thanhnvandClaude Opus 4.8
3adc48ed82
Resolve every root by marker walk-up instead of a fixed depth that only lands on the app via the .specify compat symlink, so the harness runs correctly when invoked by its real packages/casan-harness path — proven by a full gate run via that path: 64/0/0. - 95 scripts/tests: PROJECT_ROOT/ROOT "$SCRIPT_DIR/../.."-style computations -> $CASAN_APP_ROOT. - 6 leaf scripts (infra-lab, context-validate, secrets-scan, path-guard, toolchain-verify, phase2-sourcegen) now source casan-paths + use CASAN_APP_ROOT. - run-casan4: source casan-paths as a package sibling (facade-independent), PROJECT_ROOT=CASAN_APP_ROOT. - 8 Python files: project_root()/REPO_ROOT/bundle_root walk UP for the .specify marker (control-plane-settings, loop_common, model-call, context-compress, test-integrity, bundle-integrity, traceability-matrix; generate-* fixed earlier). - evidence-pack-build.py + traceability-matrix.py: domain refs -> apps/okr/domain (input/, corpus/redteam-vectors.jsonl, traceability-map.json). - ci-harness-gate.sh: export CASAN_TESTS_DIR/CASAN_TEST_MANIFEST/CASAN_BUNDLE_ROOT so the integrity Python resolves via the harness root regardless of invocation path; ROOT=CASAN_APP_ROOT. - Remove the domain compat symlinks from packages/casan-harness/security (redteam-corpus, redteam-vectors, benign-corpus) — packages now holds NO domain data. Both invocation paths pass (compat facade still present): .specify/... and packages/... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
76 lines
4.1 KiB
Bash
76 lines
4.1 KiB
Bash
#!/usr/bin/env bash
|
|
set -uo pipefail
|
|
|
|
# CASAN Plan-16 SEC-17 (ARCH-03) — CASAN_PROFILE=prod is secure-by-default.
|
|
#
|
|
# Many strong controls were opt-in env flags (off unless explicitly set), so a
|
|
# lazy operator ran permissively. Under CASAN_PROFILE=prod they now default ON —
|
|
# while an explicit `=0` still wins (internal scans that disable a flag on purpose
|
|
# must stay disabled). Proven across three real controls:
|
|
# * verify-audit-chain: unsigned chain fails under prod,
|
|
# * control-plane verify-audit: unsigned store fails under prod,
|
|
# * casan-harness kill-switch: engaged switch is enforced under prod, but an
|
|
# explicit CASAN_KILLSWITCH_ENFORCE=0 overrides.
|
|
#
|
|
# Deterministic; hermetic (temp dirs); no model/network.
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
|
|
PROJECT_ROOT="$CASAN_APP_ROOT"
|
|
BASH_DIR="$CASAN_HARNESS_ROOT/scripts/bash"
|
|
WORK="$(mktemp -d)"
|
|
trap 'rm -rf "$WORK"' EXIT
|
|
|
|
PASS=0; FAIL=0
|
|
pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
|
|
fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
|
|
rc_of() { set +e; "$@" >/dev/null 2>&1; echo $?; set -e 2>/dev/null || true; }
|
|
|
|
echo "===== Plan-16 SEC-17: CASAN_PROFILE=prod secure-by-default ====="
|
|
|
|
# --- Control 1: verify-audit-chain (unsigned) ---
|
|
AUD="$WORK/audit"; mkdir -p "$AUD"
|
|
python3 - "$AUD/audit.jsonl" <<'PY'
|
|
import hashlib, json, sys
|
|
core = "|".join(["2026-07-06T00:00:00Z","t1","act","a@x","low","ALLOW","n/a","","ih","oh",""])
|
|
h = hashlib.sha256(core.encode()).hexdigest()
|
|
open(sys.argv[1],"w").write(json.dumps({"timestamp":"2026-07-06T00:00:00Z","trace_id":"t1","action":"act",
|
|
"actor":"a@x","risk_level":"low","decision":"ALLOW","approval_status":"n/a","approver":"",
|
|
"input_hash":"ih","output_hash":"oh","previous_record_hash":"","record_hash":h})+"\n")
|
|
PY
|
|
[[ "$(rc_of bash "$BASH_DIR/verify-audit-chain.sh" "$AUD/audit.jsonl")" -eq 0 ]] \
|
|
&& pass "verify-audit-chain: permissive default allows unsigned" || fail "permissive should allow unsigned"
|
|
[[ "$(rc_of env CASAN_PROFILE=prod bash "$BASH_DIR/verify-audit-chain.sh" "$AUD/audit.jsonl")" -ne 0 ]] \
|
|
&& pass "verify-audit-chain: prod profile enforces (unsigned FAILS)" || fail "prod did not enforce audit-chain"
|
|
|
|
# --- Control 2: control-plane verify-audit (unsigned store) ---
|
|
export CASAN_CP_STORE_FILE="$WORK/cp.json" CASAN_CP_KEY_DIR="$WORK/cpkeys" CASAN_CP_PUB="$WORK/cp.pub"
|
|
python3 "$BASH_DIR/control-plane-settings.py" set compression.enabled true --actor a --reason r >/dev/null 2>&1
|
|
rm -f "$WORK/cp.json.head" "$WORK/cp.json.head.sig" "$WORK/cp.pub" # strip the signature -> unsigned store
|
|
[[ "$(rc_of python3 "$BASH_DIR/control-plane-settings.py" verify-audit)" -eq 0 ]] \
|
|
&& pass "control-plane: permissive default allows unsigned store" || fail "permissive should allow unsigned store"
|
|
[[ "$(rc_of env CASAN_PROFILE=prod python3 "$BASH_DIR/control-plane-settings.py" verify-audit)" -ne 0 ]] \
|
|
&& pass "control-plane: prod profile enforces (unsigned store FAILS)" || fail "prod did not enforce control-plane"
|
|
unset CASAN_CP_STORE_FILE CASAN_CP_KEY_DIR CASAN_CP_PUB
|
|
|
|
# --- Control 3: casan-harness kill-switch (prod-on + explicit-0-wins) ---
|
|
export CASAN_KILLSWITCH_DIR="$WORK/ks"
|
|
echo "hi" > "$WORK/in.txt"
|
|
bash "$BASH_DIR/kill-switch.sh" engage project sec17 "test" >/dev/null 2>&1
|
|
|
|
OUT="$(set +e; CASAN_PROFILE=prod CASAN_KILLSWITCH_SCOPE=project CASAN_KILLSWITCH_ID=sec17 \
|
|
bash "$BASH_DIR/casan-harness.sh" "$WORK/in.txt" "$WORK/o.txt" act -- bash -c 'echo x' 2>&1)"
|
|
echo "$OUT" | grep -q "KILL_SWITCH_ACTIVE" \
|
|
&& pass "kill-switch: prod profile enforces an engaged switch (no explicit flag)" \
|
|
|| fail "prod profile did not enforce kill-switch"
|
|
|
|
OUT="$(set +e; CASAN_PROFILE=prod CASAN_KILLSWITCH_ENFORCE=0 CASAN_KILLSWITCH_SCOPE=project CASAN_KILLSWITCH_ID=sec17 \
|
|
bash "$BASH_DIR/casan-harness.sh" "$WORK/in.txt" "$WORK/o2.txt" act -- bash -c 'echo x' 2>&1)"
|
|
echo "$OUT" | grep -q "KILL_SWITCH_ACTIVE" \
|
|
&& fail "explicit CASAN_KILLSWITCH_ENFORCE=0 was overridden by prod (should win)" \
|
|
|| pass "kill-switch: explicit =0 overrides prod default (internal opt-out preserved)"
|
|
|
|
echo ""
|
|
echo "===== SEC-17 SUMMARY: PASS=$PASS FAIL=$FAIL ====="
|
|
[[ "$FAIL" -eq 0 ]] || exit 1
|