thanhnvandClaude Opus 4.8
fa3dd94c76
The plan set (Plan-00..18, backlog/hardening/QA status, team allocation) is the ONGOING roadmap, not a finished competition artifact — restored from history into docs/plans/. Plan-01 (restructure) marked ✅ done; the rest remain to do. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
24 KiB
24 KiB
CASAN Production Hardening — Implementation Status
Live record of what has been implemented and tested from Plan-07 (Production Hardening) and Plan-09 (Evidence Pack), versus what is still planned. Honest by design: a control is only listed as done when it has an executable test that would fail if the control were removed.
Labels: [implemented+tested] · [scaffold+tested] (works, but a stronger production form is documented as TODO) · [planned] (not built).
Vai trò file (single source of truth): file này là nguồn chuẩn cho "control nào đã implement+test". "Còn gì phải làm" →
CASAN_BACKLOG_STATUS.md(có legend chuẩn + ánh xạ nhãn). Mục lục plan →CASAN_PLAN_00_INDEX.md.
1. What is implemented now
Phase 1 — Plan-07 Track A (low-risk hardening) — [implemented+tested]
| ID | Control | Where | Test |
|---|---|---|---|
| A1 | H4 semantic strict fail-closed (CASAN_SECURITY_STRICT=1): model unavailable ⇒ BLOCK, never silent SKIP; non-strict logs SEMANTIC_SKIPPED loudly |
security-check.sh |
phase1 A1 |
| A2 | H4 unicode/encoding normalization: NFKC + zero-width strip + homoglyph fold + base64/hex decode & rescan | security-check.sh, unicode-normalize.py, decode-suspicious.py |
phase1 A2 |
| A3 | H4 tool-output injection scan before output re-enters model context (mode off/warn/block; strict⇒block) | tool-output-scan.sh, casan-harness.sh |
phase1 A3 |
| A4 | H5 telemetry integrity: provider-usage + cost metrics bound to a signed manifest head (tamper ⇒ mismatch; re-forge ⇒ signature invalid) | telemetry-integrity.sh, sign-audit-head.sh |
phase1 A4 |
| A5 | H6 cost controls: absolute per-call cap + cumulative budget + cold-start protection, keeping median×mult spike | cost-spike-detect.sh |
phase1 A5 |
| A6 | Benign corpus (EN/VI/JA, 95 samples) + FP budget gate: FP ≤ 3%, adversarial block ≥ 95%, CRITICAL = 100% | benign-fp-report.sh, benign-corpus/, redteam-vectors.jsonl |
phase1 A6 |
Phase 2 — Plan-07 Track C-MVP (production minimum bar) — mixed
| ID | Control | Status | Where | Test |
|---|---|---|---|---|
| C1 | Tool authorization / action gating (ALLOW/WARN/REQUIRE_APPROVAL/BLOCK): sensitive-file writes, destructive/remote-exec commands, dep-install & network egress | [implemented+tested] | action-gate.sh |
phase2 C1 |
| C2 | Supply-chain gate: manifest diff, denylist + typosquat + dangerous lifecycle-script block, new-dep approval, dep-diff report | [implemented+tested] | supply-chain-gate.sh, supply-chain-scan.py |
phase2 C2 |
| C3 | Data-exfil guard: secret-to-cloud & artifact-leaks-env ⇒ BLOCK; PII-in-audit ⇒ mask | [implemented+tested] | data-exfil-guard.sh |
phase2 C3 |
| C6 | Runtime sandbox: static policy block (read ~/.ssh, net egress, fork bomb, write-outside-workspace, huge-file) + ulimit/timeout backstops | [scaffold+tested] | sandbox-run.sh |
phase2 C6 |
Phase 3 — Plan-09 Evidence Pack (MVP) — [implemented+tested]
| Control | Where | Test |
|---|---|---|
casan pack / casan verify-pack (mapped to evidence-pack.sh): standard 13-file pack incl. traceability-matrix.json, hash manifest, signed head, tamper-evident verify, certified-run gate (no false certification, no silent skip) |
evidence-pack.sh, evidence-pack-build.py, evidence-pack-verify.py |
phase3-evidence-pack |
Phase 4 — H5 governance hardening (raises the lowest harness) — mixed
| ID | Control | Status | Where | Test |
|---|---|---|---|---|
| C4 | Approval-identity + mock IdP/OIDC: high-risk approval trusted only when a REGISTERED reviewer signs the request OR an IdP-signed RS256 JWT proves approver identity/role/expiry and binds to this request — env-var approver no longer enough (SoD still enforced) | [implemented+tested] (mock IdP; production JWKS still planned) | approval-sign.sh, approval-jwt-mint.py, approval-verify.sh, reviewers.registry, governance-check.sh (CASAN_APPROVAL_STRICT=1) |
phase-h5-approval (12) |
| B3 | KMS key management: sign audit/telemetry head via Vault Transit (key exportable:false → never leaves KMS) + key rotation; validated live |
[implemented+tested] (live when Vault present; skip-aware otherwise) | vault-kms.sh (rotate, assert-nonexportable), sign-audit-head.sh |
phase-h5-infra (KMS) |
| C5 | External WORM audit: ship audit head to a hash-linked append-only ledger; detect local rollback (AUDIT_GAP_DETECTED) and ledger tamper (AUDIT_LEDGER_TAMPERED) |
[implemented+tested] (local ledger MVP) | worm-ledger.py, audit-ship.sh, verify-audit-gap.sh |
phase-h5-infra (WORM) |
Phase 5 — H6 AgentOps hardening (raises the lowest harness) — mixed
| ID | Control | Status | Where | Test |
|---|---|---|---|---|
| D1 | Live alert dispatch: alerts POST to a real HTTP webhook (severity routing, dedup window, retry); undelivered alerts fail-loud (ALERT_DELIVERY_FAILED, strict) and queue to a dead-letter file with redelivery (--flush-deadletter); wired into agent-metrics.sh (failing step ⇒ live page) |
[implemented+tested] (live local webhook; production points at Slack/PagerDuty + on-call) | alert-dispatch.sh, agent-metrics.sh |
phase-h6-agentops (①) |
| D2 | Provider-telemetry API + reconciliation: pull usage from a provider usage HTTP API (all-or-nothing schema gate, PROVIDER_API_UNREACHABLE/PROVIDER_USAGE_INVALID fail-loud) + reconcile local metrics vs provider ground truth — under-reporting/hidden runs ⇒ TELEMETRY_DISCREPANCY |
[implemented+tested] (live local API endpoint; production points at OpenAI/Anthropic usage APIs) | provider-usage-fetch.sh, telemetry-reconcile.sh |
phase-h6-agentops (②) |
| D3 | Hosted dashboard: dashboard served over HTTP with a stale-aware /healthz probe (fresh ⇒ 200 ok; telemetry silent-death ⇒ 503 stale — page-able by any uptime monitor) |
[implemented+tested] (local HTTP daemon; production host = nginx/container, same routes) | dashboard-serve.sh, dashboard-server.py |
phase-h6-agentops (③) |
| D4 | Sliding-window circuit breaker (V15): failure rate over the last N calls trips CIRCUIT_OPEN_WINDOW — interleaving successes no longer evades the consecutive-failure breaker |
[implemented+tested] | circuit-breaker-check.sh |
phase-h6-agentops (④) |
Phase 6 — Deep-gap closers (Track B + C6/C7, post-competition) — mixed
| ID | Control | Status | Where | Test |
|---|---|---|---|---|
| C7 | Incident response + kill-switch (V23): incident.sh raise grades severity (LOW/MED/HIGH/CRIT via incident-severity.map), records a routed entry (owner), and for HIGH/CRIT auto-engages the scoped kill-switch.sh (project/model/provider/global) + fires an alert; casan-harness.sh refuses to run under an engaged switch (opt-in) |
[implemented+tested] | incident.sh, kill-switch.sh, incident-runbook.md, incident-severity.map |
phase-c7-incident (15) |
| B1 | Multilingual VI/JA injection (V2): VI/JA block-patterns (matched on raw UTF-8, anchored on the injection object) catch injections English regex missed, with 0 false positives on the benign VI/JA corpus | [implemented+tested] | prompt-filter.yaml (PI-VI-, PI-JA-) |
phase-h4-multilingual (7) |
| C6 | TRUE runtime isolation (V22): container sandbox (--network=none --read-only --pids-limit --cap-drop=ALL, workspace-only mount) — the kernel neutralises host-file reads / egress / out-of-workspace writes; upgrades the static scaffold |
[implemented+tested] (live via Docker; skip-aware) | sandbox-container.sh, sandbox-run.sh (CASAN_SANDBOX_MODE=container) |
phase-c6-sandbox (6) |
| B2 | Split + classifier injection (V5,V6): context-assemble-scan.sh scans the concatenated context so a payload split across benign pieces is caught on assembly; verdict-steering patterns (PI-CLS-*) block content that tries to hijack the evaluator |
[implemented+tested] | context-assemble-scan.sh, prompt-filter.yaml (PI-CLS-*) |
phase-h4-split-inject (8) |
| B4 | Model-digest pinning (V16): approved Ollama model digest pinned; router verifies live digest before generation/classify/judge; mismatch blocks by default with warn mode for rollout | [implemented+tested] | model-digest-check.sh, model-call.py, .specify/security/model-digest.pin |
phase3-model-router (digest cases) |
| Plan-10 | Traceability REQ→code→test: parse FR-*, require code+test mapping per FR, generate matrix, include it in Evidence Pack, plus symbol/line-level refs (object form {file,symbols,lines}; missing symbol/line ⇒ gate FAIL) |
[implemented+tested] | traceability-matrix.py, .specify/traceability-map.json, docs/output/casan/traceability-matrix.json |
phase10-traceability (6) |
Phase 7 — Local production-like infra lab (Tier-2 emulation) — [implemented+tested]
| Control | Status | Where | Test |
|---|---|---|---|
| Docker Compose lab for Vault KMS, OIDC/JWKS IdP, MinIO Object Lock WORM, dashboard behind nginx basic auth, alert webhook, and provider billing API mock | [implemented+tested] (local-prod emulation; managed prod services still required for Strong claim) | infra/local-prod/docker-compose.yml, infra-lab.sh |
phase-prod-infra-lab (2); infra-lab verify internal 7/0 |
Phase 8 — Plan-16 security-audit remediation (P0/P1/P2) — mixed
Adversarial audit of the harness scripts (
CASAN_PLAN_16) turned into fixes. Each control listed has an executable fail-able test in.specify/tests/phase-sec*wired intoci-harness-gate.sh. 24 SEC suites = 118 checks, 0 fail (WSL).
| ID | Control | Status | Where | Test |
|---|---|---|---|---|
| SEC-01 | Unsigned = FAIL in enforced mode (verify-audit-chain / verify-tool-audit / telemetry-integrity / evidence-pack): tamper→recompute→strip-sig no longer passes | [implemented+tested] | those verifiers (CASAN_VERIFY_STRICT/prod) |
phase-sec01 (10) |
| SEC-02 | KMS-anchor for heads, no local auto-gen key in enforced mode | [implemented+tested] | vault-kms.sh, sign-audit-head.sh |
phase-sec02 (3) |
| SEC-03 | rollback-manager: no bash -c, structured argv only (RCE closed) |
[implemented+tested] | rollback-manager.sh |
phase-sec03 (3) |
| SEC-04 | action-gate fail-closed: Python RC checked, default DENY | [implemented+tested] | action-gate.sh |
phase-sec04 (4) |
| SEC-05 | JSON-safe writers (no log-injection forged records) | [implemented+tested] | governance-check.sh, agent-metrics.sh, incident.sh |
phase-sec05 (4) |
| SEC-06 | Control-plane / governance-report signed head (no false CERTIFIED) | [implemented+tested] | control-plane-settings.py, governance-report.py |
phase-sec06 (5) |
| SEC-07..10 | Approval-JWT, pii fail-closed, input-caps/fail-closed read, non-spoofable identity | [implemented+tested] | supply-chain/self-improve/CP · pii-mask.py · security-check/drift/compress · tool-registry/agent-metrics |
phase-sec07/08/09/10 (7/4/7/5) |
| SEC-11 | Enforce-by-default (tool-output-scan/kill-switch/preflight) | ✅ consolidated into SEC-17 | CASAN_PROFILE=prod |
phase-sec17 |
| SEC-12..15 | drift-invariant, SSRF allowlist, model-digest env-override ignored in prod (SEC-14), low-cluster (typosquat≤2 / tool-exec fail-closed / nested schema recursion) | [implemented+tested] | drift-detect · provider-usage-fetch/JWKS/dashboard · model-digest-check.sh · supply-chain-scan/tool-exec/validate-tool-input |
phase-sec12/13/14/15 (5/6/5/7) |
| SEC-16..21 | bundle-integrity (ARCH-01), prod-profile enforce-by-default (ARCH-03), test-integrity (ARCH-02), atomic-store flock (ARCH-05), toolchain path-pin (ARCH-04), model/run budget (ARCH-07) | [implemented+tested] | bundle-integrity.py, test-integrity.py, atomic writes, toolchain-verify.sh, budget checks |
phase-sec16..21 (6/6/5/4/5/4) |
| SEC-27..30 | log control-char strip (X-02), path-traversal realpath (X-04), audit fail-closed on disk-fail (X-05), approval-replay nonce/jti (X-06) | [implemented+tested] | log writers, path-guard, audit append, approval-verify.sh |
phase-sec27..30 (3/4/3/3) |
| SEC-26 | stored / second-order injection (X-01): scan golden-runs/red-team corpus/traceability-map/requirement with H4 before prompt-load; stored injection → BLOCK, missing source → fail-closed | [implemented+tested] | stored-content-scan.sh (→ artifact-scan.sh) |
phase-sec26 (5) |
| SEC-22 | ARCH-06 trusted-time for exp (clock-skew defeated; file error fail-closed) + ARCH-08 untrusted-telemetry tag in self-improve (unsigned metrics → untrusted; enforced apply of an untrusted proposal BLOCKED). ARCH-10 external attestation is an external track (like TIER-2) |
[implemented+tested] | approval-verify.sh, self-improve.py |
phase-sec22 (9) |
| SEC-23 | MT-01/02/03/04 multi-tenant partition (Phase 1–5 offline): tenant-store + cross-tenant guard + secure-by-default; per-tenant control-plane settings/audit-chain + telemetry; RBAC data-boundary + casan-harness tenant-scoping; tenant kill-switch + per-tenant cost/quota; signed tenant registry (unsigned/tampered/forged → refuse); per-tenant encryption at rest (local-key; tenant B cannot read tenant A's plaintext). Only 23.11 (Vault Transit non-exportable) needs infra | [implemented+tested] (offline; 23.11 KMS planned) | tenant-store.sh, tenant-paths.sh, tenant-registry-verify.sh, tenant-crypt.sh, control-plane-settings.py, rbac-check.py, casan-harness.sh, kill-switch.sh, cost-spike-detect.sh |
phase-sec23-tenant-store (10), -state-isolation (9), -rbac-tenant (6), -scope (4), -registry-crypt (7) |
| SEC-24 | SC-05/06 (offline): image digest-pin lint (reject floating tags) + signed/verified CI workflow (unsigned/tampered/forged → refuse). Live CVE/OSV + real image scan need infra | [partial] | supply-chain-integrity.sh |
phase-sec24 (8) |
| SEC-25 | SC-07 (offline): build-artifact attestation — sign artifact hash + verify tested==deployed (swap/forged/unsigned → refuse). Signed-commit enrollment + full SLSA chain need CI/key infra | [partial] | artifact-attest.sh |
phase-sec25 (5) |
| SEC-24 | SC-04/05/06: SCA + pin runner/base-image + signed workflow | [planned] | — | — |
| SEC-25 | SC-07: signed commits + SLSA-style attestation | [planned] | — | — |
| SEC-26 | X-01: scan golden/corpus/map with H4 on prompt-load (stored injection) | [implemented+tested] | stored-content-scan.sh |
phase-sec26 (5) |
2. Test inventory (all suites)
| Suite | Checks | Purpose |
|---|---|---|
run-casan4-harness-tests.sh |
35 | Baseline happy-path + Level-5 evidence (unchanged) |
adversarial-harness-tests.sh |
44 | Original adversarial battery (unchanged) |
phase1-track-a-tests.sh |
25 | Track A hardening |
phase2-track-c-tests.sh |
29 | Track C-MVP |
phase3-evidence-pack-tests.sh |
7 | Evidence Pack MVP |
phase-h5-approval-tests.sh |
12 | Approval-identity (C4) + mock IdP/OIDC JWT |
phase-h5-infra-tests.sh |
7 | KMS (B3, live/skip-aware) + WORM (C5) |
phase-h6-agentops-tests.sh |
20 | live alerting (D1) + provider-API/reconcile (D2) + hosted dashboard (D3) + window breaker (D4); against live local HTTP endpoints |
phase-c7-incident-tests.sh |
15 | New — incident severity + scoped kill-switch (C7) + wrapper enforcement |
phase-h4-multilingual-tests.sh |
7 | New — VI/JA injection block + benign VI/JA 0-FP (B1) |
phase-c6-sandbox-tests.sh |
6 | New — TRUE container isolation (C6, live via Docker / skip-aware) |
phase-h4-split-inject-tests.sh |
8 | New — split-injection assembly scan + classifier-inject (B2) |
phase10-traceability-tests.sh |
6 | New — Plan-10 FR→code→test matrix + fail-able missing-test gate + symbol/line-level refs (missing symbol/line ⇒ FAIL) |
phase08-compression-tests.sh |
9 | New — Plan-08 CASAN-native token-killer: dedup/extractive/structural + must-keep preserve + tee raw-passthrough + fail-able must-keep gate + settings-govern-harness (compression.enabled) |
phase-control-plane-tests.sh |
9 | New — Plan-13 harness-owned governed settings: deny-by-default + approval gate + versioning/rollback + audit hash-chain tamper detection + effective-setting resolver |
phase-rbac-tests.sh |
12 | New — Plan-14 harness-owned RBAC: deny-by-default + action gating + tenant isolation + sensitive-requires-org-admin + Separation of Duties + IdP-claim→role mapping |
phase-rbac-audit-tests.sh |
5 | New — Plan-14 RBAC decision audit into an H5-style oversight log (ALLOW/DENY recorded, append-only, cross-tenant reason; opt-in CASAN_RBAC_AUDIT_LOG) |
phase-rai-tests.sh |
12 | New — Plan-15 harness-owned Responsible AI & Data Governance: data classification + PII→cloud denial without approval + model-card enforcement + retention gate/purge-audit + RAI aggregate report |
phase-selfimprove-tests.sh |
7 | New — Plan-04 self-improve core: telemetry→proposal (dry-run) + apply-requires-approval + governed-store application + sensitive-needs-approval |
phase-governance-report-tests.sh |
5 | New — Plan-09 tie-in: unified governance evidence report (traceability+RBAC+RAI+audit+self-improve) + certified-run gate (tampered audit ⇒ NOT_CERTIFIED) |
phase-preflight-tests.sh |
5 | New — Plan-15/13 enforcement wiring: harness preflight blocks PII→cloud without approval BEFORE the model call; model-router honors CASAN_PREFLIGHT (opt-in, short-circuits) |
phase-prod-infra-lab-tests.sh |
2 | New optional/local-prod — Docker Compose infra lab starts + verifies Vault/IdP/MinIO/dashboard/alert/billing |
phase-sec{01..30} + phase-sec23-tenant-store/-state-isolation/-rbac-tenant/-scope/-registry-crypt + phase-sec24 + phase-sec25 (33 suites) |
181 | New — Plan-16 security-audit remediation P0/P1/P2 (each control has a fail-able adversarial test; wired into ci-harness-gate.sh): SEC-01..21 P0/P1/arch controls; trusted-time for JWT exp + untrusted-telemetry tag (SEC-22, ARCH-06/08); multi-tenant partition (SEC-23 Phase 1–5 offline, MT-01/02/03/04); supply-chain image-pin + signed workflow (SEC-24 offline); build-artifact attestation tested==deployed (SEC-25 offline); stored/second-order injection scan (SEC-26); log control-char strip, path-traversal, audit fail-closed, approval-replay nonce (SEC-27..30) |
phase-loop-governor + phase-loop-convergence + phase-loop-gate + phase-loop-trace + phase-loop-metaloop + phase-loop-run (6 suites) |
97 | New — Plan-17 Agentic Loop Governance T1–T6 (deny-by-default, fail-closed; wired into ci-harness-gate.sh; state redirected via CASAN_LOOP_STATE_ROOT, repo .specify/state stays clean): Loop Budget Governor (loop-breaker: no/corrupt policy → strict ceiling/HALT, on_exceed halt/escalate) 15; Convergence detector (repeat/thrash → OSCILLATING, flat progress → STALLED, fail-closed) 15; Per-iteration Verify Contract (H4 block → DENY, unmet → FAIL, bounded correction → ESCALATE, no self-declared DONE) 20; Loop Trace/Replay (append-only hash-linked; edited record → chain BREAK; tampered artifact → replay DRIFT; KMS-anchor is TIER-2/A7) 16; Meta-loop (propose≠apply; SoD proposer≠approver; loosen>org-ceiling refused; applied via governed CP store → actually changes governor; rollback reverts) 15; Orchestrator loop-run.sh (gate→governor→convergence→trace per turn; DONE/HALT/ESCALATE; secure-by-default prod opt-out refused; between-turn compaction) 16 |
| Total | 563 core + 2 local-prod infra lab | Baseline 79 preserved; +206 governance checks (traceability/compression/control-plane/RBAC/RBAC-audit/RAI/self-improve/governance-report/preflight) + +181 Plan-16 SEC-remediation checks across 33 suites (all fail-able; SEC-11⊂SEC-17; SEC-22 done ARCH-06/08 — ARCH-10 external; SEC-23 Phase 1–5 offline done — only 23.11 Vault-KMS planned; SEC-24/25 offline slice done — live-CVE/image-scan + signed-commit/SLSA need infra) + +97 Plan-17 loop-engineering checks across 6 suites (Governor/Convergence/Verify-contract/Trace-Replay/Meta-loop/Orchestrator — all 5 loop primitives + orchestrator, fail-closed; remaining infra-gated: T4 KMS-anchor head [A7], T6 Command Center widget 17.22 [C5], live H3-judge). Full-suite green verified on CI/Mac with Ollama+Docker; the deterministic new suites verify in WSL (msys+Python Windows path skew). Preflight wiring is opt-in (CASAN_PREFLIGHT default off). Direct phase3-model-router-tests.sh adds 11/0 (3 cases need live Ollama); infra-lab verify adds 7 internal infra checks. |
Run order note: run-casan4-harness-tests.sh does rm -rf .specify/logs, so run it
first and never concurrently with the other suites.
3. What is NOT done (still planned — do not claim as production-ready)
| Area | Status | Plan ref |
|---|---|---|
| Production model provenance beyond local Ollama digest | [partial] — local model digest pinning is implemented+tested; cloud provider model attestations/SBOM-style provenance still planned | Plan-07 B4 (V16) |
| Live alerting to a managed channel (Slack/PagerDuty + on-call rota) | [partial] — webhook dispatch + dedup + dead-letter done; managed channel & escalation are config away, incident workflow is C7 | Plan-07 C7 / Phase 5 D1 |
| Hosted telemetry dashboard | [partial] — HTTP-served dashboard + stale-aware /healthz done locally; deployed host (nginx/container, auth) planned |
Phase 5 D3 |
| Provider billing-API telemetry | [partial] — API fetch + schema gate + local-vs-provider reconciliation done against a live local endpoint; real OpenAI/Anthropic usage-API calls (needs keys) planned | Phase 5 D2 |
| True runtime isolation | [partial] — real container isolation done + validated live via Docker (C6 phase-6); nsjail/rootless + a hardened base image for CI still planned | Plan-07 C6 (V22) |
| KMS key management (rotation, non-exportable) | [partial] — Vault Transit path implemented + validated live; not yet the default (local-key fallback), no HSM/short-lived IdP tokens | Plan-07 B3 |
| Reviewer approval workflow | [partial] — cryptographic approval-identity done + Docker mock IdP/OIDC JWKS done; enterprise IdP/JWKS + policy versioning/diff still planned | Plan-07 C4 (V20) |
| External append-only (WORM) audit | [partial] — hash-linked local ledger + rollback/tamper detection done; true WORM store (S3 Object Lock/QLDB) + trusted timestamp planned | Plan-07 C5 (V21) |
| Live CVE/OSV scanning wired in | [partial] — availability detected; local denylist authoritative offline | Plan-07 C2 follow-up |
4. Honest claim
Track A + Track C-MVP + Evidence Pack + H5/H6 hardening + the deep-gap closers
(C7 incident/kill-switch, VI/JA multilingual, true container isolation, split &
classifier injection) raise H4/H5/H6 from "PoC/demo (~3.0/5)" to early
internal-production hardening, with executable adversarial tests for every
control (218 core checks, 0 fail — last full harness run 2026-07-06; KMS + container
isolation validated live/skip-aware via Vault dev + Docker). Fair maturity score
(00_SUBMISSION_PACKAGE/evidence/scoring-run-report.md): H4 80→83 (multilingual
- split/classifier closed), H2 80→82 (real sandbox isolation), C7 incident
dimension closed; H5 and H6 remain at 80 (their remaining gaps are infra), so the
lowest harness stays 80 — CASAN Level 4, proven by attack. This is not full
production readiness: crossing the whole pipeline into "Strong (81+)" still needs the
H5/H6 infra items — enterprise IdP/JWKS, a true WORM store (S3 Object Lock/QLDB),
KMS-by-default + HSM, a deployed dashboard host with TLS/OIDC + managed alert channel/on-call, and
real billing-API telemetry — the [partial]/[planned] rows above and in
CASAN_PLAN_07_PRODUCTION_HARDENING.md.