thanhnvandClaude Opus 4.8
3432ae59e1
- SEC-07 (M-08): real approval verification via approval-verify.sh in enforced mode (CASAN_PROFILE=prod / CASAN_APPROVAL_STRICT=1) for control-plane `set` (sensitive keys), kill-switch `clear`, and self-improve (inherits control-plane). A bare or forged approval string is now denied; dev mode stays backward-compatible. - SEC-10 (M-05): non-spoofable agent identity. tool-registry-gate least-privilege no longer trusts CASAN_AGENT env in enforced mode (CASAN_IDENTITY_STRICT=1) — the caller must present a signed token (agent-identity-sign.sh) bound to agent id + run id, verified against agent-identities.registry. Blocks env spoofing + replay. Verify: SEC+integrity gate 18/0, run-casan4 0-FAIL, adversarial 44/44 (H2 intact), control-plane 9/0, h5-approval 12/0, c7-incident 15/0, self-improve 7/0, track-c 29/0. Plan-16 P0 + P1 now complete; remaining: P2 (SEC-12/13/14/15/22..30). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
23 lines
1.1 KiB
Plaintext
23 lines
1.1 KiB
Plaintext
# CASAN Plan-16 SEC-10 — agent-identity registry (non-spoofable least-privilege).
|
|
#
|
|
# tool-registry-gate.sh least-privilege used to trust CASAN_AGENT (a plain env var
|
|
# anyone can set). Under CASAN_PROFILE=prod (or CASAN_IDENTITY_STRICT=1) the caller
|
|
# must instead present a signed token proving it is that agent — verified against
|
|
# one of the PUBLIC keys below. Private keys live OFF-REPO (with the agent runner /
|
|
# issued by an IdP); only public keys are provisioned here (same policy as the audit
|
|
# and reviewer signing keys).
|
|
#
|
|
# Line format (no yaml dependency):
|
|
# agent <agent-id> <pubkey-file> # pubkey-file relative to the agents/ dir
|
|
#
|
|
# Token minted with: agent-identity-sign.sh <agent-id> <run-id> <priv> <sig-out>
|
|
# Presented via: CASAN_AGENT=<id> CASAN_AGENT_SIG=<sig> CASAN_RUN_ID=<run>
|
|
#
|
|
# NOTE: pubkeys under agents/ are provisioned out-of-band by ops. Until then,
|
|
# enforced mode fails CLOSED (an unproven agent is denied every restricted tool).
|
|
|
|
agent release-manager release-manager.pub.pem
|
|
agent implement-agent implement-agent.pub.pem
|
|
agent design-agent design-agent.pub.pem
|
|
agent review-agent review-agent.pub.pem
|