fix template, remove okr, use casan.*

.github/workflows/ci.yml

@@ -11,59 +11,68 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  test-backend:
-    name: Backend Tests
+  project-quality:
+    name: Project quality · ${{ matrix.project }}
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: ./backend
-    env:
-      DATABASE_URL: file:./test.db
-      JWT_SECRET: test-secret
-      # ANTHROPIC_API_KEY enables the LLM-judge gate; tests skip gracefully when absent
-      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - project: okr
+            manifest: apps/okr/domain/project.manifest.json
+          - project: service-desk
+            manifest: apps/service-desk/domain/project.manifest.json
     steps:
       - uses: actions/checkout@v4
-
       - uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: "20"
           cache: npm
-          cache-dependency-path: package-lock.json
+      - run: npm ci
+      - name: Validate project contract
+        run: python3 packages/casan-harness/scripts/bash/project_manifest.py validate --root . --manifest "${{ matrix.manifest }}"
+      - name: Build
+        run: python3 packages/casan-harness/scripts/bash/project_manifest.py run --root . --manifest "${{ matrix.manifest }}" --kind build
+      - name: Test
+        run: python3 packages/casan-harness/scripts/bash/project_manifest.py run --root . --manifest "${{ matrix.manifest }}" --kind test
+      - name: Project security, corpus and traceability gates
+        env:
+          CASAN_PROJECT_MANIFEST: ${{ matrix.manifest }}
+          # The repository-level governance job runs the exhaustive corpus suite once.
+          CASAN_PROJECT_GATE_RUN_CORPUS: "0"
+          CASAN_PROJECT_GATE_RUN_BUILD: "0"
+          CASAN_PROJECT_GATE_RUN_TEST: "0"
+        run: bin/casan gate
 
-      - name: Install dependencies
-        working-directory: .
-        run: npm ci
-
-      - name: Setup test database
-        run: npm run db:setup
-
-      - name: Seed test database
-        run: npx prisma db seed
-
-      # Run test files sequentially (--test-concurrency=1) to prevent shared-DB
-      # conflicts between e2e tests that mutate state and services tests that rely on it.
-      - name: Run unit + e2e + LLM-judge tests
-        run: node --import tsx --test-concurrency=1 --test "test/**/*.test.ts"
-
-  test-frontend:
-    name: Frontend Type Check
+  casan-governance:
+    name: CASAN governance
     runs-on: ubuntu-latest
-
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@v4
-
       - uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: "20"
           cache: npm
-          cache-dependency-path: package-lock.json
+      - run: npm ci
+      - name: Run reusable governance suites
+        env:
+          CASAN_CI_RUN_PROJECT: "0"
+          CASAN_CI_RUN_CONTROL_PANEL: "0"
+          CASAN_CI_RUN_INFRA_LAB: "0"
+        run: bin/casan gate
 
-      - name: Install dependencies
-        working-directory: .
-        run: npm ci
-
-      - name: Type check
-        working-directory: ./frontend
-        run: npm test
+  control-panel:
+    name: Control panel
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+      - run: npm ci
+      - run: npm run console:test
+      - run: npm run console:build