thanhnv
06c404084d
CASAN Supply Chain and Provenance / verify-scan-attest (push) Canceled after 0s
CASAN CI Gate / Frontend Tests (H3 gate) (push) Canceled after 0s
CASAN CI Gate / CASAN Security Gate + Vault KMS (H4/H5) (push) Canceled after 0s
CASAN CI Gate / Build & Deploy OKR → /opt/webapps/okr (push) Canceled after 0s
CASAN Harness CI / harness (push) Canceled after 0s
126 lines
7.0 KiB
JSON
126 lines
7.0 KiB
JSON
{
|
|
"casan_packaging": "level-based source hub",
|
|
"version": "1.0.0",
|
|
"note": "Single source of truth for what each release bundle contains and its maturity. The repo is a source hub holding all levels; releases are SPLIT so downstream adopts only the level it needs. See docs/packaging/CASAN_PACKAGING_PLAN.md.",
|
|
"levels": {
|
|
"core": {
|
|
"level": 1,
|
|
"package_names": ["casan-core", "casan-harness"],
|
|
"status": "implemented",
|
|
"summary": "Minimal H1-H7 production runtime: security/action gates, evidence pack, audit, cost/telemetry, policy/config defaults, adapters, lightweight CLI, native Codex/Claude operator facade, three-dimensional commercial readiness, and a zero-dependency single-project Local Assurance Viewer with H1-H7, H6, history and on-demand export. Source-only tests and Platform helpers are excluded.",
|
|
"target_users": ["governance-harness-only projects", "BJT initial adoption", "CI gate usage"],
|
|
"includes": [
|
|
".codex-plugin",
|
|
".claude-plugin",
|
|
"skills",
|
|
"packages/casan-harness",
|
|
"bin/casan",
|
|
"install.sh",
|
|
"install.ps1",
|
|
"packaging/levels.json",
|
|
"packaging/runtime-layout.json",
|
|
"scripts/copy-runtime.py",
|
|
"VERSION"
|
|
],
|
|
"excludes_globs": [
|
|
"**/__pycache__/**",
|
|
"**/*.pyc",
|
|
"**/.DS_Store",
|
|
"packages/casan-harness/tests/**",
|
|
"packages/casan-harness/level5/**"
|
|
],
|
|
"artifact": "casan-core-v{VERSION}.tar.gz",
|
|
"docker_image": "casan-harness:{VERSION}"
|
|
},
|
|
"devkit": {
|
|
"level": 2,
|
|
"package_names": ["casan-devkit", "casan-project-kit"],
|
|
"status": "implemented",
|
|
"summary": "Level 1 + production adoption commands, project templates, domain-pack scaffold, Gitea workflow templates, and adoption/CI/domain-pack guides.",
|
|
"target_users": ["new projects adopting CASAN", "internal teams needing a repeatable setup"],
|
|
"extends": "core",
|
|
"includes": [
|
|
"packages/casan-devkit",
|
|
"docs/packaging/ADOPTION_GUIDE.md",
|
|
"docs/packaging/CI_GUIDE.md",
|
|
"docs/packaging/DOMAIN_PACK_GUIDE.md",
|
|
"docs/packaging/DOCKER_GUIDE.md",
|
|
"docs/packaging/CASAN_PACKAGING_PLAN.md",
|
|
"docs/packaging/CORE_LOCAL_ASSURANCE_VIEWER.md",
|
|
"docs/packaging/COMMERCIAL_READINESS_CONTRACT.md",
|
|
"scripts/package-release.sh"
|
|
],
|
|
"artifact": "casan-devkit-v{VERSION}.tar.gz"
|
|
},
|
|
"platform": {
|
|
"level": 3,
|
|
"package_names": ["casan-platform", "casan-control-panel"],
|
|
"status": "preview",
|
|
"summary": "Optional productization UI: packaged Control Panel, AgentOps dashboard, Run History, governed settings, approvals, kill-switch, FinOps/SLO, Command Center, Governed Chat MVP and Evidence Pack Viewer. Attack Battery Viewer, Gitea webhook publishing and managed production rollout remain preview work.",
|
|
"target_users": ["teams wanting UI/dashboard/visibility", "demo/training/productization"],
|
|
"extends": "devkit",
|
|
"implemented_components": ["agentops-dashboard", "control-panel monitoring and run history", "governed settings and rollback", "RBAC and approval inbox", "kill-switch", "FinOps/SLO", "Command Center", "Governed Chat read-only/analysis/operator/codegen MVP", "agent/skill/model selection", "Evidence Pack Viewer", "local-prod TLS/OIDC smoke"],
|
|
"pending_components": ["managed production deploy with enterprise IdP/cert/host", "attack-battery-viewer", "gitea-webhook evidence publishing"],
|
|
"includes": [
|
|
"packages/casan-platform",
|
|
"packages/casan-control-panel",
|
|
"packages/casan-harness/scripts/bash/dashboard-server.py",
|
|
"packages/casan-harness/scripts/bash/dashboard-serve.sh",
|
|
"package.json",
|
|
"package-lock.json",
|
|
"Dockerfile.control-panel-api",
|
|
"Dockerfile.control-panel-ui",
|
|
"docker-compose.control-panel.yml",
|
|
"docker-compose.control-panel.local.yml",
|
|
"nginx/control-panel.conf",
|
|
"packaging/control-panel-oauth2-proxy.env.example",
|
|
"infra/local-prod/idp",
|
|
"infra/production",
|
|
"docs/security/CONTROL_PANEL_AUTH_HARDENING.md",
|
|
"docs/packaging/EDITION_FEATURE_LIMITATION_MATRIX.md",
|
|
"docs/jp-poc",
|
|
"docs/commercial/LICENSE_AND_IP_DECISION.md",
|
|
"docs/commercial/THIRD_PARTY_SOFTWARE.json",
|
|
"docs/technical_architecture.md",
|
|
"apps/okr/domain",
|
|
"apps/okr/frontend",
|
|
"apps/okr/backend",
|
|
"apps/service-desk",
|
|
"scripts/smoke-release-artifact.sh"
|
|
],
|
|
"artifact": "casan-platform-preview-v{VERSION}.tar.gz",
|
|
"docker_image": "casan-platform:{VERSION} (preview)"
|
|
},
|
|
"enterprise": {
|
|
"level": 4,
|
|
"package_names": ["casan-enterprise", "casan-governed-console"],
|
|
"status": "future",
|
|
"summary": "Enterprise promotion layer for the already implemented governed console building blocks. The edition remains future until managed deployment, lifecycle operations, legal/compliance deliverables and enterprise support controls are verified.",
|
|
"target_users": ["enterprise/internal platform", "multi-project governance", "official governed AI-SDLC console"],
|
|
"extends": "platform",
|
|
"implemented_components": [
|
|
"RBAC (rbac-check.py)",
|
|
"tenant isolation (tenant-store.sh/tenant-paths.sh/tenant-registry-verify.sh/tenant-crypt.sh)",
|
|
"approval workflow (approval-verify.sh/approval-sign.sh/approval-jwt-mint.py)",
|
|
"KMS (vault-kms.sh)",
|
|
"WORM (worm-ledger.py)",
|
|
"kill-switch (kill-switch.sh)",
|
|
"Governed Chat/Prompt Router/Operator/Codegen MVP (packaged in Platform preview)",
|
|
"Agent/Skill/Model selection MVP (packaged in Platform preview)",
|
|
"Evidence Pack Viewer (packaged in Platform preview)"
|
|
],
|
|
"pending_components": ["managed enterprise deployment evidence", "policy-versioning UI", "HA/DR/SLA", "external security assessment", "commercial support and compliance pack"],
|
|
"includes": ["packages/casan-enterprise"],
|
|
"artifact": "casan-enterprise-preview-v{VERSION}.tar.gz",
|
|
"docker_image": "casan-enterprise:{VERSION} (future)"
|
|
}
|
|
},
|
|
"bundles": {
|
|
"core": {"builds": ["core"], "status": "implemented"},
|
|
"devkit": {"builds": ["core", "devkit"], "status": "implemented"},
|
|
"platform": {"builds": ["core", "devkit", "platform"], "status": "preview"},
|
|
"all-in-one-demo": {"builds": ["core", "devkit", "platform", "apps/okr/domain", "backend", "frontend", "docs/output/casan", "package.json", "package-lock.json", "Dockerfile.backend", "Dockerfile.frontend", "docker-compose.prod.yml"], "status": "implemented", "note": "Full runnable snapshot: harness + OKR app (backend/frontend) + OKR demo domain + latest evidence, for demo/training. The traceability gate needs the app source, so it is bundled here."},
|
|
"enterprise": {"builds": ["enterprise"], "status": "future", "note": "Refused by package-release.sh — Level 4 is structure-only; no fake-complete artifact."}
|
|
}
|
|
}
|