thanhnvandClaude Opus 4.8
36a4812ef3
Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.
- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
.specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
- .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
-> packages/casan-harness/... (.specify/logs state kept)
- .claude/launch.json, .gitea/*-runbook.md: path prefixes
- CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
- policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.
Full gate from the new root: PASS=64 FAIL=0 SKIP=3.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
96 lines
4.2 KiB
Bash
Executable File
96 lines
4.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -uo pipefail
|
|
|
|
# CASAN — Incident response (C7 / V23).
|
|
#
|
|
# Turns a detected security/ops event into a graded incident: classify severity,
|
|
# record a tamper-visible incident entry, and for HIGH/CRIT auto-engage the
|
|
# scoped kill-switch + fire an alert (reuses alert-dispatch.sh from H6 if present).
|
|
# Answers "when a gate catches an attack/spike/tamper — who is paged and what
|
|
# stops?" — severity, owner, kill-switch, runbook.
|
|
#
|
|
# Usage:
|
|
# incident.sh raise <event-type> [detail] [--scope <s>] [--id <id>]
|
|
# incident.sh status
|
|
# Exit: 0 recorded (LOW/MED) · 2 kill-switch engaged (HIGH/CRIT) · 64 usage.
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/casan-paths.sh"
|
|
PROJECT_ROOT="$CASAN_APP_ROOT"
|
|
SEC_DIR="$CASAN_HARNESS_ROOT/security"
|
|
LOG="$CASAN_STATE_ROOT/logs/level5/incidents.jsonl"
|
|
RUNBOOK="$SEC_DIR/incident-runbook.md"
|
|
SEVMAP="$SEC_DIR/incident-severity.map"
|
|
mkdir -p "$(dirname "$LOG")"
|
|
# shellcheck source=casan-log.sh
|
|
source "$SCRIPT_DIR/casan-log.sh"
|
|
|
|
CMD="${1:-}"
|
|
ts() { date -u +"%Y-%m-%dT%H:%M:%SZ"; }
|
|
|
|
# owner routing by severity (production: on-call rota / IdP group).
|
|
owner_for() { case "$1" in CRIT) echo "security-oncall" ;; HIGH) echo "ops-oncall" ;; MED) echo "tech-lead" ;; *) echo "triage" ;; esac; }
|
|
|
|
if [[ "$CMD" == "status" ]]; then
|
|
n=$(grep -c . "$LOG" 2>/dev/null || echo 0)
|
|
echo "INCIDENTS total=$n log=$LOG"
|
|
[[ -f "$LOG" ]] && tail -5 "$LOG"
|
|
exit 0
|
|
fi
|
|
[[ "$CMD" == "raise" ]] || { echo "Usage: incident.sh raise <event-type> [detail] [--scope <s>] [--id <id>]" >&2; exit 64; }
|
|
|
|
EVENT="${2:-}"; DETAIL="${3:-}"
|
|
[[ -n "$EVENT" ]] || { echo "usage: incident.sh raise <event-type> [detail]" >&2; exit 64; }
|
|
SCOPE="project"; ID="${CASAN_PROJECT:-current}"
|
|
shift 2 2>/dev/null || true
|
|
while [[ "$#" -gt 0 ]]; do
|
|
case "$1" in
|
|
--scope) SCOPE="${2:-project}"; shift 2 ;;
|
|
--id) ID="${2:-current}"; shift 2 ;;
|
|
*) shift ;;
|
|
esac
|
|
done
|
|
|
|
# Classify severity from the map (fallback to default).
|
|
SEV="$(awk -v e="$EVENT" '$1==e {print $2; exit}' "$SEVMAP" 2>/dev/null)"
|
|
[[ -n "$SEV" ]] || SEV="$(awk '$1=="default" {print $2; exit}' "$SEVMAP" 2>/dev/null)"
|
|
[[ -n "$SEV" ]] || SEV="MED"
|
|
OWNER="$(owner_for "$SEV")"
|
|
TS="$(ts)"
|
|
ACTION="recorded"
|
|
|
|
# HIGH/CRIT → engage the scoped kill-switch (stop the blast radius).
|
|
if [[ "$SEV" == "CRIT" || "$SEV" == "HIGH" ]]; then
|
|
bash "$SCRIPT_DIR/kill-switch.sh" engage "$SCOPE" "$ID" "incident:$EVENT" >/dev/null 2>&1 || true
|
|
ACTION="kill_switch_engaged"
|
|
# Fire an alert through the H6 dispatcher if it is wired up.
|
|
if [[ -x "$SCRIPT_DIR/alert-dispatch.sh" ]]; then
|
|
bash "$SCRIPT_DIR/alert-dispatch.sh" "$SEV" "incident:$EVENT" "$DETAIL" >/dev/null 2>&1 || true
|
|
fi
|
|
casan_log error incident "INCIDENT sev=$SEV event=$EVENT scope=$SCOPE id=$ID → kill-switch ENGAGED owner=$OWNER"
|
|
else
|
|
casan_log warn incident "INCIDENT sev=$SEV event=$EVENT scope=$SCOPE id=$ID owner=$OWNER"
|
|
fi
|
|
|
|
# SEC-05 (M-05): the keyless printf fallback below must not permit JSON injection
|
|
# either — strip quotes/backslashes/newlines from interpolated fields so a crafted
|
|
# EVENT/OWNER/SCOPE cannot forge a second incident record.
|
|
_json_strip() { local s="${1//\\/}"; s="${s//\"/}"; s="${s//$'\n'/ }"; s="${s//$'\r'/ }"; printf '%s' "$s"; }
|
|
|
|
# Record a structured incident entry.
|
|
python - "$LOG" "$TS" "$EVENT" "$SEV" "$OWNER" "$SCOPE" "$ID" "$ACTION" "$DETAIL" "$RUNBOOK" <<'PY' 2>/dev/null || \
|
|
printf '{"timestamp":"%s","event":"%s","severity":"%s","owner":"%s","scope":"%s","id":"%s","action":"%s"}\n' \
|
|
"$(_json_strip "$TS")" "$(_json_strip "$EVENT")" "$(_json_strip "$SEV")" "$(_json_strip "$OWNER")" "$(_json_strip "$SCOPE")" "$(_json_strip "$ID")" "$(_json_strip "$ACTION")" >> "$LOG"
|
|
import json, sys
|
|
log, ts, event, sev, owner, scope, iid, action, detail, runbook = sys.argv[1:11]
|
|
with open(log, "a", encoding="utf-8") as f:
|
|
f.write(json.dumps({
|
|
"timestamp": ts, "event": event, "severity": sev, "owner": owner,
|
|
"scope": scope, "id": iid, "action": action, "detail": detail[:300],
|
|
"runbook": runbook,
|
|
}) + "\n")
|
|
PY
|
|
|
|
echo "INCIDENT_RAISED sev=$SEV event=$EVENT owner=$OWNER scope=$SCOPE id=$ID action=$ACTION runbook=$RUNBOOK"
|
|
[[ "$SEV" == "CRIT" || "$SEV" == "HIGH" ]] && exit 2 || exit 0
|