thanhnvandClaude Opus 4.8
664bd1f00c
Physically move the pure-code subtrees out of .specify into the package, leaving compat symlinks at the old .specify/<dir> paths so every existing reference (internal CASAN_HARNESS_ROOT + external CI/docker/mjs) keeps resolving. Runtime state stays put. Moved (git mv): scripts/ tests/ security/ templates/ config/ governance/ memory/ .specify/<dir> -> packages/casan-harness/<dir> (+ .specify/<dir> symlink) Stays in .specify (state/governance/domain, handled later): logs/ agentops/ level5/ init-options.json traceability-map.json Python `.resolve()` self-location followed the compat symlink into packages and lost the app root; generate-casan-demo-context.py, generate-agentops-dashboard.py and dashboard-server.py now walk UP for the `.specify` state marker instead of a fixed parent depth (fixes "missing trace files" in run-casan4). Full gate: PASS=64 FAIL=0 SKIP=3 (CASAN_CI_STEP_TIMEOUT_SEC=1200 — track-a ~450s runs close to the 600s default and can tip over under load; this is timing variance, not a regression — it passed cleanly with headroom). Runtime log/audit artifacts kept unstaged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
119 lines
4.7 KiB
Bash
Executable File
119 lines
4.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -uo pipefail
|
|
|
|
# CASAN H5 — Telemetry integrity proof (Track A, V9).
|
|
#
|
|
# Token/cost telemetry (provider-usage.jsonl, cost/metrics.jsonl) previously sat
|
|
# OUTSIDE the signed audit chain, so a forger could rewrite token counts to hide
|
|
# cost abuse and nothing would detect it. This binds those files to a signed
|
|
# manifest: any byte change flips the manifest head hash, and because the head
|
|
# is RSA-signed with an off-repo key, a forger cannot re-sign a rewritten head.
|
|
#
|
|
# Usage:
|
|
# telemetry-integrity.sh sign — hash telemetry files, write + sign manifest head
|
|
# telemetry-integrity.sh verify — recompute, compare head, verify signature
|
|
#
|
|
# Key resolution (sign): CASAN_AUDIT_PRIV, else level5/central-governance/audit-private.pem
|
|
# Key resolution (verify): CASAN_AUDIT_PUB, else level5/central-governance/audit-public.pem
|
|
#
|
|
# Outputs (under .specify/logs/level5/):
|
|
# telemetry-manifest.json — {basename: sha256} for each telemetry file
|
|
# telemetry-head.txt — sha256 over the canonical manifest text
|
|
# telemetry-head.sig — RSA signature of telemetry-head.txt (when a key exists)
|
|
#
|
|
# Exit: 0 ok, 1 tamper/mismatch/invalid-signature, 64 usage.
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/casan-paths.sh"
|
|
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
|
L5_DIR="$CASAN_STATE_ROOT/logs/level5"
|
|
COST_DIR="$CASAN_STATE_ROOT/logs/cost"
|
|
mkdir -p "$L5_DIR"
|
|
|
|
CMD="${1:-}"
|
|
MANIFEST="$L5_DIR/telemetry-manifest.json"
|
|
HEAD_FILE="$L5_DIR/telemetry-head.txt"
|
|
HEAD_SIG="$L5_DIR/telemetry-head.sig"
|
|
AUDIT_PRIV="${CASAN_AUDIT_PRIV:-$CASAN_GOVERNANCE_ROOT/audit-private.pem}"
|
|
AUDIT_PUB="${CASAN_AUDIT_PUB:-$CASAN_GOVERNANCE_ROOT/audit-public.pem}"
|
|
|
|
# Telemetry files to bind. Missing files hash to the literal "MISSING" so the
|
|
# manifest is stable and a deletion is itself a detectable change.
|
|
TELEMETRY_FILES=(
|
|
"$L5_DIR/provider-usage.jsonl"
|
|
"$COST_DIR/metrics.jsonl"
|
|
)
|
|
|
|
compute_head() {
|
|
# Prints: manifest-json on line 1, head-hash on line 2.
|
|
python - "$@" <<'PY'
|
|
import hashlib, json, os, sys
|
|
files = sys.argv[1:]
|
|
manifest = {}
|
|
for path in files:
|
|
name = os.path.basename(path)
|
|
if os.path.isfile(path):
|
|
with open(path, "rb") as f:
|
|
manifest[name] = hashlib.sha256(f.read()).hexdigest()
|
|
else:
|
|
manifest[name] = "MISSING"
|
|
canonical = json.dumps(manifest, sort_keys=True, separators=(",", ":"))
|
|
head = hashlib.sha256(canonical.encode()).hexdigest()
|
|
print(canonical)
|
|
print(head)
|
|
PY
|
|
}
|
|
|
|
case "$CMD" in
|
|
sign)
|
|
OUT="$(compute_head "${TELEMETRY_FILES[@]}")"
|
|
CANON="$(printf '%s' "$OUT" | sed -n '1p')"
|
|
HEAD="$(printf '%s' "$OUT" | sed -n '2p')"
|
|
printf '%s' "$CANON" > "$MANIFEST"
|
|
printf '%s' "$HEAD" > "$HEAD_FILE"
|
|
if [[ -f "$AUDIT_PRIV" ]] && command -v openssl >/dev/null 2>&1; then
|
|
openssl dgst -sha256 -sign "$AUDIT_PRIV" -out "$HEAD_SIG" "$HEAD_FILE"
|
|
echo "TELEMETRY_INTEGRITY_SIGNED head=$HEAD anchor=signed files=${#TELEMETRY_FILES[@]}"
|
|
else
|
|
rm -f "$HEAD_SIG"
|
|
echo "TELEMETRY_INTEGRITY_SIGNED head=$HEAD anchor=unsigned files=${#TELEMETRY_FILES[@]} (no private key)"
|
|
fi
|
|
;;
|
|
verify)
|
|
if [[ ! -f "$HEAD_FILE" ]]; then
|
|
echo "TELEMETRY_INTEGRITY_MISSING no telemetry-head.txt (run: telemetry-integrity.sh sign)" >&2
|
|
exit 1
|
|
fi
|
|
OUT="$(compute_head "${TELEMETRY_FILES[@]}")"
|
|
HEAD_NOW="$(printf '%s' "$OUT" | sed -n '2p')"
|
|
HEAD_STORED="$(cat "$HEAD_FILE")"
|
|
if [[ "$HEAD_NOW" != "$HEAD_STORED" ]]; then
|
|
echo "TELEMETRY_INTEGRITY_MISMATCH computed=$HEAD_NOW stored=$HEAD_STORED" >&2
|
|
exit 1
|
|
fi
|
|
if [[ -f "$HEAD_SIG" && -f "$AUDIT_PUB" ]] && command -v openssl >/dev/null 2>&1; then
|
|
if ! openssl dgst -sha256 -verify "$AUDIT_PUB" -signature "$HEAD_SIG" "$HEAD_FILE" >/dev/null 2>&1; then
|
|
echo "TELEMETRY_INTEGRITY_SIGNATURE_INVALID head=$HEAD_STORED" >&2
|
|
exit 1
|
|
fi
|
|
echo "TELEMETRY_INTEGRITY_VALID anchor=signed head=$HEAD_STORED"
|
|
else
|
|
# SEC-01 (H-01): enforced mode treats a missing/unverifiable signature as FAIL,
|
|
# otherwise deleting telemetry-head.sig after rewriting token counts would pass.
|
|
if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_VERIFY_STRICT:-}" == "1" ]]; then
|
|
MISSING=""
|
|
[[ -f "$HEAD_SIG" ]] || MISSING="$MISSING head-sig"
|
|
[[ -f "$AUDIT_PUB" ]] || MISSING="$MISSING pubkey"
|
|
command -v openssl >/dev/null 2>&1 || MISSING="$MISSING openssl"
|
|
echo "TELEMETRY_INTEGRITY_UNSIGNED_STRICT_FAIL head=$HEAD_STORED missing=${MISSING# }" >&2
|
|
exit 1
|
|
fi
|
|
echo "TELEMETRY_INTEGRITY_VALID anchor=unsigned head=$HEAD_STORED"
|
|
fi
|
|
;;
|
|
*)
|
|
echo "Usage: telemetry-integrity.sh {sign|verify}" >&2
|
|
exit 64
|
|
;;
|
|
esac
|