gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
77 Commits 1 Branch 0 Tags
ec261bcbc5795f757704e1e3a03ab4506db423f2
Commit Graph
3 Commits
Author SHA1 Message Date
thanhnvandClaude Opus 4.8 7e998f67c2 feat(h5-h6-hardening): Plan-07 Track A — A4 telemetry integrity, A5 cost controls 
A4 (V9): telemetry-integrity.sh binds provider-usage.jsonl + cost/metrics.jsonl
  to a signed manifest head. Tampering a token flips the head (MISMATCH); an
  attacker who rewrites the head cannot re-sign it (SIGNATURE_INVALID) without
  the off-repo key. sign-audit-head.sh now also signs telemetry (best-effort).
  Supports CASAN_AUDIT_PRIV/PUB overrides for self-contained verification.
A5 (V12/V13/V14): cost-spike-detect.sh adds an absolute per-call cap
  (CASAN_COST_ABSOLUTE_MAX_TOKENS, enforced from record #1 → catches slow-boil
  and cold-start) and a cumulative budget (CASAN_COST_CUMULATIVE_BUDGET_TOKENS →
  catches under-threshold spray), keeping the existing median×mult spike test.
  Backward compatible: <3 records with no caps still exits 3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-03 22:25:00 +09:00
thanhnvandClaude Sonnet 4.6 3e7690fe37 fix(security-gate): resolve tool-calls audit signature key mismatch 
Root cause: tool-audit-lib.sh signs tool-calls-head.sig with a local RSA
key (~/.casan/audit-keys/), but sign-audit-head.sh (called as a CI step)
overwrites audit-public.pem with the Vault KMS public key. On the second
run inside security-gate.sh, the local key still exists so audit-public.pem
is NOT updated, leaving a Vault key vs local-key mismatch that causes
verify-tool-audit.sh to exit 1.

Fix 1 — sign-audit-head.sh: after signing the audit.jsonl chain via Vault
KMS, also re-sign the tool-calls chain head with the same casan-audit-key.
Both chains are now anchored to the same Vault public key in audit-public.pem.

Fix 2 — run-casan4-harness-tests.sh: call sign-audit-head.sh just before
the inline verify-tool-audit.sh check (line 217). This re-signs both chains
with Vault KMS so the inline check sees anchor=signed instead of mismatched
local key vs Vault pub.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-01 20:07:14 +09:00
thanhnvandClaude Sonnet 4.6 9892e82221 feat(wave5): CI/CD pipeline + Vault KMS + OKR deploy to port 80/3001 
Infrastructure (H3 CI gate, H5 KMS):
- Gitea Actions enabled (GITEA__actions__ENABLED=true)
- act_runner: Docker-outside-of-Docker for deploy job
- Vault Transit RSA-2048 signing keys (casan-audit-key, casan-policy-key)

Vault KMS scripts (H5 governance):
- .specify/scripts/bash/vault-kms.sh — sign/verify/pubkey/ensure-key
- .specify/scripts/bash/sign-audit-head.sh — sign audit chain via Vault
- Updated sign-policy-bundle.sh — Vault path + local fallback
- Updated security-gate.sh — KMS gate added (PASS=11 FAIL=0)

OKR app deployment (port 80/3001):
- Dockerfile.backend — node:22-slim (node:sqlite requires Node 22)
- Dockerfile.frontend — node:20-alpine build + nginx:alpine runtime
- nginx/nginx.conf — React SPA + /api/v1/* proxy to okr-backend:3001
- backend/entrypoint.sh — auto init DB on first run + seed
- .dockerignore

CI pipeline (.gitea/workflows/ci.yml):
- Job 1: Vitest frontend tests (H3)
- Job 2: CASAN security gate + Vault KMS signing (H4/H5)
- Job 3: Deploy OKR → port 80 (runs on push to main after tests pass)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-01 12:55:17 +09:00