Files
CASAN/AINative_OKR_CASAN5/docs/output/casan/phase3-preflight.md
T

139 lines
4.1 KiB
Markdown

# CASAN Phase 3 Preflight Report
Date: 2026-06-30
Repo root: `/Users/thanhnguyen/Documents/AI/HarnessHkt/Harness_Hakathon/Output_CASAN5_REFINED/AINative_OKR_CASAN5`
## Evidence Files
- `docs/output/casan/phase3-evidence/preflight/git.txt`
- `docs/output/casan/phase3-evidence/preflight/mac-toolchain.txt`
- `docs/output/casan/phase3-evidence/preflight/cloud-env-presence.txt`
- `docs/output/casan/phase3-evidence/preflight/linux-server.txt`
- `docs/output/casan/phase3-evidence/preflight/ollama-mac.txt`
- `docs/output/casan/phase3-evidence/preflight/ollama-linux-via-tunnel.txt`
- `docs/output/casan/phase3-evidence/preflight/ollama-linux-via-tunnel-generate.json`
- `docs/output/casan/phase3-evidence/preflight/npm-audit-high.txt`
- `docs/output/casan/phase3-evidence/preflight/npm-audit-high.exit`
- `docs/output/casan/phase3-evidence/preflight/npm-audit.json`
- `docs/output/casan/phase3-evidence/preflight/npm-audit-json.exit`
- `docs/output/casan/phase3-evidence/preflight/npm-test.txt`
- `docs/output/casan/phase3-evidence/preflight/npm-build.txt`
## Git
Status: git repository detected.
- `git rev-parse --is-inside-work-tree`: `true`
- Branch: `main`
- Current untracked files include:
- `docs/output/casan/phase3-evidence/`
- `docs/output/casan/phase3-push-to-90-plan.md`
- `docs/output/casan/phase3-security-hardening-plan.md`
Implication: Phase 3 can use git-based diffs/commits if desired, but untracked evidence and plan files should be handled intentionally.
## Mac Runtime
- macOS: 26.5.1, arm64
- Node: v24.12.0
- npm: 11.7.0
- Python: 3.9.0
- Bash: 3.2.57
- curl: 8.7.1
## Linux Server Runtime
SSH target used by operator: `thanh nv` account on `192.168.1.5`.
- OS: Ubuntu 26.04 LTS
- Kernel: `7.0.0-14-generic`
- Architecture: x86_64
- Node: v22.23.1
- npm: 11.17.0
- Python: 3.14.4
- Ollama: 0.30.11
## Model Availability
Cloud model env on Mac:
- `CASAN_MODEL_PRIMARY=unset`
- `CASAN_MODEL_SECONDARY=unset`
- `ANTHROPIC_API_KEY=unset`
- `OPENAI_API_KEY=unset`
Cloud status: unavailable for current preflight.
Local model strategy:
- Ollama is used on Linux server, not directly on Mac.
- Mac reaches Linux Ollama through SSH tunnel exposed as `http://127.0.0.1:11434`.
- Primary local model: `ollama:ornith:9b`
- Available Linux Ollama models:
- `ornith:9b`, digest `a75697c145891910e312c95e4a9fc1ccb8653e5ef543b23b0403a4665b82fd91`
- `gemma4:12b`, digest `4eb23ef187e2c5462566d6a1d3bbbc2f1346d0b4327cbb66d58fffbcc9b2b05c`
Generate smoke test:
- `ollama-linux-via-tunnel-generate.json` returned response `OK`.
- Real usage fields were present:
- `prompt_eval_count`: 72
- `eval_count`: 27
- `total_duration`: 10540918012 ns
## npm Audit
`npm audit --workspaces --audit-level=high` exit code: `1`.
Audit summary from JSON:
- Total vulnerabilities: 12
- High: 5
- Moderate: 7
- Critical: 0
High-risk packages reported include:
- `multer <=2.1.1`, via `@nestjs/platform-express`
- `tar <=7.5.15`, via `@mapbox/node-pre-gyp`
Implication: Phase 3 supply-chain work should not claim green until high vulnerabilities are addressed or a documented accepted-risk decision is made.
## Baseline Test / Build
Current captured baseline is blocked:
- `npm test`: failed
- `npm run build`: failed
- Immediate cause in both logs: `sh: prisma: command not found`
This means current local dependency state is incomplete or PATH/package installation is inconsistent at the time of preflight. Before Phase 3 implementation claims any pass state, rerun:
```bash
npm install
npm test
npm run build
```
and capture refreshed logs under `docs/output/casan/phase3-evidence/preflight/`.
## Preflight Decision
Proceed with Phase 3 Wave 1 only after resolving the local dependency issue or explicitly marking app baseline as blocked.
Recommended environment for Wave 1:
```bash
export CASAN_MODEL_BACKEND=local
export CASAN_MODEL_PRIMARY=ollama:ornith:9b
export CASAN_MODEL_SECONDARY=ollama:ornith:9b
```
Required tunnel while running model-router tests on Mac:
```bash
ssh -N -L 11434:127.0.0.1:11434 thanhnv@192.168.1.5
```
No cloud-backed judge/classifier should be claimed until Anthropic or OpenAI credentials are actually present.