feat: harden CASAN production install lifecycle

packages/casan-harness/scripts/bash/casan-paths.sh

@@ -41,8 +41,8 @@ _casan_find_app_root() {
   return 1
 }
 
-# Harness (CODE) root: the tree that holds scripts/, security/, templates/, tests/,
-# config/, level5/*.yaml. Derived from this file's location so it follows the move.
+# Harness (CODE) root: the production tree that holds scripts/, security/,
+# templates/, config/, adapters/, and schemas/. Derived from this file's location.
 if [[ -z "${CASAN_HARNESS_ROOT:-}" ]]; then
   CASAN_HARNESS_ROOT="$(cd "$_casan_paths_self/../.." && pwd)"
 fi

packages/casan-harness/scripts/bash/goal-orchestrator.py

@@ -36,7 +36,7 @@ BIN = os.path.join(ROOT, "packages", "casan-harness", "scripts", "bash")
 MODEL_ROUTER = os.environ.get("CASAN_GOAL_MODEL_ROUTER") or os.path.join(BIN, "model-router.sh")
 SECURITY = os.path.join(BIN, "security-check.sh")
 STATE_ROOT = os.environ.get("CASAN_STATE_ROOT") or os.path.join(ROOT, ".specify")
-PROJECT_REGISTRY = os.path.join(ROOT, "packages", "casan-harness", "level5", "project-registry.json")
+PROJECT_REGISTRY = os.path.join(ROOT, "packages", "casan-harness", "config", "project-registry.json")
 APPROVAL_INBOX = os.path.join(BIN, "approval-inbox.py")
 _MANIFEST_SPEC = importlib.util.spec_from_file_location(
     "casan_goal_project_manifest", os.path.join(BIN, "project_manifest.py")

packages/casan-harness/scripts/bash/goal-patch-executor.py

@@ -77,7 +77,7 @@ def _manifest_for_files(files: list[str]) -> dict:
     if selected or project:
         return PROJECT_MANIFEST.load(ROOT, selected, project)
 
-    registry = load(os.path.join(ROOT, "packages", "casan-harness", "level5", "project-registry.json"))
+    registry = load(os.path.join(ROOT, "packages", "casan-harness", "config", "project-registry.json"))
     candidates = []
     for entry in registry.get("projects", []):
         manifest_path = entry.get("manifest")

packages/casan-harness/scripts/bash/project_manifest.py

@@ -70,7 +70,7 @@ def load(root: str, manifest_path: str | None = None, project_id: str | None = N
     if selected:
         path = within(root, selected, "manifest")
     elif requested:
-        registry = _json(os.path.join(root, "packages/casan-harness/level5/project-registry.json"), "project registry")
+        registry = _json(os.path.join(root, "packages/casan-harness/config/project-registry.json"), "project registry")
         entry = next((item for item in registry.get("projects", []) if item.get("project_id") == requested), None)
         if not entry:
             _fail(f"project is not registered: {requested}")

packages/casan-harness/scripts/bash/tool-registry-gate.sh

@@ -14,7 +14,7 @@ fi
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
 PROJECT_ROOT="$CASAN_APP_ROOT"
-REGISTRY="$CASAN_HARNESS_ROOT/level5/tool-registry.yaml"
+REGISTRY="$CASAN_HARNESS_ROOT/config/tool-registry.yaml"
 LOG_DIR="$CASAN_STATE_ROOT/logs/level5"
 AUDIT_DIR="$CASAN_STATE_ROOT/logs/audit"
 mkdir -p "$LOG_DIR" "$AUDIT_DIR"

packages/casan-harness/scripts/bash/verify-harness-reuse.sh

@@ -6,8 +6,8 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
 PROJECT_ROOT="$CASAN_APP_ROOT"
-REGISTRY="$CASAN_HARNESS_ROOT/level5/project-registry.json"
-PACKAGE="$CASAN_HARNESS_ROOT/level5/harness-package.json"
+REGISTRY="$CASAN_HARNESS_ROOT/config/project-registry.json"
+PACKAGE="$CASAN_HARNESS_ROOT/config/harness-package.json"
 
 python - "$REGISTRY" "$PACKAGE" <<'PY'
 import json

packages/casan-harness/scripts/powershell/tool-registry-gate.ps1

@@ -1,5 +1,5 @@
 #!/usr/bin/env pwsh
-# CASAN L5 Tool Registry Gate - PowerShell port of tool-registry-gate.sh
+# CASAN Tool Registry Gate - PowerShell port of tool-registry-gate.sh
 # Usage:
 #   tool-registry-gate.ps1 <tool-id> [idempotency-key]
 #
@@ -13,8 +13,9 @@ param(
 $ErrorActionPreference = "Stop"
 
 $scriptDir   = Split-Path $MyInvocation.MyCommand.Path -Parent
-$projectRoot = (Resolve-Path (Join-Path $scriptDir "../../..")).Path
-$registry    = Join-Path $projectRoot ".specify/level5/tool-registry.yaml"
+$harnessRoot = if ($env:CASAN_HARNESS_ROOT) { $env:CASAN_HARNESS_ROOT } else { (Resolve-Path (Join-Path $scriptDir "../..")).Path }
+$projectRoot = if ($env:CASAN_APP_ROOT) { $env:CASAN_APP_ROOT } else { (Resolve-Path (Join-Path $scriptDir "../../../..")).Path }
+$registry    = Join-Path $harnessRoot "config/tool-registry.yaml"
 $logDir      = Join-Path $projectRoot ".specify/logs/level5"
 $txLog       = Join-Path $logDir "tool-registry.jsonl"
 $toolCallLog = Join-Path $projectRoot ".specify/logs/audit/tool-calls.jsonl"

packages/casan-harness/scripts/python/harness_hash.py

@@ -11,7 +11,7 @@ guarantee from Plan-16 even when the harness lives outside the repo.
 Only GATE-relevant trees are hashed (the code that makes security/governance
 decisions), never runtime state/logs:
 
-    scripts/bash   scripts/python   security   level5   adapters   schemas
+    scripts/bash   scripts/python   security   config   adapters   schemas
 
 stdlib-only, deterministic (sorted paths), text-mode agnostic (hashes raw bytes).
 
@@ -30,10 +30,9 @@ import sys
 
 ALGO = "sha256"
 HASHED_SUBTREES = (
-    "scripts/bash", "scripts/python", "security", "level5", "adapters", "schemas")
+    "scripts/bash", "scripts/python", "security", "config", "adapters", "schemas")
 SKIP_DIR_NAMES = {"__pycache__", ".git", "node_modules"}
 SKIP_SUFFIXES = (".pyc", ".pyo", ".log", ".tmp", ".DS_Store")
-# Within level5, only policy/config, not regenerated runtime artifacts.
 SKIP_BASENAMES = {"policy-manifest.json", "policy-manifest.sig", "project-registry.json"}