Add local production infra lab

2026-07-06 12:00:27 +09:00
parent ec261bcbc5
commit fc736aabf1
16 changed files with 623 additions and 23 deletions
@@ -21,6 +21,7 @@ set -uo pipefail
 #      CASAN_REVIEWERS_DIR  (default governance/reviewers) — base dir for pubkey-file
 #      CASAN_APPROVAL_JWT   (optional RS256 IdP token)
 #      CASAN_IDP_PUBLIC_KEY (default central-governance/idp-public.pem)
+#      CASAN_IDP_JWKS_URL   (optional OIDC JWKS endpoint; overrides public key)
 # Exit: 0 ok (prints "APPROVAL_OK role=<role>"), 3 deny (reason on stderr), 64 usage.

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -54,7 +55,11 @@ ROLES="$(awk -v a="$ACTION" '$1=="action" && $2==a {print $3; exit}' "$REVIEWERS

 if [[ -n "${CASAN_APPROVAL_JWT:-}" ]]; then
  IDP_PUB="${CASAN_IDP_PUBLIC_KEY:-$GOV_DIR/idp-public.pem}"
-  [[ -f "$IDP_PUB" ]] || deny "idp_pubkey_missing($IDP_PUB)"
+  if [[ -n "${CASAN_IDP_JWKS_URL:-}" ]]; then
+    IDP_PUB="jwks:${CASAN_IDP_JWKS_URL}"
+  else
+    [[ -f "$IDP_PUB" ]] || deny "idp_pubkey_missing($IDP_PUB)"
+  fi
  JWT_OUT="$(
    python3 - "$CASAN_APPROVAL_JWT" "$IDP_PUB" "$APPROVER" "$ROLES" "$ACTION" "$ACTOR" "$INPUT_SHA" <<'PY'
 import base64
@@ -64,6 +69,7 @@ import subprocess
 import sys
 import tempfile
 import time
+import urllib.request

 jwt, pub, approver, roles_csv, action, actor, input_sha = sys.argv[1:8]

@@ -101,13 +107,54 @@ if claims.get("input_sha256") != input_sha:

 sig = b64u_decode(parts[2])
 signing_input = ".".join(parts[:2]).encode()
+
+def der_len(n):
+    if n < 128:
+        return bytes([n])
+    raw = n.to_bytes((n.bit_length() + 7) // 8, "big")
+    return bytes([0x80 | len(raw)]) + raw
+
+def der_tlv(tag, body):
+    return bytes([tag]) + der_len(len(body)) + body
+
+def der_int(n):
+    raw = n.to_bytes((n.bit_length() + 7) // 8, "big") or b"\x00"
+    if raw[0] & 0x80:
+        raw = b"\x00" + raw
+    return der_tlv(0x02, raw)
+
+def jwk_to_pem(jwk):
+    n = int.from_bytes(b64u_decode(jwk["n"]), "big")
+    e = int.from_bytes(b64u_decode(jwk["e"]), "big")
+    rsa_pub = der_tlv(0x30, der_int(n) + der_int(e))
+    alg_id = der_tlv(
+        0x30,
+        der_tlv(0x06, b"\x2a\x86\x48\x86\xf7\x0d\x01\x01\x01") + der_tlv(0x05, b""),
+    )
+    spki = der_tlv(0x30, alg_id + der_tlv(0x03, b"\x00" + rsa_pub))
+    b64 = base64.encodebytes(spki).decode().replace("\n", "")
+    lines = [b64[i:i+64] for i in range(0, len(b64), 64)]
+    return "-----BEGIN PUBLIC KEY-----\n" + "\n".join(lines) + "\n-----END PUBLIC KEY-----\n"
+
+pub_file = pub
 with tempfile.TemporaryDirectory() as td:
    sig_path = os.path.join(td, "sig.bin")
    msg_path = os.path.join(td, "msg.txt")
    open(sig_path, "wb").write(sig)
    open(msg_path, "wb").write(signing_input)
+    if pub.startswith("jwks:"):
+        try:
+            jwks = json.loads(urllib.request.urlopen(pub[len("jwks:"):], timeout=5).read().decode())
+        except Exception:
+            die("jwks_fetch_failed")
+        kid = header.get("kid")
+        keys = [k for k in jwks.get("keys", []) if k.get("kty") == "RSA" and (not kid or k.get("kid") == kid)]
+        if not keys:
+            die("jwks_key_not_found")
+        pub_file = os.path.join(td, "idp-public.pem")
+        open(pub_file, "w", encoding="utf-8").write(jwk_to_pem(keys[0]))
    rc = subprocess.run(
-        ["openssl", "dgst", "-sha256", "-verify", pub, "-signature", sig_path, msg_path],
+        ["openssl", "dgst", "-sha256", "-verify", pub_file, "-signature", sig_path, msg_path],
        stdout=subprocess.DEVNULL,
        stderr=subprocess.DEVNULL,
    ).returncode
@@ -73,6 +73,8 @@ class Handler(BaseHTTPRequestHandler):
    def log_message(self, *args):  # silence per-request stderr noise
        pass

+BIND = os.environ.get("CASAN_DASHBOARD_BIND", "127.0.0.1")
+

 if __name__ == "__main__":
-    HTTPServer(("127.0.0.1", PORT), Handler).serve_forever()
+    HTTPServer((BIND, PORT), Handler).serve_forever()
@@ -0,0 +1,143 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN local production-like infra lab.
+#
+# Usage:
+#   infra-lab.sh start|stop|status|verify|env
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+COMPOSE="$PROJECT_ROOT/infra/local-prod/docker-compose.yml"
+CMD="${1:-status}"
+
+compose() {
+  docker compose -f "$COMPOSE" "$@"
+}
+
+need_docker() {
+  command -v docker >/dev/null 2>&1 || { echo "INFRA_LAB_DOCKER_MISSING" >&2; exit 1; }
+  docker compose version >/dev/null 2>&1 || { echo "INFRA_LAB_COMPOSE_MISSING" >&2; exit 1; }
+}
+
+hash_file() {
+  if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | awk '{print $1}'
+  else shasum -a 256 "$1" | awk '{print $1}'; fi
+}
+
+wait_url() {
+  local url="$1"
+  for _ in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24; do
+    curl -fsS -m 3 "$url" >/dev/null 2>&1 && return 0
+    sleep 2
+  done
+  echo "INFRA_LAB_WAIT_TIMEOUT url=$url" >&2
+  return 1
+}
+
+case "$CMD" in
+  start)
+    need_docker
+    compose up -d --build
+    wait_url "http://127.0.0.1:18200/v1/sys/health" || exit 1
+    wait_url "http://127.0.0.1:18081/healthz" || exit 1
+    wait_url "http://127.0.0.1:19090/minio/health/live" || exit 1
+    wait_url "http://127.0.0.1:19092/healthz" || exit 1
+    wait_url "http://127.0.0.1:19093/healthz" || exit 1
+    wait_url "http://127.0.0.1:18080/healthz" || exit 1
+    echo "INFRA_LAB_STARTED compose=$COMPOSE"
+    ;;
+
+  stop)
+    need_docker
+    compose down
+    echo "INFRA_LAB_STOPPED"
+    ;;
+
+  status)
+    need_docker
+    compose ps
+    ;;
+
+  env)
+    cat <<'EOF'
+export VAULT_ADDR=http://127.0.0.1:18200
+export VAULT_TOKEN=root
+export CASAN_IDP_JWKS_URL=http://127.0.0.1:18081/.well-known/jwks.json
+export CASAN_ALERT_WEBHOOK=http://127.0.0.1:19092/alert
+export CASAN_PROVIDER_USAGE_API=http://127.0.0.1:19093/usage
+export CASAN_DASHBOARD_URL=http://127.0.0.1:18080
+export CASAN_DASHBOARD_AUTH=casan:casan
+export CASAN_MINIO_ENDPOINT=http://127.0.0.1:19090
+export CASAN_MINIO_BUCKET=casan-worm
+EOF
+    ;;
+
+  verify)
+    need_docker
+    PASS=0; FAIL=0
+    pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
+    fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
+
+    wait_url "http://127.0.0.1:18200/v1/sys/health" && pass "Vault dev reachable" || fail "Vault dev unreachable"
+    VAULT_ADDR=http://127.0.0.1:18200 VAULT_TOKEN=root bash "$SCRIPT_DIR/vault-kms.sh" enable-transit >/dev/null 2>&1
+    WORK="$(mktemp -d)"
+    trap 'rm -rf "$WORK"' EXIT
+    printf 'infra-lab-head\n' > "$WORK/head.txt"
+    if VAULT_ADDR=http://127.0.0.1:18200 VAULT_TOKEN=root bash "$SCRIPT_DIR/vault-kms.sh" sign "$WORK/head.txt" "$WORK/head.sig" casan-infra-lab >/dev/null 2>&1 \
+      && VAULT_ADDR=http://127.0.0.1:18200 VAULT_TOKEN=root bash "$SCRIPT_DIR/vault-kms.sh" verify "$WORK/head.txt" "$WORK/head.sig" casan-infra-lab >/dev/null 2>&1; then
+      pass "Vault Transit signs and verifies"
+    else
+      fail "Vault Transit sign/verify failed"
+    fi
+
+    printf 'deploy to production and run database migration\n' > "$WORK/approval.txt"
+    INPUT_SHA="$(hash_file "$WORK/approval.txt")"
+    TOKEN="$(curl -fsS -m 5 -H 'Content-Type: application/json' \
+      -d "{\"sub\":\"oidc-ops\",\"role\":\"ops\",\"action\":\"deploy\",\"actor\":\"alice\",\"input_sha256\":\"$INPUT_SHA\",\"ttl_s\":300}" \
+      http://127.0.0.1:18081/token | python3 -c 'import json,sys; print(json.load(sys.stdin)["access_token"])')" || TOKEN=""
+    if [[ -n "$TOKEN" ]] && CASAN_APPROVAL_JWT="$TOKEN" CASAN_IDP_JWKS_URL="http://127.0.0.1:18081/.well-known/jwks.json" \
+      bash "$SCRIPT_DIR/approval-verify.sh" deploy alice "$WORK/approval.txt" oidc-ops - >/dev/null 2>&1; then
+      pass "Mock OIDC IdP issues JWKS-verifiable approval JWT"
+    else
+      fail "Mock OIDC approval verification failed"
+    fi
+
+    if compose run --rm minio-mc -c 'set -eu; obj="verify-$(date +%s)-$$.txt"; mc alias set local http://minio:9000 casanadmin casanadmin123 >/dev/null; printf verify >/tmp/verify.txt; mc cp /tmp/verify.txt "local/casan-worm/$obj" >/dev/null; out="$(mc retention info "local/casan-worm/$obj")"; case "$out" in *COMPLIANCE*|*Mode*) exit 0;; *) echo "$out" >&2; exit 1;; esac' >/dev/null 2>&1; then
+      pass "MinIO WORM/Object Lock bucket accepts retained object"
+    else
+      fail "MinIO WORM verification failed"
+    fi
+
+    ALERT_FILE="$WORK/alert.json"
+    printf '{"body":{"alert.type":"execution-failed","step.name":"infra-lab"},"resource":{"service.name":"casan"}}\n' > "$ALERT_FILE"
+    if CASAN_AGENTOPS_DIR="$WORK/agentops" CASAN_ALERT_WEBHOOK=http://127.0.0.1:19092/alert bash "$SCRIPT_DIR/alert-dispatch.sh" "$ALERT_FILE" >/dev/null 2>&1 \
+      && curl -fsS http://127.0.0.1:19092/events | grep -q "infra-lab"; then
+      pass "Alert webhook receives live dispatch"
+    else
+      fail "Alert webhook verification failed"
+    fi
+
+    if bash "$SCRIPT_DIR/provider-usage-fetch.sh" http://127.0.0.1:19093/usage "$WORK/provider.jsonl" >/dev/null 2>&1 \
+      && grep -q "provider_api" "$WORK/provider.jsonl"; then
+      pass "Billing API mock imports provider telemetry"
+    else
+      fail "Billing API mock verification failed"
+    fi
+
+    if curl -fsS http://127.0.0.1:18080/healthz | grep -q '"status"' \
+      && curl -fsS -u casan:casan http://127.0.0.1:18080/ | grep -q "AgentOps Dashboard"; then
+      pass "Dashboard served behind nginx basic auth"
+    else
+      fail "Dashboard/nginx verification failed"
+    fi
+
+    echo "INFRA_LAB_VERIFY_SUMMARY PASS=$PASS FAIL=$FAIL"
+    [[ "$FAIL" -eq 0 ]] || exit 1
+    ;;
+
+  *)
+    echo "Usage: infra-lab.sh start|stop|status|verify|env" >&2
+    exit 64
+    ;;
+esac
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN Tier-2 local production-like infra lab tests.
+# Starts Docker Compose if needed, verifies Vault/IdP/MinIO/dashboard/alert/billing.
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+S="$PROJECT_ROOT/.specify/scripts/bash"
+
+PASS=0; FAIL=0; SKIP=0
+pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
+fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
+skip() { echo "SKIP: $1"; SKIP=$((SKIP + 1)); }
+
+if ! command -v docker >/dev/null 2>&1 || ! docker compose version >/dev/null 2>&1; then
+  skip "Docker Compose unavailable"
+  echo "===== PROD INFRA LAB SUMMARY: PASS=$PASS FAIL=$FAIL SKIP=$SKIP ====="
+  exit 0
+fi
+
+if bash "$S/infra-lab.sh" start >/dev/null 2>&1; then
+  pass "local-prod Docker Compose stack starts"
+else
+  fail "local-prod Docker Compose stack failed to start"
+fi
+
+if bash "$S/infra-lab.sh" verify > /tmp/casan-infra-lab-verify.out 2>&1; then
+  pass "local-prod infra lab verification passes"
+else
+  cat /tmp/casan-infra-lab-verify.out
+  fail "local-prod infra lab verification failed"
+fi
+
+echo ""
+echo "===== PROD INFRA LAB SUMMARY: PASS=$PASS FAIL=$FAIL SKIP=$SKIP ====="
+[[ "$FAIL" -eq 0 ]] || exit 1
@@ -0,0 +1,29 @@
+# CASAN Local Production-Like Infra Lab
+
+This Docker Compose stack emulates the external infrastructure needed to move
+CASAN Tier 2 from "needs infra" to locally testable production-like controls.
+
+## Services
+
+| Service | Local URL | Purpose |
+|---|---|---|
+| Vault dev | `http://127.0.0.1:18200` | KMS Transit signing/rotation/non-exportable keys |
+| Mock IdP/OIDC | `http://127.0.0.1:18081` | RS256 JWT + JWKS for approval identity |
+| MinIO | `http://127.0.0.1:19090` | S3-compatible WORM/Object Lock emulation |
+| MinIO Console | `http://127.0.0.1:19091` | Object store admin UI |
+| Alert webhook | `http://127.0.0.1:19092` | Slack/PagerDuty-style webhook emulator |
+| Billing API mock | `http://127.0.0.1:19093/usage` | Provider usage API emulator |
+| Dashboard via nginx | `http://127.0.0.1:18080` | Dashboard behind basic auth (`casan` / `casan`) |
+
+## Commands
+
+```bash
+bash .specify/scripts/bash/infra-lab.sh start
+bash .specify/scripts/bash/infra-lab.sh verify
+bash .specify/scripts/bash/infra-lab.sh env
+bash .specify/scripts/bash/infra-lab.sh stop
+```
+
+This is a lab, not a compliance claim. AWS S3 Object Lock, real enterprise IdP,
+CloudHSM, PagerDuty/Slack, and OpenAI/Anthropic billing APIs still need real
+managed services and credentials before claiming production Strong readiness.
@@ -0,0 +1,140 @@
+name: casan-local-prod
+
+services:
+  vault:
+    image: hashicorp/vault:1.15
+    cap_add:
+      - IPC_LOCK
+    environment:
+      VAULT_DEV_ROOT_TOKEN_ID: root
+      VAULT_DEV_LISTEN_ADDRESS: 0.0.0.0:8200
+    ports:
+      - "18200:8200"
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:8200/v1/sys/health"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+
+  idp:
+    build:
+      context: ./idp
+    environment:
+      CASAN_IDP_PORT: "8080"
+      CASAN_IDP_ISSUER: http://127.0.0.1:18081
+    ports:
+      - "18081:8080"
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=2)"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+
+  minio:
+    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: casanadmin
+      MINIO_ROOT_PASSWORD: casanadmin123
+      MINIO_BROWSER_REDIRECT_URL: http://127.0.0.1:19091
+    ports:
+      - "19090:9000"
+      - "19091:9001"
+    volumes:
+      - minio-data:/data
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:9000/minio/health/live"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+
+  minio-init:
+    image: minio/mc:RELEASE.2025-08-13T08-35-41Z
+    depends_on:
+      minio:
+        condition: service_healthy
+    entrypoint: /bin/sh
+    command:
+      - -c
+      - |
+        set -eu
+        mc alias set local http://minio:9000 casanadmin casanadmin123
+        mc mb --ignore-existing --with-lock local/casan-worm
+        mc retention set --default COMPLIANCE 1d local/casan-worm
+        mc anonymous set none local/casan-worm
+        echo MINIO_WORM_READY bucket=casan-worm mode=COMPLIANCE retention=1d
+
+  minio-mc:
+    image: minio/mc:RELEASE.2025-08-13T08-35-41Z
+    profiles: ["tools"]
+    depends_on:
+      minio:
+        condition: service_healthy
+    entrypoint: /bin/sh
+
+  alert-webhook:
+    build:
+      context: ./mock-http
+    command: ["python", "/app/mock_http.py", "alert"]
+    environment:
+      CASAN_MOCK_PORT: "8080"
+    ports:
+      - "19092:8080"
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=2)"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+
+  billing-api:
+    build:
+      context: ./mock-http
+    command: ["python", "/app/mock_http.py", "billing"]
+    environment:
+      CASAN_MOCK_PORT: "8080"
+    ports:
+      - "19093:8080"
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=2)"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+
+  dashboard:
+    image: python:3.12-slim
+    working_dir: /workspace
+    command: ["python", ".specify/scripts/bash/dashboard-server.py", "8787"]
+    environment:
+      CASAN_DASHBOARD_BIND: 0.0.0.0
+      CASAN_DASHBOARD_STALE_S: "315360000"
+      CASAN_DASHBOARD_METRICS: /workspace/.specify/logs/cost/metrics.jsonl
+      CASAN_DASHBOARD_HTML: /workspace/docs/output/casan/central-agentops-dashboard.html
+      CASAN_DASHBOARD_ALERTS: /workspace/.specify/agentops/alerts.log
+    volumes:
+      - ../..:/workspace:ro
+    expose:
+      - "8787"
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8787/healthz', timeout=2)"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+
+  dashboard-nginx:
+    image: nginx:1.27-alpine
+    depends_on:
+      dashboard:
+        condition: service_healthy
+    ports:
+      - "18080:80"
+    volumes:
+      - ./nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./nginx/htpasswd:/etc/nginx/.htpasswd:ro
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1/healthz"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+
+volumes:
+  minio-data:
@@ -0,0 +1,7 @@
+FROM python:3.12-slim
+
+RUN pip install --no-cache-dir "pyjwt[crypto]==2.10.1"
+WORKDIR /app
+COPY mock_idp.py /app/mock_idp.py
+EXPOSE 8080
+CMD ["python", "/app/mock_idp.py"]
@@ -0,0 +1,94 @@
+#!/usr/bin/env python3
+import json
+import os
+import time
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from urllib.parse import urlparse
+
+import jwt
+from cryptography.hazmat.primitives.asymmetric import rsa
+
+
+PORT = int(os.environ.get("CASAN_IDP_PORT", "8080"))
+ISSUER = os.environ.get("CASAN_IDP_ISSUER", f"http://127.0.0.1:{PORT}")
+KID = "casan-local-prod-idp"
+KEY = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+
+
+def b64u_int(value: int) -> str:
+    raw = value.to_bytes((value.bit_length() + 7) // 8, "big")
+    import base64
+
+    return base64.urlsafe_b64encode(raw).decode().rstrip("=")
+
+
+def jwk():
+    numbers = KEY.public_key().public_numbers()
+    return {
+        "kty": "RSA",
+        "use": "sig",
+        "alg": "RS256",
+        "kid": KID,
+        "n": b64u_int(numbers.n),
+        "e": b64u_int(numbers.e),
+    }
+
+
+class Handler(BaseHTTPRequestHandler):
+    def send_json(self, code, payload):
+        body = json.dumps(payload).encode()
+        self.send_response(code)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_GET(self):  # noqa: N802
+        path = urlparse(self.path).path
+        if path == "/healthz":
+            self.send_json(200, {"status": "ok", "issuer": ISSUER})
+        elif path == "/.well-known/openid-configuration":
+            self.send_json(
+                200,
+                {
+                    "issuer": ISSUER,
+                    "jwks_uri": f"{ISSUER}/.well-known/jwks.json",
+                    "token_endpoint": f"{ISSUER}/token",
+                    "id_token_signing_alg_values_supported": ["RS256"],
+                },
+            )
+        elif path == "/.well-known/jwks.json":
+            self.send_json(200, {"keys": [jwk()]})
+        else:
+            self.send_json(404, {"error": "not_found"})
+
+    def do_POST(self):  # noqa: N802
+        if urlparse(self.path).path != "/token":
+            self.send_json(404, {"error": "not_found"})
+            return
+        size = int(self.headers.get("Content-Length", "0"))
+        try:
+            payload = json.loads(self.rfile.read(size) or b"{}")
+        except json.JSONDecodeError:
+            self.send_json(400, {"error": "invalid_json"})
+            return
+        now = int(time.time())
+        claims = {
+            "iss": ISSUER,
+            "sub": payload.get("sub", "oidc-ops"),
+            "role": payload.get("role", "ops"),
+            "action": payload.get("action", "deploy"),
+            "actor": payload.get("actor", "alice"),
+            "input_sha256": payload.get("input_sha256", ""),
+            "iat": now,
+            "exp": now + int(payload.get("ttl_s", 300)),
+        }
+        token = jwt.encode(claims, KEY, algorithm="RS256", headers={"kid": KID})
+        self.send_json(200, {"access_token": token, "token_type": "Bearer", "expires_in": claims["exp"] - now})
+
+    def log_message(self, *args):
+        pass
+
+
+if __name__ == "__main__":
+    HTTPServer(("0.0.0.0", PORT), Handler).serve_forever()
@@ -0,0 +1,5 @@
+FROM python:3.12-slim
+
+WORKDIR /app
+COPY mock_http.py /app/mock_http.py
+EXPOSE 8080
@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+import json
+import os
+import sys
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from urllib.parse import urlparse
+
+
+MODE = sys.argv[1] if len(sys.argv) > 1 else "alert"
+PORT = int(os.environ.get("CASAN_MOCK_PORT", "8080"))
+EVENTS = []
+
+
+USAGE = [
+    {
+        "provider": "local-prod-mock",
+        "model": "billing-api-emulator",
+        "run_id": "infra-lab-run",
+        "step": "speckit.implement",
+        "input_tokens": 1842,
+        "output_tokens": 936,
+        "total_tokens": 2778,
+        "cost_usd": 0.08334,
+        "latency_ms": 4210,
+        "status": "success",
+    }
+]
+
+
+class Handler(BaseHTTPRequestHandler):
+    def send_json(self, code, payload):
+        body = json.dumps(payload).encode()
+        self.send_response(code)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_GET(self):  # noqa: N802
+        path = urlparse(self.path).path
+        if path == "/healthz":
+            self.send_json(200, {"status": "ok", "mode": MODE, "events": len(EVENTS)})
+        elif MODE == "alert" and path == "/events":
+            self.send_json(200, EVENTS)
+        elif MODE == "billing" and path in ("/usage", "/v1/usage"):
+            self.send_json(200, USAGE)
+        else:
+            self.send_json(404, {"error": "not_found"})
+
+    def do_POST(self):  # noqa: N802
+        if MODE != "alert":
+            self.send_json(404, {"error": "not_found"})
+            return
+        size = int(self.headers.get("Content-Length", "0"))
+        raw = self.rfile.read(size)
+        try:
+            payload = json.loads(raw or b"{}")
+        except json.JSONDecodeError:
+            payload = {"raw": raw.decode(errors="replace")}
+        EVENTS.append(payload)
+        self.send_json(200, {"ok": True, "events": len(EVENTS)})
+
+    def log_message(self, *args):
+        pass
+
+
+if __name__ == "__main__":
+    HTTPServer(("0.0.0.0", PORT), Handler).serve_forever()
@@ -0,0 +1,17 @@
+server {
+  listen 80;
+  server_name _;
+
+  location = /healthz {
+    proxy_pass http://dashboard:8787/healthz;
+  }
+
+  location / {
+    auth_basic "CASAN local-prod dashboard";
+    auth_basic_user_file /etc/nginx/.htpasswd;
+    proxy_pass http://dashboard:8787;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+}
@@ -0,0 +1 @@
+casan:$apr1$bCe9E6jA$7NdeZUhyLMXXWGe9RCCY1/
				`@@ -0,0 +1 @@`
				`casan:$apr1$bCe9E6jA$7NdeZUhyLMXXWGe9RCCY1/`