thanhnvandClaude Opus 4.8
36a4812ef3
Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.
- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
.specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
- .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
-> packages/casan-harness/... (.specify/logs state kept)
- .claude/launch.json, .gitea/*-runbook.md: path prefixes
- CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
- policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.
Full gate from the new root: PASS=64 FAIL=0 SKIP=3.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
88 lines
3.8 KiB
Bash
88 lines
3.8 KiB
Bash
#!/usr/bin/env bash
|
|
set -uo pipefail
|
|
|
|
# CASAN — Model-digest pinning (Plan-07 B4 / V16, trust the model backend).
|
|
#
|
|
# An attacker who swaps or poisons the local model (e.g. re-tags a different
|
|
# ornith:9b) changes CASAN's behaviour with no code change. This pins the
|
|
# approved model's content digest and refuses (or warns) when the live digest
|
|
# no longer matches — so a silent model swap is detected.
|
|
#
|
|
# Digest source: Ollama /api/tags (real) or CASAN_MODEL_DIGEST (override, for
|
|
# CI/tests). If neither is available the check SKIPs (cannot verify).
|
|
#
|
|
# Usage:
|
|
# model-digest-check.sh pin [model] # record the current digest as approved
|
|
# model-digest-check.sh verify [model] # compare live digest to the pinned one
|
|
# model-digest-check.sh show [model]
|
|
# Env: CASAN_MODEL (default ornith:9b) · CASAN_MODEL_DIGEST (override) ·
|
|
# CASAN_MODEL_DIGEST_PIN (pin file) · CASAN_MODEL_DIGEST_MODE=block|warn ·
|
|
# OLLAMA_HOST (default 127.0.0.1:11434)
|
|
# Exit: 0 match/pinned/warned · 2 MISMATCH in block mode · 3 unpinned/undeterminable.
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/casan-paths.sh"
|
|
PROJECT_ROOT="$CASAN_APP_ROOT"
|
|
PIN_FILE="${CASAN_MODEL_DIGEST_PIN:-$CASAN_HARNESS_ROOT/security/model-digest.pin}"
|
|
mkdir -p "$(dirname "$PIN_FILE")"
|
|
CMD="${1:-verify}"
|
|
MODEL="${2:-${CASAN_MODEL:-ornith:9b}}"
|
|
OLLAMA="${OLLAMA_HOST:-127.0.0.1:11434}"
|
|
|
|
current_digest() {
|
|
# 1) explicit override (deterministic for CI/tests) — DISABLED in enforced mode.
|
|
# SEC-14 / M-03 / SC-03: an attacker who swaps the local model could also set
|
|
# CASAN_MODEL_DIGEST to the pinned value and defeat the check. Under
|
|
# CASAN_PROFILE=prod (or CASAN_MODEL_DIGEST_STRICT=1) the override is never
|
|
# trusted — the digest must come from the live model backend.
|
|
if [[ -n "${CASAN_MODEL_DIGEST:-}" ]]; then
|
|
if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_MODEL_DIGEST_STRICT:-}" == "1" ]]; then
|
|
echo "MODEL_DIGEST_OVERRIDE_IGNORED enforced mode ignores CASAN_MODEL_DIGEST; using live digest" >&2
|
|
else
|
|
printf '%s' "$CASAN_MODEL_DIGEST"; return 0
|
|
fi
|
|
fi
|
|
# 2) live Ollama
|
|
local d
|
|
d="$(curl -sf "http://$OLLAMA/api/tags" 2>/dev/null | \
|
|
python3 -c "import json,sys
|
|
m=sys.argv[1]
|
|
try: d=json.load(sys.stdin)
|
|
except Exception: sys.exit(1)
|
|
for x in d.get('models',[]):
|
|
if x.get('name')==m: print(x.get('digest','')); break" "$MODEL" 2>/dev/null)"
|
|
[[ -n "$d" ]] && { printf '%s' "$d"; return 0; }
|
|
return 1
|
|
}
|
|
|
|
pinned_digest() { awk -v m="$MODEL" '$1==m {print $2; exit}' "$PIN_FILE" 2>/dev/null; }
|
|
|
|
case "$CMD" in
|
|
pin)
|
|
D="$(current_digest)" || { echo "MODEL_DIGEST_UNAVAILABLE model=$MODEL (Ollama down + no CASAN_MODEL_DIGEST)" >&2; exit 3; }
|
|
tmp="$(mktemp)"; grep -v "^$MODEL " "$PIN_FILE" 2>/dev/null > "$tmp" || true
|
|
printf '%s\t%s\n' "$MODEL" "$D" >> "$tmp"; mv "$tmp" "$PIN_FILE"
|
|
echo "MODEL_DIGEST_PINNED model=$MODEL digest=${D:0:24}…"
|
|
;;
|
|
verify)
|
|
P="$(pinned_digest)"
|
|
[[ -n "$P" ]] || { echo "MODEL_DIGEST_UNPINNED model=$MODEL (run: model-digest-check.sh pin)" >&2; exit 3; }
|
|
D="$(current_digest)" || { echo "MODEL_DIGEST_UNAVAILABLE model=$MODEL — cannot verify" >&2; exit 3; }
|
|
if [[ "$D" == "$P" ]]; then
|
|
echo "MODEL_DIGEST_OK model=$MODEL digest=${D:0:24}…"
|
|
exit 0
|
|
fi
|
|
if [[ "${CASAN_MODEL_DIGEST_MODE:-block}" == "warn" ]]; then
|
|
echo "MODEL_DIGEST_WARN model=$MODEL pinned=${P:0:24}… live=${D:0:24}… — model may have been swapped/poisoned" >&2
|
|
exit 0
|
|
fi
|
|
echo "MODEL_DIGEST_MISMATCH model=$MODEL pinned=${P:0:24}… live=${D:0:24}… — model may have been swapped/poisoned" >&2
|
|
exit 2
|
|
;;
|
|
show)
|
|
echo "model=$MODEL pinned=$(pinned_digest || echo none) live=$(current_digest || echo unavailable)"
|
|
;;
|
|
*)
|
|
echo "Usage: model-digest-check.sh {pin|verify|show} [model]" >&2; exit 64 ;;
|
|
esac
|