feat: plan 18
This commit is contained in:
thanhnv
@@ -61,7 +61,7 @@
|
||||
| Future B1–B6 | 💤 vision | `CASAN_PLAN_FUTURE_PHASES.md` — approval workflow nâng cao · state machine · model benchmark · governed memory · auto-remediation · platform KPI. |
|
||||
| **17 Loop Engineering** | � T1–T6 done+test (offline) | **Agentic Loop Governance** — đủ 5 primitive + orchestrator (97/0 WSL, nối CI). T1 **Governor** (`loop-governor.py`; deny-by-default, no/corrupt policy→strict/HALT, on_exceed halt/escalate) 15/0; T2 **Convergence** (`loop-convergence.py`; repeat/thrash→OSCILLATING, flat→STALLED, fail-closed) 15/0; T3 **Verify Contract** (`loop-gate.py`; H4→DENY, unmet→FAIL, correction bounded→ESCALATE, no self-declared DONE) 20/0; T4 **Trace/Replay** (`loop-trace.py`; append-only hash-linked, edited→BREAK, tampered artifact→replay DRIFT) 16/0; T5 **Meta-loop** (`loop-metaloop.py`; propose≠apply, SoD, loosen>org_ceiling refused, apply qua governed CP store→đổi thật ceiling + rollback) 15/0; T6 **Orchestrator** (`loop-run.sh`; gate→governor→convergence→trace/turn, secure-by-default opt-out, nén giữa vòng) 16/0. State qua `CASAN_LOOP_STATE_ROOT` (repo `.specify/state` sạch). **Còn (infra):** T4 KMS-anchor head (A7 Vault), T6 widget Command Center (17.22, C5), live H3-judge. Chi tiết: `CASAN_PLAN_17_LOOP_ENGINEERING.md`. |
|
||||
| **16 Security audit remediation** | � P0/P1/P2 phần lớn done+test | **Remediation đã thực thi:** 28 SEC suite (151/0 WSL, nối `ci-harness-gate.sh`). Done: SEC-01..10, 12, 13, **14** (model-digest bỏ env-override ở prod/strict), 15, 16..21, **22** (trusted-time JWT `exp` ARCH-06 + tag proposal nguồn-không-tin ARCH-08), **26** (stored/second-order injection scan), 27..30, **23 Phase 1–5 offline** (multi-tenant: tenant-store+guard · per-tenant CP/audit/telemetry · RBAC data-boundary · tenant kill-switch/quota · ký registry · crypt at-rest per-tenant), **24 offline** (image digest-pin + ký workflow), **25 offline** (artifact attestation tested==deployed); **SEC-11 gộp vào SEC-17** (`CASAN_PROFILE=prod` enforce-by-default). **Còn 📋 planned (hạ tầng/process):** SEC-22 ARCH-10 (attestation ngoài) · SEC-23 23.11 (crypt qua Vault Transit) · **SEC-24 còn** (live CVE/OSV + scan image thật — offline image-pin/ký-workflow đã done) · **SEC-25 còn** (signed-commit enrollment + SLSA chain — offline artifact-attestation đã done). Chi tiết: `CASAN_PLAN_16` §0a/§2d. |
|
||||
| **18 Chat Console** | ✅ **MVP-0 + MVP-1 + MVP-2 + MVP-3 done+test** | **Governed Chat Console** (cắt lát MVP chống lan man). **MVP-0 Ask CASAN read-only DONE**: `prompt-mode-router.py`, `chat-readonly.py`, `chat-session.schema.json`, H4 input/output scan, H5 chat audit hash-chain, H6 token telemetry, answer kèm evidence sources. **MVP-1 Operator DONE**: registered actions through `action-gate`, no free-command, action artifacts with provenance. **MVP-2 Track 4 DONE**: `agent-registry.yaml`, `chat-agent-resolver.py`, `chat:select_agent` RBAC, delegation hold, tool allowlist BLOCK, Control Panel agent picker, CODEGEN draft-only through `artifact-scan` + Plan-17 loop certification. **MVP-2 OPERATOR Track 5/6 DONE**: `chat-turn.py` certifies UNCERTIFIED draft through Plan-17 `loop-run.sh` + trace verify/replay before side-effect release. **Track 8.1/8.2 DONE**: `chat-replay.py` verifies chat chain, evidence artifact hash, and OPERATOR/CODEGEN loop replay; Control Panel `GET /api/v1/chat/replay`. **Track 8.3 DONE**: Command Center `chat_loop` widget reads chat audit/replay evidence, loop ticker, budget gauge, and click-through evidence drawer. **Track 8.4 DONE**: `REQUIRES_APPROVAL` chat turns become pending `chat.escalate` approvals, SoD/reason enforced, strict/fake JWT denied before mutation. **Track 9 DONE**: non-default tenant chat state is partitioned by `tenant-store.sh`, explicit cross-tenant replay paths are denied, encrypted audit snapshots are written via `tenant-crypt.sh`, tenant kill-switch/quota are isolated. Test: chat suites **59/0** (`phase-chat-prompt-router` 9/0, `phase-chat-readonly` 5/0, `phase-chat-session-audit` 3/0, `phase-chat-operator` 8/0, `phase-chat-agent-select` 8/0, `phase-chat-pipeline` 4/0, `phase-chat-stream-hold` 2/0, `phase-chat-replay` 4/0, `phase-chat-approval` 4/0, `phase-chat-codegen` 4/0, `phase-chat-tenant` 8/0), Control Panel **29/0** + build xanh. |
|
||||
| **18 Chat Console** | ✅ **MVP-0 + MVP-1 + MVP-2 + MVP-3 + Track M done+test** | **Governed Chat Console** (cắt lát MVP chống lan man). **MVP-0 Ask CASAN read-only DONE**: `prompt-mode-router.py`, `chat-readonly.py`, `chat-session.schema.json`, H4 input/output scan, H5 chat audit hash-chain, H6 token telemetry, answer kèm evidence sources. **MVP-1 Operator DONE**: registered actions through `action-gate`, no free-command, action artifacts with provenance. **MVP-2 Track 4 DONE**: `agent-registry.yaml`, `chat-agent-resolver.py`, `chat:select_agent` RBAC, delegation hold, tool allowlist BLOCK, Control Panel agent picker, CODEGEN draft-only through `artifact-scan` + Plan-17 loop certification. **MVP-2 OPERATOR Track 5/6 DONE**: `chat-turn.py` certifies UNCERTIFIED draft through Plan-17 `loop-run.sh` + trace verify/replay before side-effect release. **Track 8.1/8.2 DONE**: `chat-replay.py` verifies chat chain, evidence artifact hash, and OPERATOR/CODEGEN loop replay; Control Panel `GET /api/v1/chat/replay`. **Track 8.3 DONE**: Command Center `chat_loop` widget reads chat audit/replay evidence, loop ticker, budget gauge, and click-through evidence drawer. **Track 8.4 DONE**: `REQUIRES_APPROVAL` chat turns become pending `chat.escalate` approvals, SoD/reason enforced, strict/fake JWT denied before mutation. **Track 9 DONE**: non-default tenant chat state is partitioned by `tenant-store.sh`, explicit cross-tenant replay paths are denied, encrypted audit snapshots are written via `tenant-crypt.sh`, tenant kill-switch/quota are isolated. Test: chat suites **59/0** (`phase-chat-prompt-router` 9/0, `phase-chat-readonly` 5/0, `phase-chat-session-audit` 3/0, `phase-chat-operator` 8/0, `phase-chat-agent-select` 8/0, `phase-chat-pipeline` 4/0, `phase-chat-stream-hold` 2/0, `phase-chat-replay` 4/0, `phase-chat-approval` 4/0, `phase-chat-codegen` 4/0, `phase-chat-tenant` 8/0), Control Panel **29/0** + build xanh. **Track M (2026-07-09) DONE**: model-optional grounded synthesis — read-only Ask CASAN tổng hợp câu trả lời tự nhiên có citations qua `model-router.sh` khi `CASAN_CHAT_MODEL_MODE=model` (config `model-providers.yaml`), offline-first (mặc định deterministic), fail-safe fallback, cloud→ép preflight PII-guard, model output vẫn qua H4 (secret→DENY), H6 real token/cost. `phase-chat-model-synthesis` **7/0** (chat suites **66/0**), nối `ci-harness-gate.sh`, UI badge model/deterministic. **Uplift items 1–5 (2026-07-09b) DONE**: (1) ANALYSIS mode reasoning/compare; (2) multi-turn memory per-chat/tenant nén Plan-08; (3) streaming draft UNCERTIFIED→final (API `/chat/ask/stream` + UI toggle); (4) CODEGEN full model-router draft (artifact-scan + loop-cert); (5) `chat-cloud-smoke.sh` (SKIP nếu thiếu key). `phase-chat-advanced` **8/0**, chat suites **74/0**. Còn: cloud live-smoke với key thật; token-level SSE (hiện 2-pha). |
|
||||
---
|
||||
|
||||
## Trần điểm & điều kiện lên "Strong (81+)"
|
||||
|
||||
@@ -1,5 +1,33 @@
|
||||
# KẾ HOẠCH 18 — Governed Chat Console (Chat-as-Loop qua Control Plane)
|
||||
|
||||
> Status 2026-07-09b: **✅ Chat capability uplift (items 1–5) done+test.**
|
||||
> **(1) ANALYSIS mode**: router phân loại ý định suy luận/so sánh (`analyze/compare/
|
||||
> evaluate/trade-off…`) → `ANALYSIS` (read-only, no side-effect), synthesis dùng
|
||||
> prompt lập luận `role=analysis`. **(2) Multi-turn memory**: `chat-readonly.load_history`
|
||||
> dựng lại lịch sử **per-chat/per-tenant** từ H5 audit (chỉ preview đã H4-scan, không
|
||||
> raw msg), nén qua Plan-08 `context-compress`, nạp vào prompt; cross-chat/cross-tenant
|
||||
> không rò. **(3) Streaming**: `ask --stream` phát NDJSON 2 pha — draft `UNCERTIFIED`
|
||||
> (deterministic, whitelist-only, no side-effect) rồi final certified; injection → deny
|
||||
> trước khi có draft. Control Panel: `POST /api/v1/chat/ask/stream` (spawn NDJSON) + UI
|
||||
> toggle Stream + draft banner. **(4) CODEGEN full model-router**: `chat-turn._model_codegen_body`
|
||||
> sinh code qua `model-router.sh` (offline-first, fallback scaffold), vẫn artifact-scan +
|
||||
> loop-cert, draft-only; injection trong code sinh → artifact-scan BLOCK. **(5) Cloud
|
||||
> live-smoke**: `chat-cloud-smoke.sh` chạy synthesis cloud thật khi có key, SKIP khi
|
||||
> không (không nằm trong unit gate). Test: `phase-chat-advanced` **8/0** + `phase-chat-model-synthesis`
|
||||
> **7/0**; toàn bộ chat suites **74/0 (WSL)**, nối `ci-harness-gate.sh`; Control Panel TS sạch.
|
||||
>
|
||||
> Status 2026-07-09: **✅ Track M (Model Provider Binding) — model-optional grounded synthesis done+test.**
|
||||
> Read-only Ask CASAN giờ tổng hợp câu trả lời tự nhiên **có trích dẫn** khi
|
||||
> `CASAN_CHAT_MODEL_MODE=model` (RAG: whitelist sources → `model-router.sh --role
|
||||
> generate`), giữ **offline-first**: mặc định/CI vẫn deterministic (không phụ thuộc
|
||||
> model). Fail-SAFE: model lỗi/không sẵn sàng → fallback deterministic, không crash,
|
||||
> không bịa. Cloud provider → ép `CASAN_PREFLIGHT=1` (PII→cloud guard). Model output
|
||||
> vẫn qua H4 output scan (secret → DENY fail-closed). H6 ghi real token + provider
|
||||
> cost_source. Config: `packages/casan-harness/config/model-providers.yaml`. Test
|
||||
> `phase-chat-model-synthesis` **7/0 (WSL)**, nối `ci-harness-gate.sh`; UI `/chat`
|
||||
> hiện badge `model:<provider>`/`deterministic`. **Còn:** ANALYSIS synthesis + multi-turn
|
||||
> memory + streaming read-only + CODEGEN full model-router path + cloud live-smoke (key thật).
|
||||
>
|
||||
> Status 2026-07-08: **✅ MVP-0 + MVP-1 + MVP-2 + MVP-3 done+test.**
|
||||
> Đã implement **Ask CASAN — Read-only Evidence Assistant** qua harness + Control
|
||||
> Panel (`/api/v1/chat/ask`, `/chat` UI): Prompt Router deterministic
|
||||
@@ -246,10 +274,10 @@ flowchart TD
|
||||
### Track M — Model Provider Binding `[MVP-0 tối thiểu → lớn dần]`
|
||||
| Task | Việc | File | Verify (WSL) |
|
||||
|---|---|---|---|
|
||||
| 18.M.1 | `provider_id` per agent + `model_role` per skill; routing theo mode (nối Plan-03/02) | mới `config/model-providers.yaml` | mode → provider đúng |
|
||||
| 18.M.2 | Data policy `local/internal/cloud`: **PII/secret → cloud phải qua C3 guard** | nối `data-exfil-guard.sh` (C3) | PII→cloud không guard → BLOCK |
|
||||
| 18.M.3 | Credential ngoài repo (env/secret store), không commit | nối `secrets-scan.sh` | key trong repo → scan FAIL |
|
||||
| 18.M.4 | Provider-call audit + token/cost telemetry → H6 | nối H6 | mỗi call → có bản ghi cost |
|
||||
| 18.M.1 | ✅ `provider_id`/`model_role` binding + routing theo role; synthesis gọi `model-router.sh --role generate` | `config/model-providers.yaml` + `chat-readonly.py synthesize_answer` | `phase-chat-model-synthesis`: model mode → provider `local`, answer có citations |
|
||||
| 18.M.2 | 🟡 Data policy `local/internal/cloud`: cloud → ép `CASAN_PREFLIGHT=1` (harness-preflight PII→cloud C3). Live cloud test cần key thật | nối `harness-preflight.sh` | offline: model output secret → H4 output scan DENY fail-closed (test 5) |
|
||||
| 18.M.3 | ✅ Credential ngoài repo: chỉ `key_env` name trong config, key đọc từ env qua `model-call.py`; cloud key unset → fallback deterministic (không bịa) | `model-providers.yaml` + `model-call.py` | key unset → `reason=cloud_key_unset` |
|
||||
| 18.M.4 | ✅ Provider token/cost telemetry → H6: real `input/output_tokens` + `cost_source` per backend + `synthesis_mode` | `chat-readonly.py record_metrics` | test: H6 metric `ollama_local_real_tokens`, tokens 42/17 |
|
||||
|
||||
### Track 3 — Operator mode (registered actions) `[MVP-1]`
|
||||
| Task | Việc | File | Verify (WSL) |
|
||||
|
||||
Reference in New Issue
Block a user