CASAN/AINative_OKR_CASAN5/docs/output/casan/phase3-preflight.md

CASAN Phase 3 Preflight Report

Date: 2026-06-30 Repo root: /Users/thanhnguyen/Documents/AI/HarnessHkt/Harness_Hakathon/Output_CASAN5_REFINED/AINative_OKR_CASAN5

Evidence Files

• docs/output/casan/phase3-evidence/preflight/git.txt
• docs/output/casan/phase3-evidence/preflight/mac-toolchain.txt
• docs/output/casan/phase3-evidence/preflight/cloud-env-presence.txt
• docs/output/casan/phase3-evidence/preflight/linux-server.txt
• docs/output/casan/phase3-evidence/preflight/ollama-mac.txt
• docs/output/casan/phase3-evidence/preflight/ollama-linux-via-tunnel.txt
• docs/output/casan/phase3-evidence/preflight/ollama-linux-via-tunnel-generate.json
• docs/output/casan/phase3-evidence/preflight/npm-audit-high.txt
• docs/output/casan/phase3-evidence/preflight/npm-audit-high.exit
• docs/output/casan/phase3-evidence/preflight/npm-audit.json
• docs/output/casan/phase3-evidence/preflight/npm-audit-json.exit
• docs/output/casan/phase3-evidence/preflight/npm-test.txt
• docs/output/casan/phase3-evidence/preflight/npm-build.txt

Git

Status: git repository detected.

• git rev-parse --is-inside-work-tree: true
• Branch: main
• Current untracked files include:
  • docs/output/casan/phase3-evidence/
  • docs/output/casan/phase3-push-to-90-plan.md
  • docs/output/casan/phase3-security-hardening-plan.md

Implication: Phase 3 can use git-based diffs/commits if desired, but untracked evidence and plan files should be handled intentionally.

Mac Runtime

• macOS: 26.5.1, arm64
• Node: v24.12.0
• npm: 11.7.0
• Python: 3.9.0
• Bash: 3.2.57
• curl: 8.7.1

Linux Server Runtime

SSH target used by operator: thanh nv account on 192.168.1.5.

• OS: Ubuntu 26.04 LTS
• Kernel: 7.0.0-14-generic
• Architecture: x86_64
• Node: v22.23.1
• npm: 11.17.0
• Python: 3.14.4
• Ollama: 0.30.11

Model Availability

Cloud model env on Mac:

• CASAN_MODEL_PRIMARY=unset
• CASAN_MODEL_SECONDARY=unset
• ANTHROPIC_API_KEY=unset
• OPENAI_API_KEY=unset

Cloud status: unavailable for current preflight.

Local model strategy:

• Ollama is used on Linux server, not directly on Mac.
• Mac reaches Linux Ollama through SSH tunnel exposed as http://127.0.0.1:11434.
• Primary local model: ollama:ornith:9b
• Available Linux Ollama models:
  • ornith:9b, digest a75697c145891910e312c95e4a9fc1ccb8653e5ef543b23b0403a4665b82fd91
  • gemma4:12b, digest 4eb23ef187e2c5462566d6a1d3bbbc2f1346d0b4327cbb66d58fffbcc9b2b05c

Generate smoke test:

• ollama-linux-via-tunnel-generate.json returned response OK.
• Real usage fields were present:
  • prompt_eval_count: 72
  • eval_count: 27
  • total_duration: 10540918012 ns

npm Audit

npm audit --workspaces --audit-level=high exit code: 1.

Audit summary from JSON:

• Total vulnerabilities: 12
• High: 5
• Moderate: 7
• Critical: 0

High-risk packages reported include:

• multer <=2.1.1, via @nestjs/platform-express
• tar <=7.5.15, via @mapbox/node-pre-gyp

Implication: Phase 3 supply-chain work should not claim green until high vulnerabilities are addressed or a documented accepted-risk decision is made.

Baseline Test / Build

Current captured baseline is blocked:

• npm test: failed
• npm run build: failed
• Immediate cause in both logs: sh: prisma: command not found

This means current local dependency state is incomplete or PATH/package installation is inconsistent at the time of preflight. Before Phase 3 implementation claims any pass state, rerun:

npm install
npm test
npm run build

and capture refreshed logs under docs/output/casan/phase3-evidence/preflight/.

Preflight Decision

Proceed with Phase 3 Wave 1 only after resolving the local dependency issue or explicitly marking app baseline as blocked.

Recommended environment for Wave 1:

export CASAN_MODEL_BACKEND=local
export CASAN_MODEL_PRIMARY=ollama:ornith:9b
export CASAN_MODEL_SECONDARY=ollama:ornith:9b

Required tunnel while running model-router tests on Mac:

ssh -N -L 11434:127.0.0.1:11434 thanhnv@192.168.1.5

No cloud-backed judge/classifier should be claimed until Anthropic or OpenAI credentials are actually present.