thanhnvandClaude Opus 4.8
664bd1f00c
Physically move the pure-code subtrees out of .specify into the package, leaving compat symlinks at the old .specify/<dir> paths so every existing reference (internal CASAN_HARNESS_ROOT + external CI/docker/mjs) keeps resolving. Runtime state stays put. Moved (git mv): scripts/ tests/ security/ templates/ config/ governance/ memory/ .specify/<dir> -> packages/casan-harness/<dir> (+ .specify/<dir> symlink) Stays in .specify (state/governance/domain, handled later): logs/ agentops/ level5/ init-options.json traceability-map.json Python `.resolve()` self-location followed the compat symlink into packages and lost the app root; generate-casan-demo-context.py, generate-agentops-dashboard.py and dashboard-server.py now walk UP for the `.specify` state marker instead of a fixed parent depth (fixes "missing trace files" in run-casan4). Full gate: PASS=64 FAIL=0 SKIP=3 (CASAN_CI_STEP_TIMEOUT_SEC=1200 — track-a ~450s runs close to the 600s default and can tip over under load; this is timing variance, not a regression — it passed cleanly with headroom). Runtime log/audit artifacts kept unstaged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
25 lines
1.0 KiB
Bash
25 lines
1.0 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# CASAN Plan-16 SEC-10 — mint a signed agent-identity token.
|
|
#
|
|
# Proves a caller really IS a given agent (instead of just setting CASAN_AGENT).
|
|
# The signed assertion is bound to the agent id AND the run id, so a token cannot
|
|
# be replayed for a different run:
|
|
# casan-agent|v1|<agent-id>|<run-id>
|
|
#
|
|
# Usage: agent-identity-sign.sh <agent-id> <run-id> <private-key> <sig-out>
|
|
# The matching PUBLIC key must be registered in agent-identities.registry.
|
|
|
|
AGENT="${1:-}"; RUN="${2:-}"; PRIV="${3:-}"; SIG_OUT="${4:-}"
|
|
if [[ -z "$AGENT" || -z "$RUN" || -z "$PRIV" || -z "$SIG_OUT" ]]; then
|
|
echo "Usage: agent-identity-sign.sh <agent-id> <run-id> <private-key> <sig-out>" >&2
|
|
exit 64
|
|
fi
|
|
command -v openssl >/dev/null 2>&1 || { echo "openssl_unavailable" >&2; exit 1; }
|
|
|
|
TMP="$(mktemp)"; trap 'rm -f "$TMP"' EXIT
|
|
printf '%s' "casan-agent|v1|$AGENT|$RUN" > "$TMP"
|
|
openssl dgst -sha256 -sign "$PRIV" -out "$SIG_OUT" "$TMP"
|
|
echo "AGENT_IDENTITY_SIGNED agent=$AGENT run=$RUN sig=$SIG_OUT"
|