thanhnvandClaude Opus 4.8
664bd1f00c
Physically move the pure-code subtrees out of .specify into the package, leaving compat symlinks at the old .specify/<dir> paths so every existing reference (internal CASAN_HARNESS_ROOT + external CI/docker/mjs) keeps resolving. Runtime state stays put. Moved (git mv): scripts/ tests/ security/ templates/ config/ governance/ memory/ .specify/<dir> -> packages/casan-harness/<dir> (+ .specify/<dir> symlink) Stays in .specify (state/governance/domain, handled later): logs/ agentops/ level5/ init-options.json traceability-map.json Python `.resolve()` self-location followed the compat symlink into packages and lost the app root; generate-casan-demo-context.py, generate-agentops-dashboard.py and dashboard-server.py now walk UP for the `.specify` state marker instead of a fixed parent depth (fixes "missing trace files" in run-casan4). Full gate: PASS=64 FAIL=0 SKIP=3 (CASAN_CI_STEP_TIMEOUT_SEC=1200 — track-a ~450s runs close to the 600s default and can tip over under load; this is timing variance, not a regression — it passed cleanly with headroom). Runtime log/audit artifacts kept unstaged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
88 lines
3.8 KiB
Bash
88 lines
3.8 KiB
Bash
#!/usr/bin/env bash
|
|
set -uo pipefail
|
|
|
|
# CASAN — Model-digest pinning (Plan-07 B4 / V16, trust the model backend).
|
|
#
|
|
# An attacker who swaps or poisons the local model (e.g. re-tags a different
|
|
# ornith:9b) changes CASAN's behaviour with no code change. This pins the
|
|
# approved model's content digest and refuses (or warns) when the live digest
|
|
# no longer matches — so a silent model swap is detected.
|
|
#
|
|
# Digest source: Ollama /api/tags (real) or CASAN_MODEL_DIGEST (override, for
|
|
# CI/tests). If neither is available the check SKIPs (cannot verify).
|
|
#
|
|
# Usage:
|
|
# model-digest-check.sh pin [model] # record the current digest as approved
|
|
# model-digest-check.sh verify [model] # compare live digest to the pinned one
|
|
# model-digest-check.sh show [model]
|
|
# Env: CASAN_MODEL (default ornith:9b) · CASAN_MODEL_DIGEST (override) ·
|
|
# CASAN_MODEL_DIGEST_PIN (pin file) · CASAN_MODEL_DIGEST_MODE=block|warn ·
|
|
# OLLAMA_HOST (default 127.0.0.1:11434)
|
|
# Exit: 0 match/pinned/warned · 2 MISMATCH in block mode · 3 unpinned/undeterminable.
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/casan-paths.sh"
|
|
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
|
PIN_FILE="${CASAN_MODEL_DIGEST_PIN:-$CASAN_HARNESS_ROOT/security/model-digest.pin}"
|
|
mkdir -p "$(dirname "$PIN_FILE")"
|
|
CMD="${1:-verify}"
|
|
MODEL="${2:-${CASAN_MODEL:-ornith:9b}}"
|
|
OLLAMA="${OLLAMA_HOST:-127.0.0.1:11434}"
|
|
|
|
current_digest() {
|
|
# 1) explicit override (deterministic for CI/tests) — DISABLED in enforced mode.
|
|
# SEC-14 / M-03 / SC-03: an attacker who swaps the local model could also set
|
|
# CASAN_MODEL_DIGEST to the pinned value and defeat the check. Under
|
|
# CASAN_PROFILE=prod (or CASAN_MODEL_DIGEST_STRICT=1) the override is never
|
|
# trusted — the digest must come from the live model backend.
|
|
if [[ -n "${CASAN_MODEL_DIGEST:-}" ]]; then
|
|
if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_MODEL_DIGEST_STRICT:-}" == "1" ]]; then
|
|
echo "MODEL_DIGEST_OVERRIDE_IGNORED enforced mode ignores CASAN_MODEL_DIGEST; using live digest" >&2
|
|
else
|
|
printf '%s' "$CASAN_MODEL_DIGEST"; return 0
|
|
fi
|
|
fi
|
|
# 2) live Ollama
|
|
local d
|
|
d="$(curl -sf "http://$OLLAMA/api/tags" 2>/dev/null | \
|
|
python3 -c "import json,sys
|
|
m=sys.argv[1]
|
|
try: d=json.load(sys.stdin)
|
|
except Exception: sys.exit(1)
|
|
for x in d.get('models',[]):
|
|
if x.get('name')==m: print(x.get('digest','')); break" "$MODEL" 2>/dev/null)"
|
|
[[ -n "$d" ]] && { printf '%s' "$d"; return 0; }
|
|
return 1
|
|
}
|
|
|
|
pinned_digest() { awk -v m="$MODEL" '$1==m {print $2; exit}' "$PIN_FILE" 2>/dev/null; }
|
|
|
|
case "$CMD" in
|
|
pin)
|
|
D="$(current_digest)" || { echo "MODEL_DIGEST_UNAVAILABLE model=$MODEL (Ollama down + no CASAN_MODEL_DIGEST)" >&2; exit 3; }
|
|
tmp="$(mktemp)"; grep -v "^$MODEL " "$PIN_FILE" 2>/dev/null > "$tmp" || true
|
|
printf '%s\t%s\n' "$MODEL" "$D" >> "$tmp"; mv "$tmp" "$PIN_FILE"
|
|
echo "MODEL_DIGEST_PINNED model=$MODEL digest=${D:0:24}…"
|
|
;;
|
|
verify)
|
|
P="$(pinned_digest)"
|
|
[[ -n "$P" ]] || { echo "MODEL_DIGEST_UNPINNED model=$MODEL (run: model-digest-check.sh pin)" >&2; exit 3; }
|
|
D="$(current_digest)" || { echo "MODEL_DIGEST_UNAVAILABLE model=$MODEL — cannot verify" >&2; exit 3; }
|
|
if [[ "$D" == "$P" ]]; then
|
|
echo "MODEL_DIGEST_OK model=$MODEL digest=${D:0:24}…"
|
|
exit 0
|
|
fi
|
|
if [[ "${CASAN_MODEL_DIGEST_MODE:-block}" == "warn" ]]; then
|
|
echo "MODEL_DIGEST_WARN model=$MODEL pinned=${P:0:24}… live=${D:0:24}… — model may have been swapped/poisoned" >&2
|
|
exit 0
|
|
fi
|
|
echo "MODEL_DIGEST_MISMATCH model=$MODEL pinned=${P:0:24}… live=${D:0:24}… — model may have been swapped/poisoned" >&2
|
|
exit 2
|
|
;;
|
|
show)
|
|
echo "model=$MODEL pinned=$(pinned_digest || echo none) live=$(current_digest || echo unavailable)"
|
|
;;
|
|
*)
|
|
echo "Usage: model-digest-check.sh {pin|verify|show} [model]" >&2; exit 64 ;;
|
|
esac
|