gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
8c06a55aedbdbdd31e3e55fdb61053f80cd15c69
CASAN/AINative_OKR_CASAN5/.specify/scripts/bash
T
History
thanhnvandClaude Opus 4.8 8c06a55aed feat: plan 16 P2 batch 1 (SEC-13 SSRF, SEC-27 log-escape, SEC-28 path-traversal) 
- SEC-13 (M-09): SSRF allowlist on provider-usage-fetch (always block non-http(s)
  schemes; enforced mode blocks internal/link-local IPs + non-allowlisted hosts,
  dev keeps loopback mocks); dashboard refuses non-loopback bind in enforced mode.
- SEC-27 (X-02): casan-log strips ESC/CSI + CR/LF (terminal-escape + fake-log-line
  injection) while keeping tab and visible text.
- SEC-28 (X-04): new path-guard.sh — realpath resolve + reject symlink/.. escapes
  outside the allowed root.

Verify: SEC-13 6/0, SEC-27 3/0, SEC-28 4/0, adversarial 44/44, run-casan4 0-FAIL.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-06 22:39:18 +09:00
..
action-gate.sh
feat: plan 16-01
2026-07-06 21:47:38 +09:00
agent-identity-sign.sh
feat: plan 16 P1 complete (SEC-07 approval + SEC-10 agent identity)
2026-07-06 22:31:57 +09:00
agent-metrics.sh
feat: plan 16-01
2026-07-06 21:47:38 +09:00
alert-dispatch.sh
feat(h6): AgentOps hardening — live alerting, provider-API reconcile, hosted dashboard, window breaker (79→80)
2026-07-05 01:14:46 +09:00
approval-jwt-mint.py
Complete CASAN backlog tier 1 controls
2026-07-06 11:31:17 +09:00
approval-sign.sh
feat(h5): approval-identity MVP — signed reviewer approvals (C4/V20)
2026-07-04 23:07:16 +09:00
approval-verify.sh
Add local production infra lab
2026-07-06 12:00:27 +09:00
artifact-scan.sh
Update optimize wave3 (need update wave 4 to wave 8)
2026-07-01 00:02:30 +09:00
audit-ship.sh
feat(h5): ① KMS key rotation/non-exportable + ② external WORM audit ledger
2026-07-04 23:16:21 +09:00
benign-fp-report.sh
feat(a6-tests): Plan-07 Track A — A6 benign/FP budget + Phase 1 adversarial suite
2026-07-03 22:46:33 +09:00
bundle-integrity.py
feat: plan 16-01
2026-07-06 21:47:38 +09:00
business-kpi-report.sh
Wave 4: frontend Vitest tests, H1/H7 fixes, Windows compat (python3→python, MSYS2 path)
2026-07-01 02:23:51 +09:00
casan-harness.sh
feat: plan 16-01
2026-07-06 21:47:38 +09:00
casan-log.sh
feat: plan 16 P2 batch 1 (SEC-13 SSRF, SEC-27 log-escape, SEC-28 path-traversal)
2026-07-06 22:39:18 +09:00
check-prerequisites.sh
update first - 84
2026-06-30 02:21:39 +09:00
ci-harness-gate.sh
feat: plan 16 P2 batch 1 (SEC-13 SSRF, SEC-27 log-escape, SEC-28 path-traversal)
2026-07-06 22:39:18 +09:00
circuit-breaker-check.sh
feat(h6): AgentOps hardening — live alerting, provider-API reconcile, hosted dashboard, window breaker (79→80)
2026-07-05 01:14:46 +09:00
common.sh
update first - 84
2026-06-30 02:21:39 +09:00
context-assemble-scan.sh
feat(h4): split-injection + classifier-injection resistance (Plan-07 B2 / V5,V6)
2026-07-05 22:55:37 +09:00
context-compress.py
feat: plan 16 P1 (SEC-08/09/19/20/21) — fail-open/DoS/authz hardening
2026-07-06 22:21:34 +09:00
context-validate.sh
Wave 4: frontend Vitest tests, H1/H7 fixes, Windows compat (python3→python, MSYS2 path)
2026-07-01 02:23:51 +09:00
control-plane-settings.py
feat: plan 16 P1 complete (SEC-07 approval + SEC-10 agent identity)
2026-07-06 22:31:57 +09:00
cost-spike-detect.sh
feat(h5-h6-hardening): Plan-07 Track A — A4 telemetry integrity, A5 cost controls
2026-07-03 22:25:00 +09:00
create-new-feature.sh
update first - 84
2026-06-30 02:21:39 +09:00
dashboard-serve.sh
feat(h6): AgentOps hardening — live alerting, provider-API reconcile, hosted dashboard, window breaker (79→80)
2026-07-05 01:14:46 +09:00
dashboard-server.py
feat: plan 16 P2 batch 1 (SEC-13 SSRF, SEC-27 log-escape, SEC-28 path-traversal)
2026-07-06 22:39:18 +09:00
data-exfil-guard.sh
feat(track-c-mvp): C3 data-exfil guard + C6 sandbox scaffold + Phase 2 suite
2026-07-03 22:57:09 +09:00
decode-suspicious.py
feat(h4-hardening): Plan-07 Track A — A1 strict semantic, A2 unicode/encoding, A3 tool-output scan
2026-07-03 22:20:50 +09:00
drift-detect.sh
feat: plan 16 P1 (SEC-08/09/19/20/21) — fail-open/DoS/authz hardening
2026-07-06 22:21:34 +09:00
evidence-pack-build.py
Complete CASAN backlog tier 1 controls
2026-07-06 11:31:17 +09:00
evidence-pack-verify.py
feat(evidence-pack): Plan-09 MVP — casan pack / verify-pack + certified-run gate
2026-07-03 23:02:39 +09:00
evidence-pack.sh
feat: plan 16-01
2026-07-06 21:47:38 +09:00
governance-check.sh
feat: plan 16-01
2026-07-06 21:47:38 +09:00
governance-report.py
update doc and optimize
2026-07-06 17:47:12 +09:00
guideH4-H5-H6.md
update first - 84
2026-06-30 02:21:39 +09:00
hallucination-scan.py
update first - 84
2026-06-30 02:21:39 +09:00
harness-preflight.sh
feat: plan 16 P1 (SEC-08/09/19/20/21) — fail-open/DoS/authz hardening
2026-07-06 22:21:34 +09:00
import-provider-telemetry.sh
Wave 4: frontend Vitest tests, H1/H7 fixes, Windows compat (python3→python, MSYS2 path)
2026-07-01 02:23:51 +09:00
incident.sh
feat: plan 16-01
2026-07-06 21:47:38 +09:00
infra-lab.sh
Add local production infra lab
2026-07-06 12:00:27 +09:00
kill-switch.sh
feat: plan 16 P1 complete (SEC-07 approval + SEC-10 agent identity)
2026-07-06 22:31:57 +09:00
model-call.py
feat: plan 16 P1 (SEC-08/09/19/20/21) — fail-open/DoS/authz hardening
2026-07-06 22:21:34 +09:00
model-digest-check.sh
Complete CASAN backlog tier 1 controls
2026-07-06 11:31:17 +09:00
model-fallback.sh
update first - 84
2026-06-30 02:21:39 +09:00
model-router.sh
feat: plan 16-01
2026-07-06 21:47:38 +09:00
path-guard.sh
feat: plan 16 P2 batch 1 (SEC-13 SSRF, SEC-27 log-escape, SEC-28 path-traversal)
2026-07-06 22:39:18 +09:00
pii-mask.py
feat: plan 16 P1 (SEC-08/09/19/20/21) — fail-open/DoS/authz hardening
2026-07-06 22:21:34 +09:00
provider-cost-lookup.py
update first - 84
2026-06-30 02:21:39 +09:00
provider-usage-fetch.sh
feat: plan 16 P2 batch 1 (SEC-13 SSRF, SEC-27 log-escape, SEC-28 path-traversal)
2026-07-06 22:39:18 +09:00
rai-guard.py
update doc and optimize
2026-07-06 17:47:12 +09:00
rbac-check.py
update doc and optimize
2026-07-06 17:47:12 +09:00
rollback-manager.sh
feat: plan 16-01
2026-07-06 21:47:38 +09:00
sandbox-container.sh
feat(c6): TRUE runtime isolation via container (Plan-07 C6 / V22)
2026-07-05 22:49:03 +09:00
sandbox-run.sh
feat(c6): TRUE runtime isolation via container (Plan-07 C6 / V22)
2026-07-05 22:49:03 +09:00
secrets-scan.sh
Update optimize wave3 (need update wave 4 to wave 8)
2026-07-01 00:02:30 +09:00
security-check.sh
feat: plan 16 P1 (SEC-08/09/19/20/21) — fail-open/DoS/authz hardening
2026-07-06 22:21:34 +09:00
security-gate.sh
fix(ci): security-gate auto-installs frontend deps if vitest missing
2026-07-01 17:27:09 +09:00
self-improve.py
update doc and optimize
2026-07-06 17:47:12 +09:00
setup-plan.sh
update first - 84
2026-06-30 02:21:39 +09:00
sign-audit-head.sh
feat(h5-h6-hardening): Plan-07 Track A — A4 telemetry integrity, A5 cost controls
2026-07-03 22:25:00 +09:00
sign-policy-bundle.sh
feat(h6): AgentOps hardening — live alerting, provider-API reconcile, hosted dashboard, window breaker (79→80)
2026-07-05 01:14:46 +09:00
supply-chain-gate.sh
feat(track-c-mvp): C1 action gating + C2 supply-chain gate
2026-07-03 22:51:43 +09:00
supply-chain-scan.py
feat(track-c-mvp): C1 action gating + C2 supply-chain gate
2026-07-03 22:51:43 +09:00
telemetry-integrity.sh
feat: plan 16-01
2026-07-06 21:47:38 +09:00
telemetry-reconcile.sh
feat(h6): AgentOps hardening — live alerting, provider-API reconcile, hosted dashboard, window breaker (79→80)
2026-07-05 01:14:46 +09:00
test-integrity.py
feat: plan 16-01
2026-07-06 21:47:38 +09:00
tool-audit-lib.sh
fix(tool-audit-lib): always re-export local pubkey to audit-public.pem
2026-07-01 21:37:13 +09:00
tool-exec.sh
update first - 84
2026-06-30 02:21:39 +09:00
tool-output-scan.sh
feat(h4-hardening): Plan-07 Track A — A1 strict semantic, A2 unicode/encoding, A3 tool-output scan
2026-07-03 22:20:50 +09:00
tool-registry-gate.sh
feat: plan 16 P1 complete (SEC-07 approval + SEC-10 agent identity)
2026-07-06 22:31:57 +09:00
toolchain-verify.sh
feat: plan 16 P1 (SEC-08/09/19/20/21) — fail-open/DoS/authz hardening
2026-07-06 22:21:34 +09:00
traceability-matrix.py
update doc and optimize
2026-07-06 17:47:12 +09:00
unicode-normalize.py
feat(h4-hardening): Plan-07 Track A — A1 strict semantic, A2 unicode/encoding, A3 tool-output scan
2026-07-03 22:20:50 +09:00
update-agent-context.sh
update first - 84
2026-06-30 02:21:39 +09:00
validate-tool-input.sh
Wave 4: frontend Vitest tests, H1/H7 fixes, Windows compat (python3→python, MSYS2 path)
2026-07-01 02:23:51 +09:00
vault-kms.sh
feat(h5): ① KMS key rotation/non-exportable + ② external WORM audit ledger
2026-07-04 23:16:21 +09:00
verify-audit-chain.sh
feat: plan 16-01
2026-07-06 21:47:38 +09:00
verify-audit-gap.sh
feat(h5): ① KMS key rotation/non-exportable + ② external WORM audit ledger
2026-07-04 23:16:21 +09:00
verify-harness-reuse.sh
Wave 4: frontend Vitest tests, H1/H7 fixes, Windows compat (python3→python, MSYS2 path)
2026-07-01 02:23:51 +09:00
verify-tool-audit.sh
feat: plan 16-01
2026-07-06 21:47:38 +09:00
worm-ledger.py
feat(h5): ① KMS key rotation/non-exportable + ② external WORM audit ledger
2026-07-04 23:16:21 +09:00