thanhnvandClaude Opus 4.8
e21a1472b1
Under CASAN_APPROVAL_STRICT=1, a high-risk approval is trusted ONLY when a REGISTERED reviewer cryptographically signs THIS exact request and their role is authorized for the action — a plain env-var CASAN_APPROVER is no longer enough. - approval-sign.sh: reviewer signs assertion "casan-approval|v1|<action>|<actor>|<input_sha256>|<approver_id>" with their key. - approval-verify.sh: gate looks up reviewer role+pubkey in reviewers.registry, enforces role→action authorization, verifies the RSA signature (fail-closed). - governance-check.sh: strict branch requires a valid signed approval; SoD still enforced; default (non-strict) env-var path UNCHANGED (baseline preserved). - reviewers.registry: role-scoped reviewer identity registry (pubkeys off-repo; production replaces with OIDC/JWT from a real IdP). - phase-h5-approval-tests.sh: 8 checks — valid/authorized approve; unsigned, wrong-role, forged-key, unregistered, replay-to-other-request, self-approval all denied; non-strict backward-compat. Baselines: run-casan4 35/35, adversarial 44/44. Lifts H5 policy-approval (C4) 2.5 -> ~3.5-4 / 5. Total suites now 6 (+8 checks = 148). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
29 lines
1.3 KiB
Plaintext
29 lines
1.3 KiB
Plaintext
# CASAN H5 — Reviewer identity registry (Approval-identity MVP · C4).
|
|
#
|
|
# Binds an approver id to a ROLE and a PUBLIC key. Under CASAN_APPROVAL_STRICT=1,
|
|
# governance-check.sh trusts an approval ONLY if it is signed by the private key
|
|
# matching one of these public keys, and the reviewer's role is authorized for
|
|
# the action (see the `action` lines).
|
|
#
|
|
# Line format (no yaml dependency):
|
|
# reviewer <id> <role> <pubkey-file> # pubkey-file relative to reviewers/ dir
|
|
# action <action-name|default> <comma,roles>
|
|
#
|
|
# Reviewer PRIVATE keys live OFF-REPO (with the reviewer / issued by an IdP) —
|
|
# only PUBLIC keys are provisioned here, same policy as the audit signing key.
|
|
# Production: replace this static registry + local pubkeys with OIDC/JWT identity
|
|
# from a real IdP (verify token signature + role/exp claims).
|
|
|
|
reviewer security-lead security security-lead.pub.pem
|
|
reviewer tech-lead tech_lead tech-lead.pub.pem
|
|
reviewer ops-owner ops ops-owner.pub.pem
|
|
reviewer project-owner project_owner project-owner.pub.pem
|
|
|
|
# Which role may approve which action class.
|
|
action deploy ops,security
|
|
action migration tech_lead,security
|
|
action db_write tech_lead,security
|
|
action write_code tech_lead,security
|
|
action policy_change security
|
|
action default tech_lead,ops,security,project_owner
|