @@ -# CASAN — Bộ Kế hoạch Chi tiết (Index) - -> Bộ kế hoạch **task-level, CHƯA thực thi** cho việc chuyên nghiệp hoá CASAN Harness. Mỗi file là một mảng độc lập, có thể giao cho người/nhóm khác nhau. -> -> Tài liệu gốc (tổng quan): `CASAN_HARNESS_PACKAGING_PLAN.md`. - -## Danh mục kế hoạch - -| # | File | Mảng | Phụ thuộc | Ưu tiên | -|---|---|---|---|---| -| 01 | `CASAN_PLAN_01_RESTRUCTURE.md` | Tái cấu trúc thư mục Phase 0→6 | — (nền tảng) | Cao | -| 02 | `CASAN_PLAN_02_LLM_SOURCEGEN.md` | Nối LLM thật vào sinh source (thay template) | 01 (một phần), 03 | Cao | -| 03 | `CASAN_PLAN_03_CLOUD_PATCH.md` | Patch cloud/OpenAI (bỏ stub) | — | Cao | -| 04 | `CASAN_PLAN_04_SELFIMPROVE.md` | Khép vòng `casan improve` | 01, 05 | Trung | -| 05 | `CASAN_PLAN_05_CICD.md` | CI/CD + phát hành package | 01 | Trung | -| 06 | `CASAN_PLAN_06_ONBOARD.md` | Onboard dự án thật thứ 2 | 01, 05 | Cao (chứng minh reuse) | -| 07 | `CASAN_PLAN_07_PRODUCTION_HARDENING.md` | Báo cáo production-readiness + vá đường lọt H4/H5/H6 + Track C (ngoài lõi) | — (Track A độc lập) | **Cao (bảo mật)** | - -> **Thứ tự trong Plan-07:** **Track A** (quick wins) → **Track C-MVP** = C1 Tool-authz + C2 Supply-chain + C3 Data-exfil + C6 Sandbox (**minimum bar** trước khi cho agent ghi code/chạy test production-like) → Track B + C-Governance/Ops (production nghiêm túc). -| 08 | `CASAN_PLAN_08_CONTEXT_COMPRESSION.md` | Nén prompt/context giảm token (H1.5 cross-cutting dưới H1/H6) | 01, 07, 03 | Trung (tối ưu, sau Plan-07 core) | -| 09 | `CASAN_PLAN_09_EVIDENCE_PACK.md` | Evidence Pack & Certification (proof pack mỗi run) | nhẹ (gom H1–H7) | **Cao (đúng phương châm)** | -| 10 | `CASAN_PLAN_10_TRACEABILITY_EVAL.md` | Traceability REQ→code→test + H3 Evaluation (gộp ý "11") | 02, 09 | Cao (khác biệt nhất) | -| 12 | `CASAN_PLAN_12_DOMAIN_PACK.md` | Domain Pack SDK — onboard bằng khai báo | 01, 06 | Trung–Cao (reuse thật) | -| — | `CASAN_PLAN_FUTURE_PHASES.md` | Backlog phase sau (B1–B6: approval workflow · state machine · model benchmark · governed memory · auto-remediation · platform KPI) | các plan nền | Vision (chưa làm) | - -## Thứ tự thực thi đề xuất (khi được duyệt) - -```mermaid -flowchart LR - P01["01 Restructure
(nền)"] --> P03["03 Cloud patch"] - P01 --> P05["05 CI/CD"] - P03 --> P02["02 LLM source-gen"] - P05 --> P06["06 Onboard dự án 2"] - P01 --> P06 - P02 --> P04["04 Self-improve"] - P05 --> P04 - P07["07 Hardening
Track A → C-MVP (song song, ưu tiên bảo mật)"] - P07 --> P08["08 Context compression
(sau Plan-07 core)"] - P09["09 Evidence Pack
(đáng làm sớm)"] --> P10["10 Traceability + H3 Eval"] - P01 --> P12["12 Domain Pack SDK"] - P06 --> P12 - - style P01 fill:#d0e8ff,stroke:#2c3e91,stroke-width:2px - style P06 fill:#d0ffd0,stroke:#1e8449 - style P07 fill:#ffd6d6,stroke:#c0392b,stroke-width:2px - style P09 fill:#fff0c0,stroke:#b9770e,stroke-width:2px -``` - -## Quy ước chung mọi file - -- **Nhãn:** [có] tồn tại thật · [demo] mẫu · [mới] cần làm · [chưa tự động] có đo, người quyết. -- **Mốc an toàn:** mọi phase đụng harness phải giữ **35/35 harness + 43/43 adversarial PASS**. -- **Verify:** mỗi task có lệnh kiểm chứng + tiêu chí Done. Không đánh dấu Done nếu chưa xem output. -- **Không bypass:** cấm `--no-verify`, `SKIP_*`, hardcode verdict (đã có `circuit-breaker-check.sh` quét). -- **Đường dẫn tuyệt đối:** script dùng `SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"` để không gãy khi di chuyển. - -## Trạng thái tổng (cập nhật khi chạy) - -| Kế hoạch | Trạng thái | Ghi chú | -|---|---|---| -| 01 Restructure | ⬜ chưa bắt đầu | | -| 02 LLM source-gen | ⬜ chưa bắt đầu | | -| 03 Cloud patch | ⬜ chưa bắt đầu | | -| 04 Self-improve | ⬜ chưa bắt đầu | | -| 05 CI/CD | ⬜ chưa bắt đầu | | -| 06 Onboard | ⬜ chưa bắt đầu | | -| 07 Production hardening | 🟡 Track A ✅ + C-MVP ✅ + H5/H6/deep-gap hardening ✅ (infra prod còn) | **Track A 25/25 · Track C-MVP 29/29 · H5 approval/OIDC 12/12 · infra 7/7 · H6 20/20 · C7/H4/C6 deep-gap closers done**. Điểm công tâm ~81/100; harness thấp nhất 80. Live IdP/JWKS, WORM-store thật, KMS default/HSM, managed alert/billing/dashboard deploy còn [planned]. Chi tiết: `CASAN_HARDENING_STATUS.md` · `evidence/scoring-run-report.md` | -| 08 Context compression | ⬜ chưa bắt đầu | H1.5 cross-cutting; làm **sau** Plan-07 core (nén thêm bề mặt rủi ro) | -| 09 Evidence Pack | 🟢 MVP ✅ (7/7) | `casan pack`/`verify-pack` → `evidence-pack.sh`: 13-file pack incl. traceability matrix + manifest + signed head + certified-run gate, tamper-evident. Chi tiết: `CASAN_HARDENING_STATUS.md` | -| 10 Traceability + H3 Eval | 🟢 MVP ✅ (3/3) | `traceability-matrix.py --gate`: parse FR-xx → code/test matrix; Evidence Pack chứa `traceability-matrix.json`. Còn line/symbol-level + eval-set độc lập. | -| 12 Domain Pack SDK | ⬜ chưa bắt đầu | Cần Plan-01 xong trước | -| Future phases (B1–B6) | 💤 vision | Backlog `CASAN_PLAN_FUTURE_PHASES.md` — chưa xây | +# CASAN — Plan Index & Current Backlog + +> Cap nhat: 2026-07-06. File nay la muc luc trang thai hien tai, khong con la +> danh sach "chua thuc thi" thuần tuy. Chi tiet ban giao nam o +> `CASAN_BACKLOG_STATUS.md`; chi tiet hardening/control nam o +> `CASAN_HARDENING_STATUS.md`. + +## Hien trang ngan gon + +| Nhom | Trang thai | Bang chung | +|---|---|---| +| Plan-07 Production hardening | Core controls da xong; managed prod infra con | 218 core checks PASS / 0 FAIL; local-prod Docker lab PASS | +| Plan-09 Evidence Pack | MVP da xong | `phase3-evidence-pack-tests.sh` 7/7; pack gom ca traceability matrix | +| Plan-10 Traceability | MVP da xong | `phase10-traceability-tests.sh` 3/3 | +| Docker local-prod infra lab | Da xong tren may local/Mac | `phase-prod-infra-lab-tests.sh` 2/2; `infra-lab verify` 7/7 | +| Scoring hien tai | Level 4; diem cong tam quanh 81/100 | H5/H6 con tran vi managed infra that chua co | + +## Danh muc plan + +| # | File | Mang | Trang thai hien tai | Uu tien tiep | +|---|---|---|---|---| +| 01 | `CASAN_PLAN_01_RESTRUCTURE.md` | Tai cau truc thu muc Phase 0-6 | **File chi tiet dang thieu**; cong viec chua lam | Cao, nhung nen lam tren nhanh rieng | +| 02 | `CASAN_PLAN_02_LLM_SOURCEGEN.md` | Noi LLM that vao sinh source thay template | Chua bat dau | Cao sau 03 | +| 03 | `CASAN_PLAN_03_CLOUD_PATCH.md` | Patch cloud/OpenAI/Anthropic, bo stub | **File chi tiet dang thieu**; cong viec chua lam | Cao, can key/provider | +| 04 | `CASAN_PLAN_04_SELFIMPROVE.md` | Khep vong `casan improve` | Chua bat dau | Trung-Cao sau 02/05 | +| 05 | `CASAN_PLAN_05_CICD.md` | CI/CD + release package | **File chi tiet dang thieu**; moi co mot phan runner/deploy | Cao cho release gate | +| 06 | `CASAN_PLAN_06_ONBOARD.md` | Onboard du an that thu 2 | Chua bat dau | Cao de chung minh reuse | +| 07 | `CASAN_PLAN_07_PRODUCTION_HARDENING.md` | H4/H5/H6 + Track C production controls | Core da xong; managed prod infra con | Con T2 infra that | +| 08 | `CASAN_PLAN_08_CONTEXT_COMPRESSION.md` | H1.5 context/token compression | Chua bat dau | Trung, lam sau core stability | +| 09 | `CASAN_PLAN_09_EVIDENCE_PACK.md` | Evidence Pack & certification | MVP da xong; report/badge dep con | Trung | +| 10 | `CASAN_PLAN_10_TRACEABILITY_EVAL.md` | REQ->code->test + H3 eval | MVP da xong; line/symbol-level con | Cao vua | +| 12 | `CASAN_PLAN_12_DOMAIN_PACK.md` | Domain Pack SDK | Chua bat dau | Trung-Cao sau 01/06 | +| Future | `CASAN_PLAN_FUTURE_PHASES.md` | Approval workflow, state machine, benchmark, memory, remediation, KPI | Vision/chua lam | Sau cac plan nen | + +## Da hoan thanh gan day + +| Muc | Ket qua | Verify | +|---|---|---| +| B4 model-digest pinning | Pin digest `ornith:9b`; mismatch BLOCK mac dinh, WARN rollout | `phase3-model-router-tests.sh` 10/10 | +| C4 approval IdP/OIDC MVP | `approval-verify.sh` verify RS256 JWT, role, expiry, request binding; co mock IdP/JWKS | `phase-h5-approval-tests.sh` 12/12 | +| Plan-10 traceability MVP | Parse `FR-*`, map requirement -> code -> test, gate thieu coverage | `phase10-traceability-tests.sh` 3/3 | +| Docker local-prod infra lab | Vault, IdP/JWKS, MinIO Object Lock, dashboard nginx auth, alert webhook, billing API mock | `phase-prod-infra-lab-tests.sh` 2/2; `infra-lab verify` 7/7 | + +## Con chua lam — uu tien cao + +| Uu tien | Viec con lai | Ly do | Buoc dau tien de lam tiep | +|---|---|---|---| +| P1 | Plan-03 Cloud patch/OpenAI/Anthropic | De LLM source-gen va billing telemetry that co y nghia | Tao/bo sung `CASAN_PLAN_03_CLOUD_PATCH.md`; wire `CASAN_MODEL_PRIMARY=openai/anthropic` qua `model-call.py`, test round-trip co key | +| P2 | Plan-02 LLM source-gen dot A | Hien pipeline van sinh artifact bang template deterministic | Dinh contract `generate(step, ctx)` cho `01-srs`/`02-bd`, goi `model-router.sh --role generate`, fallback template | +| P3 | Managed prod infra T2 | Docker lab da chay, nhung chua the claim production Strong | Cau hinh enterprise IdP/JWKS, S3 Object Lock/QLDB, KMS default/HSM, dashboard TLS/OIDC, Slack/PagerDuty, billing API that | +| P4 | Plan-05 CI/CD release gate | Can CI chay tat ca suite va goi package | Tao/bo sung `CASAN_PLAN_05_CICD.md`; them workflow chay 218 core + optional Docker infra lab | +| P5 | Plan-06 onboard project 2 | Chung minh harness reuse that | Chon domain thu 2, tao app/domain data/golden/corpus, dang ky registry, chay `verify-harness-reuse.sh` | + +## Con chua lam — uu tien trung binh + +| Viec | Trang thai | Buoc tiep theo | +|---|---|---| +| Plan-01 restructure | Chua lam; file chi tiet dang thieu | Tao plan chi tiet truoc, sau do tach tren branch rieng; giu 218/0 | +| Plan-08 context compression | Chua lam | Do token baseline; lam extractive/structural compression truoc, scan/audit raw va compressed | +| Plan-10 line/symbol-level traceability | MVP file-level da xong | Them line/symbol refs va dua gate vao CI | +| Plan-09 report/badge/UI | MVP pack da xong | Render HTML one-page + badge "Certified run" khi gate du dieu kien | +| Plan-12 Domain Pack SDK | Chua lam | Lam sau khi co Plan-01/06; dinh schema `domain-pack.yaml` va loader | +| Plan-04 self-improve | Chua lam | Doc telemetry/drift/cost -> sinh proposal dry-run, can approval moi apply | + +## Managed infra con lai, khong nen claim la done production + +| Area | Hien co | Con thieu de production | +|---|---|---| +| IdP/OIDC | Mock IdP/JWKS trong Docker | Enterprise IdP/JWKS, policy/versioning/diff | +| KMS | Vault Transit lab + fallback local | KMS mac dinh, HSM/CloudHSM, token ngan han qua IdP, bo fallback local trong prod | +| WORM audit | Local ledger + MinIO Object Lock lab | S3 Object Lock/QLDB that, trusted timestamp, retention policy | +| Dashboard | Local HTTP + nginx basic auth | Host that, TLS, OIDC/enterprise auth, uptime monitor | +| Alerting | Local webhook + retry/dead-letter | Slack/PagerDuty/managed channel, rota on-call | +| Billing telemetry | Local mock API + reconcile | OpenAI/Anthropic usage API that, keys, schema versioning | +| Sandbox | Docker container isolation | Rootless/nsjail/bubblewrap profile cho Linux CI + hardened base image | + +## Thu tu thuc thi de xuat + +```mermaid +flowchart LR + P03["03 Cloud patch
(provider keys/API)"] --> P02["02 LLM source-gen
dot A-D"] + P02 --> P04["04 Self-improve
proposal + approval"] + P05["05 CI/CD
release gates"] --> P04 + P05 --> P06["06 Onboard project 2"] + P01["01 Restructure
branch rieng"] --> P06 + P01 --> P12["12 Domain Pack SDK"] + P06 --> P12 + P07T2["07 T2 managed infra
IdP/KMS/WORM/alerts/billing"] --> STRONG["Strong claim"] + P10X["10 Traceability++
line/symbol + CI"] --> P05 + P08["08 Compression
sau core"] --> P02 +``` + +## Lenh kiem chung nhanh + +```bash +cd AINative_OKR_CASAN5 +for s in run-casan4-harness adversarial-harness phase1-track-a phase2-track-c \ + phase3-evidence-pack phase-h5-approval phase-h5-infra phase-h6-agentops \ + phase-c7-incident phase-h4-multilingual phase-c6-sandbox phase-h4-split-inject \ + phase10-traceability; do + bash .specify/tests/$s-tests.sh >/dev/null 2>&1 && echo "$s OK" || echo "$s FAIL" +done + +bash .specify/tests/phase-prod-infra-lab-tests.sh +bash .specify/scripts/bash/infra-lab.sh verify +``` + +## Ghi chu cho AI tiep theo + +- `CASAN_BACKLOG_STATUS.md` la handoff chi tiet nhat ve viec con lai. +- `CASAN_HARDENING_STATUS.md` la nguon cho control nao da implemented+tested. +- Khong stage cac file audit log runtime neu chi thay doi do chay verify. +- Backend `npm test` toan repo con blocker cu: Prisma schema MySQL nhung `setup-sqlite.mjs` + ap migration vao SQLite. Day khong phai loi cua cac plan hardening vua lam.