gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: harden chat state by tenant

Browse Source
This commit is contained in:
thanhnv
2026-07-08 23:38:22 +09:00
parent b3b0544ba8
commit c800f7edf7
20 changed files with 380 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plans/CASAN_BACKLOG_STATUS.md
+1 -1
View File
@@ -61,7 +61,7 @@
| Future B1–B6 | 💤 vision | `CASAN_PLAN_FUTURE_PHASES.md` — approval workflow nâng cao · state machine · model benchmark · governed memory · auto-remediation · platform KPI. |
| **17 Loop Engineering** | � T1–T6 done+test (offline) | **Agentic Loop Governance** — đủ 5 primitive + orchestrator (97/0 WSL, nối CI). T1 **Governor** (`loop-governor.py`; deny-by-default, no/corrupt policy→strict/HALT, on_exceed halt/escalate) 15/0; T2 **Convergence** (`loop-convergence.py`; repeat/thrash→OSCILLATING, flat→STALLED, fail-closed) 15/0; T3 **Verify Contract** (`loop-gate.py`; H4→DENY, unmet→FAIL, correction bounded→ESCALATE, no self-declared DONE) 20/0; T4 **Trace/Replay** (`loop-trace.py`; append-only hash-linked, edited→BREAK, tampered artifact→replay DRIFT) 16/0; T5 **Meta-loop** (`loop-metaloop.py`; propose≠apply, SoD, loosen>org_ceiling refused, apply qua governed CP store→đổi thật ceiling + rollback) 15/0; T6 **Orchestrator** (`loop-run.sh`; gate→governor→convergence→trace/turn, secure-by-default opt-out, nén giữa vòng) 16/0. State qua `CASAN_LOOP_STATE_ROOT` (repo `.specify/state` sạch). **Còn (infra):** T4 KMS-anchor head (A7 Vault), T6 widget Command Center (17.22, C5), live H3-judge. Chi tiết: `CASAN_PLAN_17_LOOP_ENGINEERING.md`. |
| **16 Security audit remediation** | � P0/P1/P2 phần lớn done+test | **Remediation đã thực thi:** 28 SEC suite (151/0 WSL, nối `ci-harness-gate.sh`). Done: SEC-01..10, 12, 13, **14** (model-digest bỏ env-override ở prod/strict), 15, 16..21, **22** (trusted-time JWT `exp` ARCH-06 + tag proposal nguồn-không-tin ARCH-08), **26** (stored/second-order injection scan), 27..30, **23 Phase 1–5 offline** (multi-tenant: tenant-store+guard · per-tenant CP/audit/telemetry · RBAC data-boundary · tenant kill-switch/quota · ký registry · crypt at-rest per-tenant), **24 offline** (image digest-pin + ký workflow), **25 offline** (artifact attestation tested==deployed); **SEC-11 gộp vào SEC-17** (`CASAN_PROFILE=prod` enforce-by-default). **Còn 📋 planned (hạ tầng/process):** SEC-22 ARCH-10 (attestation ngoài) · SEC-23 23.11 (crypt qua Vault Transit) · **SEC-24 còn** (live CVE/OSV + scan image thật — offline image-pin/ký-workflow đã done) · **SEC-25 còn** (signed-commit enrollment + SLSA chain — offline artifact-attestation đã done). Chi tiết: `CASAN_PLAN_16` §0a/§2d. |
| **18 Chat Console** | 🟡 **MVP-0 + MVP-1 + MVP-2 done+test; MVP-3 multi-tenant planned** · target arch còn planned | **Governed Chat Console** (cắt lát MVP chống lan man). **MVP-0 Ask CASAN read-only DONE**: `prompt-mode-router.py`, `chat-readonly.py`, `chat-session.schema.json`, H4 input/output scan, H5 chat audit hash-chain, H6 token telemetry, answer kèm evidence sources. **MVP-1 Operator DONE**: registered actions through `action-gate`, no free-command, action artifacts with provenance. **MVP-2 Track 4 DONE**: `agent-registry.yaml`, `chat-agent-resolver.py`, `chat:select_agent` RBAC, delegation hold, tool allowlist BLOCK, Control Panel agent picker, CODEGEN draft-only through `artifact-scan` + Plan-17 loop certification. **MVP-2 OPERATOR Track 5/6 DONE**: `chat-turn.py` certifies UNCERTIFIED draft through Plan-17 `loop-run.sh` + trace verify/replay before side-effect release. **Track 8.1/8.2 DONE**: `chat-replay.py` verifies chat chain, evidence artifact hash, and OPERATOR/CODEGEN loop replay; Control Panel `GET /api/v1/chat/replay`. **Track 8.3 DONE**: Command Center `chat_loop` widget reads chat audit/replay evidence, loop ticker, budget gauge, and click-through evidence drawer. **Track 8.4 DONE**: `REQUIRES_APPROVAL` chat turns become pending `chat.escalate` approvals, SoD/reason enforced, strict/fake JWT denied before mutation. Test: chat suites **51/0** (`phase-chat-prompt-router` 9/0, `phase-chat-readonly` 5/0, `phase-chat-session-audit` 3/0, `phase-chat-operator` 8/0, `phase-chat-agent-select` 8/0, `phase-chat-pipeline` 4/0, `phase-chat-stream-hold` 2/0, `phase-chat-replay` 4/0, `phase-chat-approval` 4/0, `phase-chat-codegen` 4/0), Control Panel **28/0** + build xanh. Next: MVP-3 multi-tenant. |
| **18 Chat Console** | ✅ **MVP-0 + MVP-1 + MVP-2 + MVP-3 done+test** | **Governed Chat Console** (cắt lát MVP chống lan man). **MVP-0 Ask CASAN read-only DONE**: `prompt-mode-router.py`, `chat-readonly.py`, `chat-session.schema.json`, H4 input/output scan, H5 chat audit hash-chain, H6 token telemetry, answer kèm evidence sources. **MVP-1 Operator DONE**: registered actions through `action-gate`, no free-command, action artifacts with provenance. **MVP-2 Track 4 DONE**: `agent-registry.yaml`, `chat-agent-resolver.py`, `chat:select_agent` RBAC, delegation hold, tool allowlist BLOCK, Control Panel agent picker, CODEGEN draft-only through `artifact-scan` + Plan-17 loop certification. **MVP-2 OPERATOR Track 5/6 DONE**: `chat-turn.py` certifies UNCERTIFIED draft through Plan-17 `loop-run.sh` + trace verify/replay before side-effect release. **Track 8.1/8.2 DONE**: `chat-replay.py` verifies chat chain, evidence artifact hash, and OPERATOR/CODEGEN loop replay; Control Panel `GET /api/v1/chat/replay`. **Track 8.3 DONE**: Command Center `chat_loop` widget reads chat audit/replay evidence, loop ticker, budget gauge, and click-through evidence drawer. **Track 8.4 DONE**: `REQUIRES_APPROVAL` chat turns become pending `chat.escalate` approvals, SoD/reason enforced, strict/fake JWT denied before mutation. **Track 9 DONE**: non-default tenant chat state is partitioned by `tenant-store.sh`, explicit cross-tenant replay paths are denied, encrypted audit snapshots are written via `tenant-crypt.sh`, tenant kill-switch/quota are isolated. Test: chat suites **59/0** (`phase-chat-prompt-router` 9/0, `phase-chat-readonly` 5/0, `phase-chat-session-audit` 3/0, `phase-chat-operator` 8/0, `phase-chat-agent-select` 8/0, `phase-chat-pipeline` 4/0, `phase-chat-stream-hold` 2/0, `phase-chat-replay` 4/0, `phase-chat-approval` 4/0, `phase-chat-codegen` 4/0, `phase-chat-tenant` 8/0), Control Panel **29/0** + build xanh. |
---
## Trần điểm & điều kiện lên "Strong (81+)"
docs/plans/CASAN_PLAN_00_INDEX.md
+1 -1
View File
@@ -35,7 +35,7 @@
| 15 | `CASAN_PLAN_15_RESPONSIBLE_AI_DATA_GOV.md` | Responsible AI & Data Governance (FPT §14.3–14.4) | 📋 |
| 16 | `CASAN_PLAN_16_SECURITY_AUDIT_REMEDIATION.md` | Security audit core harness + kế hoạch vá (tamper-evidence/injection/fail-open) | � P0/P1/P2 done |
| 17 | `CASAN_PLAN_17_LOOP_ENGINEERING.md` | Loop Engineering / Agentic Loop Governance (budget governor, convergence, verify-contract, loop trace/replay, meta-loop) | 📋 |
| 18 | `CASAN_PLAN_18_CHAT_CONSOLE.md` | Governed Chat Console (target arch; **MVP-0 Ask CASAN + MVP-1 Operator + MVP-2 Chat-as-Loop/Agent/Replay done** → multi-tenant) | 🟡 MVP-0/1/2 done |
| 18 | `CASAN_PLAN_18_CHAT_CONSOLE.md` | Governed Chat Console (MVP-0 Ask CASAN + MVP-1 Operator + MVP-2 Chat-as-Loop/Agent/Replay + MVP-3 multi-tenant) | ✅ done+test |
| Future | `CASAN_PLAN_FUTURE_PHASES.md` | Approval workflow, state machine, benchmark, memory, remediation, KPI | 💤 vision |
> **Không có plan số 11:** số 11 được bỏ trống có chủ ý — nhánh eval/traceability đã
docs/plans/CASAN_PLAN_13_NEXT_STEPS.puml
+3 -3
View File
@@ -24,11 +24,11 @@ package "DONE - Plan 13 Control Panel" #E8F5E9 {
component "Loop/Chat widget\nbudget + replay drawer + chat ticker\nextends Command Center contract" as loop_widgets_done #D5F5E3
component "Approvals escalation\nturn ESCALATED -> inbox\nJWT + SoD + reason" as approvals_done #D5F5E3
component "CODEGEN-as-loop\nH4 guarded codegen\nloop-certified artifacts" as codegen_done #D5F5E3
component "Chat multi-tenant hardening\nper-tenant state + quotas + crypto" as chat_mt_done #D5F5E3
}
package "NEXT - offline platform follow-ups" #FFF8E1 {
component "RAI / Data Gov view\nretention + model-card + PII report" as rai #F9E79F
component "Chat multi-tenant hardening\nper-tenant state + quotas + crypto" as chat_mt #F9E79F
}
package "EXTERNAL / MANAGED PROD" #FDEDEC {
@@ -46,10 +46,10 @@ command_done --> gov_core : provenance + audit state
loop_widgets_done --> command_done : specialized widget
approvals_done --> gov_core : proposals + SoD
codegen_done --> gov_core : guarded loop-run
chat_mt_done --> gov_core : tenant boundaries
lead --> rai : next if staying offline
rai --> gov_core : read RAI + policy artifacts
chat_mt --> gov_core : tenant boundaries
managed_oidc ..> local_prod : replace mock IdP/cert
alerts ..> gov_core : route real incidents
@@ -57,7 +57,7 @@ billing ..> command_done : ground-truth FinOps
note right of rai
Recommended next:
1. If no external infra: build RAI view or Plan-18 tenant hardening.
1. If no external infra: build RAI view or next backlog item.
2. If infra is available: promote local-prod OIDC to managed prod.
3. Keep chat widgets on the existing Command envelope.
4. Keep every metric evidence-backed with provenance.
docs/plans/CASAN_PLAN_18_CHAT_CONSOLE.md
+17 -7
View File
@@ -1,6 +1,6 @@
# KẾ HOẠCH 18 — Governed Chat Console (Chat-as-Loop qua Control Plane)
> Status 2026-07-08: **🟡 MVP-0 + MVP-1 + MVP-2 done+test; MVP-3 multi-tenant còn planned.**
> Status 2026-07-08: **✅ MVP-0 + MVP-1 + MVP-2 + MVP-3 done+test.**
> Đã implement **Ask CASAN — Read-only Evidence Assistant** qua harness + Control
> Panel (`/api/v1/chat/ask`, `/chat` UI): Prompt Router deterministic
> `READ_ONLY/OPERATOR/BLOCK/NOT_SUPPORTED`, context whitelist, H4 scan in/out, H5
@@ -15,6 +15,8 @@
> loop certification. **Track 8.1/8.2/8.3/8.4** đã có replay/verify-chain
> foundation, Command Center Chat/Loop widget đọc chat audit/replay evidence thật,
> và escalation vào approvals inbox.
> **Track 9/MVP-3** đã partition chat state theo tenant, guard explicit paths,
> ghi encrypted audit snapshot, và scope kill-switch/quota theo tenant.
> Mục tiêu
> tổng thể vẫn là thêm **cửa sổ chat** vào Control Plane (Plan-13) như một
> **bề mặt tương tác của core harness** — mỗi lượt chat là **một loop-run được
@@ -297,9 +299,9 @@ flowchart TD
### Track 9 — Multi-tenant hardening `[MVP-3]`
| Task | Việc | File | Verify (WSL) |
|---|---|---|---|
| 18.9.1 | tenant-partition state + quyền FS (SEC-23); RBAC ở **cả tầng dữ liệu** | store per-tenant | tenant A không đọc/ghi state B |
| 18.9.2 | per-tenant encrypt at-rest (MT-02) | nối KMS | admin A không đọc audit B |
| 18.9.3 | quota / kill-switch scope theo tenant (MT-03) | nối kill-switch | 1 tenant burn budget không ảnh hưởng tenant khác |
| 18.9.1 | ✅ tenant-partition state + quyền FS (SEC-23); RBAC ở **cả tầng dữ liệu** | `tenant-store.sh` + chat audit/replay paths | tenant A không đọc/ghi state B |
| 18.9.2 | ✅ per-tenant encrypt at-rest (MT-02 offline snapshot) | `tenant-crypt.sh` | admin/tenant B không decrypt audit A |
| 18.9.3 | ✅ quota / kill-switch scope theo tenant (MT-03) | `kill-switch.sh` + `cost-spike-detect.sh` | 1 tenant burn budget không ảnh hưởng tenant khác |
---
@@ -379,12 +381,19 @@ cập nhật tổng test ở `CASAN_HARDENING_STATUS.md`.
- [x] Control Panel `/approvals` can pass an approval JWT for strict review; dev mode remains backward-compatible.
- [x] Verify: `phase-chat-approval` 4/0, `phase-chat-agent-select` 8/0, `phase-chat-replay` 4/0, `console:test` 28/0, `console:build` xanh.
**MVP-3 Track 9 (Multi-tenant hardening):**
- [x] Non-default tenant chat turns write audit/head/agent-binding/metrics/artifacts/loop state under `tenant-store.sh` partitions; default single-tenant path remains backward-compatible.
- [x] `chat-replay.py` and explicit chat audit overrides are guarded by tenant-store, so tenant A cannot point replay at tenant B's audit path.
- [x] Chat audit writes create per-tenant encrypted `.enc` snapshots via `tenant-crypt.sh`; tenant B cannot decrypt tenant A's snapshot.
- [x] Chat entry checks tenant-scoped kill-switch and tenant cost quota before work; tenant A halt/quota does not halt tenant B.
- [x] Verify: `phase-chat-tenant` 8/0, `console:test` 29/0, `console:build` xanh.
**Full (target architecture) — DoD tổng:**
- [ ] Turn chạy **đúng như một loop-run Plan-17** (không định nghĩa vòng lặp riêng).
- [ ] **Không đường vòng:** test chứng minh bỏ bất kỳ gate nào (preflight/verify) → FAIL.
- [ ] Chọn agent/skill qua **RBAC + allowlist**; nâng delegation cần **approval JWT + SoD**.
- [ ] Streaming: side-effect **luôn** sau gate; draft DENY → thu hồi, không tác dụng phụ.
- [ ] Chat state **per-tenant**; test cross-tenant bị chặn ở tầng dữ liệu.
- [x] Chat state **per-tenant**; test cross-tenant bị chặn ở tầng dữ liệu.
- [ ] Turn **replay được** + `verify-chain` phát hiện tamper.
- [ ] API chỉ **bọc** harness (không verdict riêng); UI đọc **artifact thật** + click-to-evidence.
- [ ] Không đụng OKR app; core harness giữ nguyên số test + thêm suite chat.
@@ -392,11 +401,12 @@ cập nhật tổng test ở `CASAN_HARDENING_STATUS.md`.
---
## 7. Ghi chú trung thực & Non-goals (không lan man)
- **[MVP-0 + MVP-1 + MVP-2] — 🟡 done+test.**
- **[MVP-0 + MVP-1 + MVP-2 + MVP-3] — ✅ done+test.**
Ask CASAN read-only, Operator registered actions, agent/skill governance foundation,
CODEGEN draft-as-loop, OPERATOR chat-as-loop/draft-hold, replay/verify-chain foundation,
Command Center Chat/Loop widget, approvals escalation đã có harness CLI + Control Panel
API/UI. Phase multi-tenant production vẫn chưa mở.
API/UI. Multi-tenant chat state, replay guard, encrypted audit snapshot, tenant kill-switch,
và tenant quota đã có test đối kháng.
- **MVP-first (chống lan man):** **MVP-0 (Ask CASAN read-only) KHÔNG phụ thuộc Plan-17/
14/SEC-23** — làm được ngay trên nền H4/H5/H6 hiện có. Chỉ **MVP-2 trở đi** (chat-as-
loop + agent) mới cần Plan-17 (T1–T3) + Plan-14 RBAC; **MVP-3** mới cần SEC-23 tenant.
docs/plans/CASAN_TEAM_ALLOCATION_3DEV.md
+1 -1
View File
@@ -79,7 +79,7 @@ approval JWT thật ([16 SEC-07](CASAN_PLAN_16_SECURITY_AUDIT_REMEDIATION.md)),
| B10 | ✅ **done** — **MVP-1 Operator mode**: registered actions `run tests` / `build pack` / `verify pack`, no free-command, all through `action-gate`, action artifacts with provenance, Control Panel quick actions. `phase-chat-operator` 8/0; total chat suites 24/0; Control Panel 24/0 + build xanh. | [18 Track 3](CASAN_PLAN_18_CHAT_CONSOLE.md) | M | ✅ | done |
| B11 | ✅ **MVP-2 done** — Track 4 Agent/Skill governance + CODEGEN draft-as-loop + OPERATOR Track 5/6 chat-as-loop/draft-hold + Track 8.1/8.2 replay foundation + Track 8.3 Command Center Chat/Loop widget + Track 8.4 approvals escalation. `chat-turn.py` certifies OPERATOR/CODEGEN drafts through Plan-17 `loop-run.sh`; `chat-replay.py` detects evidence artifact drift and chat-chain tamper; `/command` shows chat loop ticker/budget/evidence; delegation escalation creates pending `chat.escalate` approvals. Chat suites 51/0; Control Panel 28/0 + build xanh. | [18 Track 4/5/6/8](CASAN_PLAN_18_CHAT_CONSOLE.md) | L | ✅ | B6, C7(RBAC), B10 |
| B12 | ✅ **done** — Widget Loop/Chat trên Command Center (`chat_loop` widget, loop ticker, budget gauge, replay evidence drawer) | [17 (17.22)](CASAN_PLAN_17_LOOP_ENGINEERING.md) · [18 Track 8](CASAN_PLAN_18_CHAT_CONSOLE.md) | M | ✅ | C5 ✅ baseline |
| B13 | **MVP-3** multi-tenant chat hardening (Track 9) | [18 Track 9](CASAN_PLAN_18_CHAT_CONSOLE.md) | M | 🔗 | A3(SEC-23) |
| B13 | ✅ **done** — MVP-3 multi-tenant chat hardening (Track 9): tenant-partitioned chat state/replay guard, encrypted audit snapshot, tenant kill-switch/quota isolation. `phase-chat-tenant` 8/0; Control Panel tenant replay test included in 29/0. | [18 Track 9](CASAN_PLAN_18_CHAT_CONSOLE.md) | M | ✅ | A3(SEC-23) |
---