CASAN_SCRIPT_2VIDEO.md — tight summary voiceover for just the two demo videos,
one screen each: Video 1 (battery: H4/H5/H6 + chain) and Video 2 (hardening
Track A + C-MVP + Evidence Pack). Strips the per-scene cues/notes/soundbites of
the full narration; keeps the spoken beats and both closers.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
CASAN_VIDEO_NARRATION.md — spoken lines timed to each on-screen scene of
run-all.sh (Video 1) and run-hardening.sh (Video 2). Golden rule: terminal says
WHAT, narrator says WHY — never read the screen. Per-scene ▶cue / 🎙️line / ⏸pause
markers, hero-scene emphasis (A5, B1, B6, D1, chain, HA1, HA4, HE3 money-shot),
clustered narration for fast scenes, delivery notes (tone/pace/verdict timing),
a soundbite bank for judge Q&A, and a duration table (~13-16 min). Aligned with
existing claims: Level 4 proven, AI as optional escalation, sandbox scaffold
honesty, "casan-old wins a demo; casan5 survives production".
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- CASAN_ATTACK_CATALOG.md: one-page visual map of ALL ~38 attack scenes from
run-all.sh (A1-A9, B1-B8, D1-D6, chain) + run-hardening.sh (HA1-7, HC1-4,
HE1-4). Legend for 12 attack directions (input/output/artifact/tool-out/audit/
telemetry/cost/action/supply/exfil/runtime/evidence), a defense-in-depth
diagram, per-scene matrix with control + verdict + AI marker.
- CASAN_ATTACK_PLAYBOOK.md: internal deep-dive — per attack: scenario, why
dangerous, exact blocking mechanism, AI-or-deterministic, verify command +
expected result, threat-model ref. Prominent AI-usage answer: only A3/A8/D4
invoke the model; everything else is deterministic. Semantic AI is an optional
escalation that only ADDS a block, never removes one.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The cloud branch of model-call.py was a stub (cloud_backend_not_implemented,
failed even with a key set); casan-step.mjs gated the judge on a hard-coded
Ollama ping. Wire up the real cloud path so a model can run without Ollama.
- model-call.py: add call_openai() and call_anthropic() (raw urllib, no new
dependency — matches the existing call_ollama). Endpoints hard-pinned to the
SSRF allowlist; keys read from env, never logged. Anthropic sends no
temperature/thinking (rejected as 400 on Opus 4.8/4.7; omitting thinking
keeps the terse one-word classify/judge answer). main() routes by
ollama:/openai:/anthropic: prefix; key-unset still fails closed honestly.
provider-usage.jsonl cost_source is per-backend, keeping ollama's exact
"ollama_local_real_tokens" tag that evidence/tests key on.
- casan-step.mjs: ollamaAvailable() -> modelAvailable() — when
CASAN_MODEL_PRIMARY is a cloud spec with its key set, the judge runs through
the cloud path; otherwise it pings local Ollama as before. Default
(unset CASAN_MODEL_PRIMARY) is unchanged.
- CASAN_MASTER_RUNBOOK.md: update sections 0/1/4/7/8 — cloud is now
implemented (not a stub); keep the honest "untested with a real key" +
CA-cert caveats.
Not verified against a live API key (none available); confirmed key-set makes
a real HTTPS call and key-unset fails closed. Gates unchanged:
security-gate PASS=11 FAIL=0, adversarial PASS=44 FAIL=0.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add REAL=1 to the video-steps demo so attack vectors flow through the real
production entry-point instead of calling sub-scripts directly.
- run-all.sh: REAL=1 feeds each H4 vector (A1/A2/A4/A6/A7 + cross-layer step
1) as the INPUT of an agent step run through casan-harness.sh, so the
BLOCK/PASS verdict is produced by the wrapper itself (H4-in -> H5 -> H6 ->
exec -> H4-out) exactly as when the real pipeline meets malicious input.
After the battery it runs a real pipeline slice (STEP1 okr.srs via
casan-harness.sh -- node casan-step.mjs) and shows audit.jsonl growing by a
real record. An inline inventory documents which vectors intentionally keep
calling a single control directly (artifact-scan, audit tamper/re-forge,
detectors on synthetic telemetry) and why. Default mode (no REAL) unchanged.
- map-live.sh: show the PIPELINE (STEP1) row only under REAL=1, driven by a
mode sidecar file written by run-all.sh.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Hướng A — scorecard.sh (video demo):
- h5_1 approval workflow: hardcode 0 → governance-check deploy live (approval_required)
- h6_2 hallucination rate: hardcode 0 → hallucination-scan phân biệt dirty>clean live
- "N/5 mục" chuyển từ text cứng sang đếm động
- H4/H5/H6 → 100/100 (5/5 gate live), Average 57.9 → 90.0
Hướng B — run-casan-pipeline.mjs:
- fallback: stub 'exit 9' → 'cat /nonexistent' (real failure, nhất quán adversarial T3)
- drift: giữ so fallback-output vs golden (clean run=1.0); năng lực phát hiện
drift thật chứng minh ở adversarial suite
- Full 12-step run verify: H1 CONTEXT_VALID=24, H2 tool-audit records=25 signed,
H5 audit-chain records=22 signed, H6 provider_telemetry per-step thật, H7 rollback real
phase3-real-run-scoring.md: giải thích vì sao scorecard cũ cho H5=60/H6=80
(hardcode), phân biệt scorecard-90 vs re-score-84 (2 mục đích khác nhau).
Verify: adversarial 44/0, security-gate 11/0/0, pipeline 12 steps OK.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
