thanhnvandClaude Opus 4.8
3adc48ed82
Resolve every root by marker walk-up instead of a fixed depth that only lands on the app via the .specify compat symlink, so the harness runs correctly when invoked by its real packages/casan-harness path — proven by a full gate run via that path: 64/0/0. - 95 scripts/tests: PROJECT_ROOT/ROOT "$SCRIPT_DIR/../.."-style computations -> $CASAN_APP_ROOT. - 6 leaf scripts (infra-lab, context-validate, secrets-scan, path-guard, toolchain-verify, phase2-sourcegen) now source casan-paths + use CASAN_APP_ROOT. - run-casan4: source casan-paths as a package sibling (facade-independent), PROJECT_ROOT=CASAN_APP_ROOT. - 8 Python files: project_root()/REPO_ROOT/bundle_root walk UP for the .specify marker (control-plane-settings, loop_common, model-call, context-compress, test-integrity, bundle-integrity, traceability-matrix; generate-* fixed earlier). - evidence-pack-build.py + traceability-matrix.py: domain refs -> apps/okr/domain (input/, corpus/redteam-vectors.jsonl, traceability-map.json). - ci-harness-gate.sh: export CASAN_TESTS_DIR/CASAN_TEST_MANIFEST/CASAN_BUNDLE_ROOT so the integrity Python resolves via the harness root regardless of invocation path; ROOT=CASAN_APP_ROOT. - Remove the domain compat symlinks from packages/casan-harness/security (redteam-corpus, redteam-vectors, benign-corpus) — packages now holds NO domain data. Both invocation paths pass (compat facade still present): .specify/... and packages/... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
57 lines
2.7 KiB
Bash
Executable File
57 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -uo pipefail
|
|
|
|
# CASAN WP-S8 — one-command security gate.
|
|
# Runs the security-relevant harness checks and prints a single aggregate
|
|
# verdict. Live-model checks SKIP (not fail) when the Ollama tunnel is down.
|
|
# Exit: 0 all required gates green, 1 a required gate failed.
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/casan-paths.sh"
|
|
ROOT="$CASAN_APP_ROOT"
|
|
PASS=0; FAIL=0; SKIP=0
|
|
run() { # <name> <command...>
|
|
local name="$1"; shift
|
|
if "$@" >/dev/null 2>&1; then echo " GATE PASS $name"; PASS=$((PASS+1));
|
|
else echo " GATE FAIL $name"; FAIL=$((FAIL+1)); fi
|
|
}
|
|
|
|
echo "== CASAN security gate =="
|
|
run "run-casan4 harness suite" bash "$CASAN_HARNESS_ROOT/tests/run-casan4-harness-tests.sh"
|
|
run "adversarial suite" bash "$CASAN_HARNESS_ROOT/tests/adversarial-harness-tests.sh"
|
|
# Wave 5: sign audit head via Vault KMS (or local fallback) before verifying.
|
|
# This changes verify output from anchor=unsigned to anchor=signed when Vault is configured.
|
|
run "sign audit-chain head (KMS)" bash "$CASAN_HARNESS_ROOT/scripts/bash/sign-audit-head.sh"
|
|
run "audit hash-chain (signed)" bash "$CASAN_HARNESS_ROOT/scripts/bash/verify-audit-chain.sh"
|
|
run "tool-call audit (signed)" bash "$CASAN_HARNESS_ROOT/scripts/bash/verify-tool-audit.sh"
|
|
# Wave 3 additions
|
|
run "secrets scan (WP-S4)" bash "$CASAN_HARNESS_ROOT/scripts/bash/secrets-scan.sh"
|
|
run "no-bypass + circuit breaker" bash "$CASAN_HARNESS_ROOT/scripts/bash/circuit-breaker-check.sh"
|
|
|
|
if curl -sS -m 5 http://127.0.0.1:11434/api/tags >/dev/null 2>&1; then
|
|
run "model router tests" bash "$CASAN_HARNESS_ROOT/tests/phase3-model-router-tests.sh"
|
|
run "red-team H4 metrics (30 samples)" bash "$CASAN_HARNESS_ROOT/tests/phase3-redteam-metrics.sh"
|
|
run "judge gate tests (WP-B)" bash "$CASAN_HARNESS_ROOT/tests/phase3-judge-gate-tests.sh"
|
|
else
|
|
echo " GATE SKIP model router + red-team + judge-gate (Ollama tunnel down)"; SKIP=$((SKIP+1))
|
|
fi
|
|
|
|
# Wave 4 additions
|
|
FNM_NODE_DIR="$HOME/AppData/Roaming/fnm/node-versions"
|
|
if [[ -d "$FNM_NODE_DIR" ]]; then
|
|
NODE_BIN=$(find "$FNM_NODE_DIR" -name "node.exe" -maxdepth 4 2>/dev/null | sort -V | tail -1)
|
|
[[ -n "$NODE_BIN" ]] && export PATH="$(dirname "$NODE_BIN"):$PATH"
|
|
fi
|
|
if command -v node >/dev/null 2>&1; then
|
|
if [[ ! -f "$ROOT/node_modules/.bin/vitest" ]]; then
|
|
echo " installing frontend deps (vitest not found)..."
|
|
npm ci -w frontend --prefix "$ROOT" >/dev/null 2>&1 || true
|
|
fi
|
|
run "frontend runtime tests (WV4-A)" bash -c "cd '$ROOT' && npm test -w frontend"
|
|
else
|
|
echo " GATE SKIP frontend runtime tests (node not in PATH)"; SKIP=$((SKIP+1))
|
|
fi
|
|
|
|
echo "== verdict: PASS=$PASS FAIL=$FAIL SKIP=$SKIP =="
|
|
[[ "$FAIL" -eq 0 ]] || exit 1
|