Update optimize wave3 (need update wave 4 to wave 8)

2026-07-01 00:02:30 +09:00
parent 07ac1bdcdd
commit eaf919e744
140 changed files with 3780 additions and 844 deletions
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN WP-S8 — one-command security gate.
+# Runs the security-relevant harness checks and prints a single aggregate
+# verdict. Live-model checks SKIP (not fail) when the Ollama tunnel is down.
+# Exit: 0 all required gates green, 1 a required gate failed.
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PASS=0; FAIL=0; SKIP=0
+run() {  # <name> <command...>
+  local name="$1"; shift
+  if "$@" >/dev/null 2>&1; then echo "  GATE PASS  $name"; PASS=$((PASS+1));
+  else echo "  GATE FAIL  $name"; FAIL=$((FAIL+1)); fi
+}
+
+echo "== CASAN security gate =="
+run "run-casan4 harness suite"      bash "$ROOT/.specify/tests/run-casan4-harness-tests.sh"
+run "adversarial suite"             bash "$ROOT/.specify/tests/adversarial-harness-tests.sh"
+run "audit hash-chain (signed)"     bash "$ROOT/.specify/scripts/bash/verify-audit-chain.sh"
+run "tool-call audit (signed)"      bash "$ROOT/.specify/scripts/bash/verify-tool-audit.sh"
+# Wave 3 additions
+run "secrets scan (WP-S4)"         bash "$ROOT/.specify/scripts/bash/secrets-scan.sh"
+run "no-bypass + circuit breaker"  bash "$ROOT/.specify/scripts/bash/circuit-breaker-check.sh"
+
+if curl -sS -m 5 http://127.0.0.1:11434/api/tags >/dev/null 2>&1; then
+  run "model router tests"          bash "$ROOT/.specify/tests/phase3-model-router-tests.sh"
+  run "red-team H4 metrics (30 samples)"  bash "$ROOT/.specify/tests/phase3-redteam-metrics.sh"
+  run "judge gate tests (WP-B)"    bash "$ROOT/.specify/tests/phase3-judge-gate-tests.sh"
+else
+  echo "  GATE SKIP  model router + red-team + judge-gate (Ollama tunnel down)"; SKIP=$((SKIP+1))
+fi
+
+echo "== verdict: PASS=$PASS FAIL=$FAIL SKIP=$SKIP =="
+[[ "$FAIL" -eq 0 ]] || exit 1