gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add local production infra lab

Browse Source
This commit is contained in:
thanhnv
2026-07-06 12:00:27 +09:00
parent ec261bcbc5
commit fc736aabf1
16 changed files with 623 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
casan-next-plans/CASAN_HARDENING_STATUS.md
+11 -4
View File
@@ -64,6 +64,12 @@
| B4 | **Model-digest pinning (V16)**: approved Ollama model digest pinned; router verifies live digest before generation/classify/judge; mismatch blocks by default with warn mode for rollout | [implemented+tested] | `model-digest-check.sh`, `model-call.py`, `.specify/security/model-digest.pin` | phase3-model-router (digest cases) |
| Plan-10 | **Traceability REQ→code→test MVP**: parse `FR-*`, require code+test mapping per FR, generate matrix, and include it in Evidence Pack | [implemented+tested] | `traceability-matrix.py`, `.specify/traceability-map.json`, `docs/output/casan/traceability-matrix.json` | phase10-traceability (3) |
### Phase 7 — Local production-like infra lab (Tier-2 emulation) — [implemented+tested]
| Control | Status | Where | Test |
|---|---|---|---|
| Docker Compose lab for Vault KMS, OIDC/JWKS IdP, MinIO Object Lock WORM, dashboard behind nginx basic auth, alert webhook, and provider billing API mock | [implemented+tested] (local-prod emulation; managed prod services still required for Strong claim) | `infra/local-prod/docker-compose.yml`, `infra-lab.sh` | phase-prod-infra-lab (2); `infra-lab verify` internal 7/0 |
## 2. Test inventory (all suites)
| Suite | Checks | Purpose |
@@ -81,7 +87,8 @@
| `phase-c6-sandbox-tests.sh` | 6 | **New** — TRUE container isolation (C6, live via Docker / skip-aware) |
| `phase-h4-split-inject-tests.sh` | 8 | **New** — split-injection assembly scan + classifier-inject (B2) |
| `phase10-traceability-tests.sh` | 3 | **New** — Plan-10 FR→code→test matrix + fail-able missing-test gate |
| **Total** | **218** | Baseline 79 preserved; +139 new hardening/traceability checks. Last full harness run 2026-07-06, 0 fail. Direct `phase3-model-router-tests.sh` adds 10/0 for model-router/digest/cloud/fallback checks. |
| `phase-prod-infra-lab-tests.sh` | 2 | **New optional/local-prod** — Docker Compose infra lab starts + verifies Vault/IdP/MinIO/dashboard/alert/billing |
| **Total** | **218 core + 2 local-prod infra lab** | Baseline 79 preserved; +139 new hardening/traceability checks. Last full harness run 2026-07-06, 0 fail. Direct `phase3-model-router-tests.sh` adds 10/0; `infra-lab verify` adds 7 internal infra checks. |
Run order note: `run-casan4-harness-tests.sh` does `rm -rf .specify/logs`, so run it
**first** and never concurrently with the other suites.
@@ -96,7 +103,7 @@ Run order note: `run-casan4-harness-tests.sh` does `rm -rf .specify/logs`, so ru
| Provider billing-API telemetry | [partial] — API fetch + schema gate + local-vs-provider reconciliation done against a live local endpoint; real OpenAI/Anthropic usage-API calls (needs keys) planned | Phase 5 D2 |
| True runtime isolation | [partial] — real container isolation done + validated live via Docker (C6 phase-6); nsjail/rootless + a hardened base image for CI still planned | Plan-07 C6 (V22) |
| KMS key management (rotation, non-exportable) | [partial] — Vault Transit path implemented + validated live; not yet the default (local-key fallback), no HSM/short-lived IdP tokens | Plan-07 B3 |
| Reviewer approval workflow | [partial] — cryptographic **approval-identity** done (signed reviewer + role) + mock **IdP/OIDC JWT** done; live IdP/JWKS + policy versioning/diff still planned | Plan-07 C4 (V20) |
| Reviewer approval workflow | [partial] — cryptographic **approval-identity** done + Docker mock **IdP/OIDC JWKS** done; enterprise IdP/JWKS + policy versioning/diff still planned | Plan-07 C4 (V20) |
| External append-only (WORM) audit | [partial] — hash-linked local ledger + rollback/tamper detection done; true WORM store (S3 Object Lock/QLDB) + trusted timestamp planned | Plan-07 C5 (V21) |
| Live CVE/OSV scanning wired in | [partial] — availability detected; local denylist authoritative offline | Plan-07 C2 follow-up |
@@ -113,7 +120,7 @@ isolation validated live/skip-aware via Vault dev + Docker). Fair maturity score
dimension closed; **H5 and H6 remain at 80** (their remaining gaps are infra), so the
**lowest harness stays 80** — CASAN **Level 4**, proven by attack. This is **not** full
production readiness: crossing the whole pipeline into "Strong (81+)" still needs the
H5/H6 infra items — live IdP/JWKS, a true WORM store (S3 Object Lock),
KMS-by-default + HSM, a deployed dashboard host + managed alert channel/on-call, and
H5/H6 infra items — enterprise IdP/JWKS, a true WORM store (S3 Object Lock/QLDB),
KMS-by-default + HSM, a deployed dashboard host with TLS/OIDC + managed alert channel/on-call, and
real billing-API telemetry — the [partial]/[planned] rows above and in
`CASAN_PLAN_07_PRODUCTION_HARDENING.md`.