thanhnvandClaude Opus 4.8
e21a1472b1
Under CASAN_APPROVAL_STRICT=1, a high-risk approval is trusted ONLY when a REGISTERED reviewer cryptographically signs THIS exact request and their role is authorized for the action — a plain env-var CASAN_APPROVER is no longer enough. - approval-sign.sh: reviewer signs assertion "casan-approval|v1|<action>|<actor>|<input_sha256>|<approver_id>" with their key. - approval-verify.sh: gate looks up reviewer role+pubkey in reviewers.registry, enforces role→action authorization, verifies the RSA signature (fail-closed). - governance-check.sh: strict branch requires a valid signed approval; SoD still enforced; default (non-strict) env-var path UNCHANGED (baseline preserved). - reviewers.registry: role-scoped reviewer identity registry (pubkeys off-repo; production replaces with OIDC/JWT from a real IdP). - phase-h5-approval-tests.sh: 8 checks — valid/authorized approve; unsigned, wrong-role, forged-key, unregistered, replay-to-other-request, self-approval all denied; non-strict backward-compat. Baselines: run-casan4 35/35, adversarial 44/44. Lifts H5 policy-approval (C4) 2.5 -> ~3.5-4 / 5. Total suites now 6 (+8 checks = 148). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>