thanhnvandClaude Opus 4.8
e70f0815ab
- SEC-08 pii-mask: fail-closed on missing rules / broken regex (no unmasked leak) - SEC-09: input-size cap + fail-closed reads (security-check/drift-detect/context-compress); non-UTF8 no longer crashes - SEC-19: control-plane store POSIX flock + atomic tmp+rename write - SEC-20: new toolchain-verify.sh (missing/PATH-shadowed/in-workspace binary -> refuse); wired into harness-preflight - SEC-21: model-call timeout 180->60s configurable + per-run call budget - SEC-11 realized by SEC-17 prod profile (no code) - 5 fail-able test suites wired into ci-harness-gate.sh; test-integrity manifest regenerated Verify: SEC+integrity gate 16/0, run-casan4 0-FAIL, adversarial 44/44, no regressions. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
101 lines
3.2 KiB
Bash
Executable File
101 lines
3.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# CASAN Level 5 drift detector.
|
|
# Usage:
|
|
# drift-detect.sh <golden-file> <candidate-file> <report-json>
|
|
|
|
GOLDEN="${1:-}"
|
|
CANDIDATE="${2:-}"
|
|
REPORT="${3:-}"
|
|
|
|
if [[ -z "$GOLDEN" || -z "$CANDIDATE" || -z "$REPORT" ]]; then
|
|
echo "Usage: drift-detect.sh <golden-file> <candidate-file> <report-json>" >&2
|
|
exit 64
|
|
fi
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
|
mkdir -p "$(dirname "$REPORT")" "$PROJECT_ROOT/.specify/logs/level5"
|
|
|
|
python - "$GOLDEN" "$CANDIDATE" "$REPORT" <<'PY'
|
|
import difflib
|
|
import hashlib
|
|
import json
|
|
import os
|
|
import pathlib
|
|
import sys
|
|
from datetime import datetime, timezone
|
|
|
|
golden_path = pathlib.Path(sys.argv[1])
|
|
candidate_path = pathlib.Path(sys.argv[2])
|
|
report_path = pathlib.Path(sys.argv[3])
|
|
|
|
# SEC-09 (M-10): cap input size (SequenceMatcher is O(n^2) → DoS) and read
|
|
# fail-closed. A missing/oversize/undecodable input yields a BLOCK verdict, never
|
|
# a crash/traceback (which under set -e would abort ambiguously) and never a silent
|
|
# pass.
|
|
MAX_BYTES = int(os.environ.get("CASAN_MAX_INPUT_BYTES", str(2 * 1024 * 1024)))
|
|
|
|
|
|
def block(reason):
|
|
report_path.parent.mkdir(parents=True, exist_ok=True)
|
|
report = {
|
|
"timestamp": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
|
|
"harness": "L5-drift-detection", "status": "fail", "action": "block",
|
|
"reason": reason, "golden_file": str(golden_path), "candidate_file": str(candidate_path),
|
|
}
|
|
report_path.write_text(json.dumps(report, indent=2) + "\n", encoding="utf-8")
|
|
print(f"DRIFT_FAIL reason={reason} report={report_path}")
|
|
raise SystemExit(2)
|
|
|
|
|
|
def read_capped(path):
|
|
try:
|
|
size = path.stat().st_size
|
|
except OSError:
|
|
block(f"unreadable:{path.name}")
|
|
if size > MAX_BYTES:
|
|
block(f"oversize:{path.name}({size}>{MAX_BYTES})")
|
|
try:
|
|
# errors="replace" so non-UTF8 bytes degrade to a marker instead of crashing.
|
|
return path.read_text(encoding="utf-8", errors="replace")
|
|
except OSError:
|
|
block(f"unreadable:{path.name}")
|
|
|
|
|
|
golden = read_capped(golden_path)
|
|
candidate = read_capped(candidate_path)
|
|
|
|
similarity = difflib.SequenceMatcher(None, golden, candidate).ratio()
|
|
length_delta = abs(len(candidate) - len(golden)) / max(len(golden), 1)
|
|
|
|
status = "pass"
|
|
action = "allow"
|
|
if similarity < 0.70 or length_delta > 0.50:
|
|
status = "fail"
|
|
action = "block_or_fallback"
|
|
elif similarity < 0.85 or length_delta > 0.30:
|
|
status = "warn"
|
|
action = "require_review"
|
|
|
|
report = {
|
|
"timestamp": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
|
|
"harness": "L5-drift-detection",
|
|
"status": status,
|
|
"action": action,
|
|
"similarity_ratio": round(similarity, 4),
|
|
"length_delta_ratio": round(length_delta, 4),
|
|
"golden_hash": hashlib.sha256(golden.encode()).hexdigest(),
|
|
"candidate_hash": hashlib.sha256(candidate.encode()).hexdigest(),
|
|
"golden_file": str(golden_path),
|
|
"candidate_file": str(candidate_path),
|
|
}
|
|
|
|
report_path.write_text(json.dumps(report, indent=2) + "\n", encoding="utf-8")
|
|
print(f"DRIFT_{status.upper()} similarity={report['similarity_ratio']} length_delta={report['length_delta_ratio']} report={report_path}")
|
|
|
|
if status == "fail":
|
|
raise SystemExit(2)
|
|
PY
|