CASAN

T

thanhnvandClaude Opus 4.8 c51e0f88a3 feat(track-c-mvp): C1 action gating + C2 supply-chain gate

C1 (V17) action-gate.sh: gates the ACTION, not just the tool name. Outcome model
  ALLOW/WARN/REQUIRE_APPROVAL/BLOCK. BLOCK on sensitive-file writes (.env, *.pem,
  id_rsa, .github/workflows, .ssh, .aws/credentials, .npmrc) and destructive/
  remote-exec commands (rm -rf /, curl|bash, chmod 777, git push --force);
  REQUIRE_APPROVAL on dependency installs and non-local network egress (clears
  only with an audited CASAN_ACTION_APPROVER). Decisions logged to action-gate.jsonl.
C2 (V18) supply-chain-gate.sh + supply-chain-scan.py: diffs package.json /
  requirements.txt / pom.xml / build.gradle against a baseline (explicit or git
  HEAD). BLOCK on denylisted/known-malicious packages, typosquats (edit-distance 1
  to a known package), and dangerous lifecycle scripts (pre/post/install);
  REQUIRE_APPROVAL on any new dependency. Emits a dep-diff report and records
  which live scanners (npm audit / pip-audit / osv-scanner) are available.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-03 22:51:43 +09:00

.gitea/workflows

fix(ci): self-heal mysql env-file read access in deploy preflight

2026-07-01 22:09:53 +09:00

00_SUBMISSION_PACKAGE

chore(freeze): snapshot demo state before Plan-07 hardening work

2026-07-03 22:03:44 +09:00

AINative_OKR_CASAN5

feat(track-c-mvp): C1 action gating + C2 supply-chain gate

2026-07-03 22:51:43 +09:00

casan-next-plans

chore(freeze): snapshot demo state before Plan-07 hardening work