CASAN

39 Commits 1 Branch 0 Tags

3 Commits

Include renames

Author SHA1 Message Date

Author	SHA1	Message	Date
thanhnvandClaude Opus 4.8	82011a0c67	fix(ci): eliminate audit-signature flake + self-heal deploy docker access Two comprehensive CI fixes: 1. Adversarial harness flake (PASS=42 FAIL=2, state-dependent): governance-check.sh re-exported audit-public.pem only when GENERATING a new signing key. On a CI runner where the off-repo private key PERSISTS across runs, the checked-out (Vault-signed) audit-public.pem drifted out of sync with the local re-signing key, so verify-audit-chain.sh rejected a genuine head ("H5/H2 verifies the genuine signed chain"). Now always re-export the public key matching the signing key — mirrors the same fix already applied to tool-audit-lib.sh (`c31987c`). Reproduced the exact FAIL=2 locally with a drifted persisted key; now deterministically 44/44. 2. Deploy docker.sock permission denied: Added a self-healing preflight to deploy-okr that ensures the deploy user is in the docker group on the web VPS (idempotent, passwordless sudo) and proves a fresh SSH session can reach the daemon before streaming images. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-01 21:44:20 +09:00
Nam Pham Dinh ThanhandClaude Sonnet 4.6	838b2473b6	Wave 4: frontend Vitest tests, H1/H7 fixes, Windows compat (python3→python, MSYS2 path) WV4-A: Added 16 Vitest/RTL tests to frontend (jsdom env, fail-before proof verified) WV4-B: Created 12 stub traces for pipeline retention gap; fixed MSYS2/Python path mismatch in context-validate.sh; run-casan4-harness-tests.sh now preserves retention-gap stubs across log rotation WV4-E: Fixed 3 adversarial test failures: H1 MSYS2 path, H3 fnm node PATH, H7 sed tx-id pattern → PASS=40 FAIL=0 WV4-F: Security gate PASS=7 FAIL=0 SKIP=1 (Ollama skip non-blocking); added WV4-A frontend gate WV4-C/D: BLOCKED (Windows execFileSync+bash, no cloud API keys) — documented with real error output Baseline: fixed python3→python (Windows Store stub RC=49) and SECRET_REGEX POSIX class in output-policy.yaml Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-01 02:23:51 +09:00
thanhnv	07ac1bdcdd	update first - 84	2026-06-30 02:21:39 +09:00

thanhnvandClaude Opus 4.8

82011a0c67

fix(ci): eliminate audit-signature flake + self-heal deploy docker access

Two comprehensive CI fixes:

1. Adversarial harness flake (PASS=42 FAIL=2, state-dependent):
   governance-check.sh re-exported audit-public.pem only when GENERATING a
   new signing key. On a CI runner where the off-repo private key PERSISTS
   across runs, the checked-out (Vault-signed) audit-public.pem drifted out
   of sync with the local re-signing key, so verify-audit-chain.sh rejected a
   genuine head ("H5/H2 verifies the genuine signed chain"). Now always
   re-export the public key matching the signing key — mirrors the same fix
   already applied to tool-audit-lib.sh (c31987c). Reproduced the exact
   FAIL=2 locally with a drifted persisted key; now deterministically 44/44.

2. Deploy docker.sock permission denied:
   Added a self-healing preflight to deploy-okr that ensures the deploy user
   is in the docker group on the web VPS (idempotent, passwordless sudo) and
   proves a fresh SSH session can reach the daemon before streaming images.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-01 21:44:20 +09:00

Nam Pham Dinh ThanhandClaude Sonnet 4.6

838b2473b6

Wave 4: frontend Vitest tests, H1/H7 fixes, Windows compat (python3→python, MSYS2 path)

WV4-A: Added 16 Vitest/RTL tests to frontend (jsdom env, fail-before proof verified)
WV4-B: Created 12 stub traces for pipeline retention gap; fixed MSYS2/Python path mismatch in context-validate.sh; run-casan4-harness-tests.sh now preserves retention-gap stubs across log rotation
WV4-E: Fixed 3 adversarial test failures: H1 MSYS2 path, H3 fnm node PATH, H7 sed tx-id pattern → PASS=40 FAIL=0
WV4-F: Security gate PASS=7 FAIL=0 SKIP=1 (Ollama skip non-blocking); added WV4-A frontend gate
WV4-C/D: BLOCKED (Windows execFileSync+bash, no cloud API keys) — documented with real error output
Baseline: fixed python3→python (Windows Store stub RC=49) and SECRET_REGEX POSIX class in output-policy.yaml

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-01 02:23:51 +09:00

thanhnv 07ac1bdcdd update first - 84 2026-06-30 02:21:39 +09:00