fix template, remove okr, use casan.*

docs/packaging/ADOPTION_GUIDE.md

@@ -12,6 +12,20 @@ This copies the core harness + `bin/casan` into `../my-project`, scaffolds
 `apps/ticketing/domain/` from the domain-pack template, adds `.gitea/workflows/casan-ci.yml`,
 and registers the project in `project-registry.json`.
 
+## Option A2 — New production project shell
+
+```bash
+packages/casan-devkit/install.sh \
+  --target ../my-project \
+  --project ticketing \
+  --domain "Ticketing" \
+  --template nestjs-react
+```
+
+This creates a strict-TypeScript NestJS/React monorepo, health bootstrap, tests, Docker multi-stage
+images, GitHub CI, a complete Domain Pack, versioned quality profile, project manifest, CASAN CLI,
+harness, and manifest-driven pipeline. Existing different files are never overwritten.
+
 ## Option B — Core tarball (harness-only / CI gate)
 ```bash
 tar -xzf casan-core-v1.0.0.tar.gz
@@ -37,6 +51,13 @@ See `DOCKER_GUIDE.md`.
    bin/casan reuse                                            # HARNESS_REUSE_VALID
    ```
 
+For a manifest-enabled project prefer:
+
+```bash
+bin/casan project validate --manifest apps/<project>/domain/project.manifest.json
+bin/casan pipeline --manifest apps/<project>/domain/project.manifest.json
+```
+
 ## Path model (what lives where)
 - **Harness code** → `packages/casan-harness/` (never edited by adopters).
 - **Your domain data** → `apps/<project>/domain/` (via `CASAN_DOMAIN_ROOT`).

docs/packaging/DOMAIN_PACK_GUIDE.md

@@ -10,6 +10,7 @@ Scaffold template: `packages/casan-devkit/templates/domain-pack/`.
 ```
 apps/<project>/domain/
 ├── domain-pack.yaml           # manifest describing this pack
+├── project.manifest.json      # executable project/build/test/verification contract
 ├── input/
 │   ├── requirement.md         # FR-xx table drives the traceability gate
 │   └── architecture.md        # optional tech-stack/context
@@ -33,10 +34,12 @@ apps/<project>/domain/
 - **traceability-map.json** — `{"FR-01": {"name": "...", "code": ["apps/okr/backend/src/...", {"file":"...","symbols":["Foo"],"lines":[12]}], "tests": ["..."]}}`. Symbol/line refs are
   optional but tighten the gate.
 - **domain-pack.yaml** — documents the above + optional threshold overrides.
+- **project.manifest.json** — selects authoritative inputs, source roots, quality profile,
+  feature/artifact namespace, argv build/test commands, and per-path verification commands.
 
 ## Wire it up
 ```bash
-export CASAN_DOMAIN_ROOT=apps/<project>/domain
+export CASAN_PROJECT_MANIFEST=apps/<project>/domain/project.manifest.json
 bin/casan gate                 # runs domain-dependent suites against your pack
 ```
 `domain_root` is also recorded per-project in `packages/casan-harness/level5/project-registry.json`
@@ -46,7 +49,6 @@ so `bin/casan reuse` can prove multi-project reuse.
 The OKR app's own pack is the worked example: `apps/okr/domain/` (golden-runs, corpus,
 input, traceability-map). Copy its shape for your domain.
 
-## Toward Plan-12 (Domain Pack SDK)
-Today a pack is a directory + `CASAN_DOMAIN_ROOT`. Plan-12 will make it fully declarative
-(register a pack by manifest, no manual wiring). The `domain-pack.yaml` here is the seed of
-that manifest.
+The project manifest is validated fail-closed by both Node and Python runtimes. Paths are confined
+to the repository, commands are argv arrays checked against the quality-profile executable
+allowlist, and every source root must map to a post-patch verification rule.