gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Complete CASAN backlog tier 1 controls

Browse Source
This commit is contained in:
thanhnv
2026-07-06 11:31:17 +09:00
parent 571c2b7e80
commit e79d7973fb
22 changed files with 685 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AINative_OKR_CASAN5/.specify/tests/phase3-model-router-tests.sh
+23 -2
View File
@@ -66,7 +66,28 @@ else
pass "no API-key/secret pattern in .specify/logs"
fi
# 6: cloud backend reports unavailable honestly while keys are unset.
# 6: model digest pinning catches a silent model swap, with warn mode available.
PIN="$WORK/model-digest.pin"
CASAN_MODEL_DIGEST_PIN="$PIN" CASAN_MODEL_DIGEST="digest-approved" bash "$SCRIPTS/model-digest-check.sh" pin ornith:9b >/dev/null 2>&1
if CASAN_MODEL_DIGEST_PIN="$PIN" CASAN_MODEL_DIGEST="digest-approved" bash "$SCRIPTS/model-digest-check.sh" verify ornith:9b >/dev/null 2>&1; then
pass "model digest pin verifies approved digest"
else
fail "model digest pin rejected matching digest"
fi
set +e
CASAN_MODEL_DIGEST_PIN="$PIN" CASAN_MODEL_DIGEST="digest-swapped" bash "$SCRIPTS/model-digest-check.sh" verify ornith:9b >/dev/null 2>"$WORK/digest.err"
DRC=$?
CASAN_MODEL_DIGEST_PIN="$PIN" CASAN_MODEL_DIGEST="digest-swapped" CASAN_MODEL_DIGEST_MODE=warn bash "$SCRIPTS/model-digest-check.sh" verify ornith:9b >/dev/null 2>"$WORK/digest-warn.err"
WRC=$?
set -e 2>/dev/null || true
[[ "$DRC" -eq 2 ]] && grep -q "MODEL_DIGEST_MISMATCH" "$WORK/digest.err" \
&& pass "model digest mismatch blocks by default" \
|| fail "model digest mismatch did not block (rc=$DRC)"
[[ "$WRC" -eq 0 ]] && grep -q "MODEL_DIGEST_WARN" "$WORK/digest-warn.err" \
&& pass "model digest mismatch can warn during rollout" \
|| fail "model digest warn mode did not warn cleanly (rc=$WRC)"
# 7: cloud backend reports unavailable honestly while keys are unset.
if [[ -z "${ANTHROPIC_API_KEY:-}" ]]; then
set +e
bash "$ROUTER" "$WORK/s.txt" "$WORK/cloud.json" --role classify --model anthropic:claude-opus-4-8 >/dev/null 2>"$WORK/cloud.err"
@@ -76,7 +97,7 @@ else
skip "cloud-unavailable test (ANTHROPIC_API_KEY is set)"
fi
# 7: deliberate failing primary route -> fallback through the REAL router (not exit 9).
# 8: deliberate failing primary route -> fallback through the REAL router (not exit 9).
if [[ "$TUNNEL_UP" -eq 1 ]]; then
printf 'Return exactly: OK\n' > "$WORK/f.txt"
set +e