fix template, remove okr, use casan.*

packages/casan-control-panel/backend/test/approvals.test.ts

@@ -69,6 +69,39 @@ test('approval inbox submit -> approve applies governed setting and writes overs
   });
 });
 
+test('operations owner request remains visible and actionable for an independent reviewer', async () => {
+  await withTempGovernance(async () => {
+    const svc = new ApprovalsService();
+    const submitted = svc.submit({
+      action: 'goal.workspace.execute',
+      target: 'customer-portal',
+      risk: 'high',
+      sensitive: true,
+      reason: 'apply the reviewed workspace patch',
+      payload: { goal_id: 'goal-123', project_id: 'customer-portal' },
+    }, projectAdmin) as { proposal: { id: string; status: string; proposer: string } };
+
+    const reviewerInbox = svc.list(approver, 'pending') as {
+      count: number;
+      proposals: Array<{ id: string; proposer: string; status: string }>;
+    };
+    const visible = reviewerInbox.proposals.find((proposal) => proposal.id === submitted.proposal.id);
+
+    assert.equal(reviewerInbox.count, 1);
+    assert.equal(visible?.proposer, projectAdmin.actor);
+    assert.equal(visible?.status, 'pending');
+
+    const decided = await svc.decide({
+      id: submitted.proposal.id,
+      decision: 'approve',
+      reason: 'independent reviewer verified scope and controls',
+    }, approver) as { proposal: { status: string; approver: string } };
+
+    assert.equal(decided.proposal.status, 'approved');
+    assert.equal(decided.proposal.approver, approver.actor);
+  });
+});
+
 test('approval inbox denies forged JWT in strict mode without deciding proposal', async () => {
   await withTempGovernance(async ({ inbox }) => {
     const svc = new ApprovalsService();

packages/casan-control-panel/backend/test/goals.test.ts

@@ -1,9 +1,14 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import { BadRequestException, ForbiddenException } from '@nestjs/common';
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
 import { GoalsService } from '../src/goals/goals.service.js';
 
 const admin = { actor: 'goal-admin', role: 'org-admin', project: 'default', tenant: 'goal-test' };
+const root = resolve(import.meta.dirname, '../../../..');
+const registry = resolve(root, 'packages/casan-harness/level5/project-registry.json');
 
 test('goal project selector exposes only active allowlisted registry entries', () => {
   const result = new GoalsService().projects(admin);
@@ -25,3 +30,37 @@ test('goal project creation is restricted to organization administrators', () =>
     ForbiddenException,
   );
 });
+
+test('goal project creation rejects unsafe template values before touching the workspace', () => {
+  assert.throws(
+    () => new GoalsService().createProject({ projectId: 'unsafe-shell', domain: 'Broken "Template"' }, admin),
+    BadRequestException,
+  );
+});
+
+test('goal project creation builds a complete isolated shell and central adapter manifest', () => {
+  const projectId = `goal-shell-${process.pid}`;
+  const projectRoot = resolve(root, 'apps/projects', projectId);
+  const registryBefore = readFileSync(registry, 'utf8');
+  try {
+    const created = new GoalsService().createProject({ projectId, domain: 'Goal Shell Verification' }, admin);
+    assert.equal(created.project_id, projectId);
+    assert.equal(created.shell_root, `apps/projects/${projectId}`);
+    assert.equal(created.manifest, `apps/projects/${projectId}/casan.workspace.manifest.json`);
+    assert.ok(existsSync(resolve(projectRoot, '.github/workflows/ci.yml')));
+    assert.ok(existsSync(resolve(projectRoot, `apps/${projectId}/domain/project.manifest.json`)));
+    assert.ok(existsSync(resolve(projectRoot, 'packages/casan-harness/scripts/bash/project-gate.sh')));
+    assert.ok(existsSync(resolve(projectRoot, 'casan.workspace.manifest.json')));
+
+    const validation = execFileSync('python3', [
+      resolve(root, 'packages/casan-harness/scripts/bash/project_manifest.py'),
+      'validate', '--root', root, '--manifest', created.manifest!,
+    ], { encoding: 'utf8' });
+    assert.match(validation, /"status": "valid"/);
+    assert.ok(new GoalsService().projects(admin).projects.some((project) => project.project_id === projectId && project.shell_root === created.shell_root));
+  } finally {
+    writeFileSync(registry, registryBefore, 'utf8');
+    rmSync(projectRoot, { recursive: true, force: true });
+    rmSync(`${registry}.lock`, { force: true });
+  }
+});