gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
51 Commits 1 Branch 0 Tags
7870eb51e40691886538274693ebc00454a7b0a7
Commit Graph
5 Commits
Author SHA1 Message Date
thanhnvandClaude Opus 4.8 c51e0f88a3 feat(track-c-mvp): C1 action gating + C2 supply-chain gate 
C1 (V17) action-gate.sh: gates the ACTION, not just the tool name. Outcome model
  ALLOW/WARN/REQUIRE_APPROVAL/BLOCK. BLOCK on sensitive-file writes (.env, *.pem,
  id_rsa, .github/workflows, .ssh, .aws/credentials, .npmrc) and destructive/
  remote-exec commands (rm -rf /, curl|bash, chmod 777, git push --force);
  REQUIRE_APPROVAL on dependency installs and non-local network egress (clears
  only with an audited CASAN_ACTION_APPROVER). Decisions logged to action-gate.jsonl.
C2 (V18) supply-chain-gate.sh + supply-chain-scan.py: diffs package.json /
  requirements.txt / pom.xml / build.gradle against a baseline (explicit or git
  HEAD). BLOCK on denylisted/known-malicious packages, typosquats (edit-distance 1
  to a known package), and dangerous lifecycle scripts (pre/post/install);
  REQUIRE_APPROVAL on any new dependency. Emits a dep-diff report and records
  which live scanners (npm audit / pip-audit / osv-scanner) are available.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-03 22:51:43 +09:00
thanhnvandClaude Opus 4.8 cf2c42b9fa feat(a6-tests): Plan-07 Track A — A6 benign/FP budget + Phase 1 adversarial suite 
A6: benign-corpus (EN 32 / VI 32 / JA 31 = 95 legit inputs) + redteam-vectors.jsonl
  (12 vectors, 4 critical). benign-fp-report.sh runs the REAL security-check over
  both and enforces the budget: false_positive_rate <= 3%, adversarial block >= 95%,
  CRITICAL block = 100%. Measured on the deterministic layer (semantic OFF) so it
  is reproducible in CI. Current: FP=0.00%, block=100%, critical=100%.
phase1-track-a-tests.sh: 25 adversarial checks covering A1–A6 (homoglyph, zero-width,
  fullwidth, base64/hex, strict fail-closed, tool-output scan, telemetry tamper,
  cost slow-boil/spray/cold-start, FP budget). Kept separate so baseline suites
  (35/35, 44/44) stay untouched. New Phase 1 total: 35 + 44 + 25 = 104 checks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-03 22:46:33 +09:00
Nam Pham Dinh ThanhandClaude Sonnet 4.6 838b2473b6 Wave 4: frontend Vitest tests, H1/H7 fixes, Windows compat (python3→python, MSYS2 path) 
WV4-A: Added 16 Vitest/RTL tests to frontend (jsdom env, fail-before proof verified)
WV4-B: Created 12 stub traces for pipeline retention gap; fixed MSYS2/Python path mismatch in context-validate.sh; run-casan4-harness-tests.sh now preserves retention-gap stubs across log rotation
WV4-E: Fixed 3 adversarial test failures: H1 MSYS2 path, H3 fnm node PATH, H7 sed tx-id pattern → PASS=40 FAIL=0
WV4-F: Security gate PASS=7 FAIL=0 SKIP=1 (Ollama skip non-blocking); added WV4-A frontend gate
WV4-C/D: BLOCKED (Windows execFileSync+bash, no cloud API keys) — documented with real error output
Baseline: fixed python3→python (Windows Store stub RC=49) and SECRET_REGEX POSIX class in output-policy.yaml

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-01 02:23:51 +09:00
thanhnv eaf919e744 Update optimize wave3 (need update wave 4 to wave 8) 2026-07-01 00:02:30 +09:00
thanhnv 07ac1bdcdd update first - 84 2026-06-30 02:21:39 +09:00