fix template, remove okr, use casan.*

.github/workflows/ci.yml

@@ -11,59 +11,68 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  test-backend:
-    name: Backend Tests
+  project-quality:
+    name: Project quality · ${{ matrix.project }}
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: ./backend
-    env:
-      DATABASE_URL: file:./test.db
-      JWT_SECRET: test-secret
-      # ANTHROPIC_API_KEY enables the LLM-judge gate; tests skip gracefully when absent
-      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - project: okr
+            manifest: apps/okr/domain/project.manifest.json
+          - project: service-desk
+            manifest: apps/service-desk/domain/project.manifest.json
     steps:
       - uses: actions/checkout@v4
-
       - uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: "20"
           cache: npm
-          cache-dependency-path: package-lock.json
+      - run: npm ci
+      - name: Validate project contract
+        run: python3 packages/casan-harness/scripts/bash/project_manifest.py validate --root . --manifest "${{ matrix.manifest }}"
+      - name: Build
+        run: python3 packages/casan-harness/scripts/bash/project_manifest.py run --root . --manifest "${{ matrix.manifest }}" --kind build
+      - name: Test
+        run: python3 packages/casan-harness/scripts/bash/project_manifest.py run --root . --manifest "${{ matrix.manifest }}" --kind test
+      - name: Project security, corpus and traceability gates
+        env:
+          CASAN_PROJECT_MANIFEST: ${{ matrix.manifest }}
+          # The repository-level governance job runs the exhaustive corpus suite once.
+          CASAN_PROJECT_GATE_RUN_CORPUS: "0"
+          CASAN_PROJECT_GATE_RUN_BUILD: "0"
+          CASAN_PROJECT_GATE_RUN_TEST: "0"
+        run: bin/casan gate
 
-      - name: Install dependencies
-        working-directory: .
-        run: npm ci
-
-      - name: Setup test database
-        run: npm run db:setup
-
-      - name: Seed test database
-        run: npx prisma db seed
-
-      # Run test files sequentially (--test-concurrency=1) to prevent shared-DB
-      # conflicts between e2e tests that mutate state and services tests that rely on it.
-      - name: Run unit + e2e + LLM-judge tests
-        run: node --import tsx --test-concurrency=1 --test "test/**/*.test.ts"
-
-  test-frontend:
-    name: Frontend Type Check
+  casan-governance:
+    name: CASAN governance
     runs-on: ubuntu-latest
-
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@v4
-
       - uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: "20"
           cache: npm
-          cache-dependency-path: package-lock.json
+      - run: npm ci
+      - name: Run reusable governance suites
+        env:
+          CASAN_CI_RUN_PROJECT: "0"
+          CASAN_CI_RUN_CONTROL_PANEL: "0"
+          CASAN_CI_RUN_INFRA_LAB: "0"
+        run: bin/casan gate
 
-      - name: Install dependencies
-        working-directory: .
-        run: npm ci
-
-      - name: Type check
-        working-directory: ./frontend
-        run: npm test
+  control-panel:
+    name: Control panel
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+      - run: npm ci
+      - run: npm run console:test
+      - run: npm run console:build

.github/workflows/deploy.yml

@@ -1,6 +1,5 @@
-name: Deploy
+name: Release Candidate
 
-# Triggers only after CI passes on main — this is the gate
 on:
   workflow_run:
     workflows: [CI]
@@ -8,38 +7,30 @@ on:
     types: [completed]
 
 jobs:
-  deploy:
-    name: Deploy to Production
+  package:
+    name: Build verified release candidate
     runs-on: ubuntu-latest
-    environment: production
-    # Only deploy when CI succeeded — not on failure or cancel
+    timeout-minutes: 30
     if: github.event.workflow_run.conclusion == 'success'
-
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
-
       - uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: "20"
           cache: npm
-          cache-dependency-path: package-lock.json
+      - run: npm ci
+      - run: python3 packages/casan-harness/scripts/bash/project_manifest.py run --root . --manifest apps/okr/domain/project.manifest.json --kind build
+      - name: Package immutable application artifacts
+        run: tar -czf okr-release-candidate.tgz apps/okr/backend/dist apps/okr/frontend/dist apps/okr/domain/project.manifest.json
+      - uses: actions/upload-artifact@v4
+        with:
+          name: okr-release-candidate-${{ github.event.workflow_run.head_sha }}
+          path: okr-release-candidate.tgz
+          if-no-files-found: error
+          retention-days: 14
 
-      - name: Install dependencies
-        working-directory: .
-        run: npm ci
-
-      - name: Build backend
-        working-directory: ./backend
-        run: npm run build
-
-      - name: Build frontend
-        working-directory: ./frontend
-        run: npm run build
-
-      # TODO: replace with your actual deploy command, e.g.:
-      #   - rsync -av dist/ user@server:/var/www/app/
-      #   - fly deploy
-      #   - vercel --prod
-      #   - aws s3 sync frontend/dist/ s3://your-bucket
-      - name: Deploy
-        run: echo "All tests passed — add deploy commands here"
+      # Environment deployment is intentionally adapter-owned. Add a separate job
+      # protected by the GitHub `production` environment when the target platform,
+      # workload identity, health check, and rollback command are approved.