gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
46 Commits 1 Branch 0 Tags
62004c8725d96caee0c1d792c8808d50282d2d8e
Commit Graph
3 Commits
Author SHA1 Message Date
thanhnvandClaude Sonnet 4.6 3e7690fe37 fix(security-gate): resolve tool-calls audit signature key mismatch 
Root cause: tool-audit-lib.sh signs tool-calls-head.sig with a local RSA
key (~/.casan/audit-keys/), but sign-audit-head.sh (called as a CI step)
overwrites audit-public.pem with the Vault KMS public key. On the second
run inside security-gate.sh, the local key still exists so audit-public.pem
is NOT updated, leaving a Vault key vs local-key mismatch that causes
verify-tool-audit.sh to exit 1.

Fix 1 — sign-audit-head.sh: after signing the audit.jsonl chain via Vault
KMS, also re-sign the tool-calls chain head with the same casan-audit-key.
Both chains are now anchored to the same Vault public key in audit-public.pem.

Fix 2 — run-casan4-harness-tests.sh: call sign-audit-head.sh just before
the inline verify-tool-audit.sh check (line 217). This re-signs both chains
with Vault KMS so the inline check sees anchor=signed instead of mismatched
local key vs Vault pub.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-01 20:07:14 +09:00
Nam Pham Dinh ThanhandClaude Sonnet 4.6 838b2473b6 Wave 4: frontend Vitest tests, H1/H7 fixes, Windows compat (python3→python, MSYS2 path) 
WV4-A: Added 16 Vitest/RTL tests to frontend (jsdom env, fail-before proof verified)
WV4-B: Created 12 stub traces for pipeline retention gap; fixed MSYS2/Python path mismatch in context-validate.sh; run-casan4-harness-tests.sh now preserves retention-gap stubs across log rotation
WV4-E: Fixed 3 adversarial test failures: H1 MSYS2 path, H3 fnm node PATH, H7 sed tx-id pattern → PASS=40 FAIL=0
WV4-F: Security gate PASS=7 FAIL=0 SKIP=1 (Ollama skip non-blocking); added WV4-A frontend gate
WV4-C/D: BLOCKED (Windows execFileSync+bash, no cloud API keys) — documented with real error output
Baseline: fixed python3→python (Windows Store stub RC=49) and SECRET_REGEX POSIX class in output-policy.yaml

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-01 02:23:51 +09:00
thanhnv 07ac1bdcdd update first - 84 2026-06-30 02:21:39 +09:00