gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(plan-01): Phase 0.5 — path indirection via casan-paths.sh (no file moves)

Browse Source 
Task 1.2: introduce a single path resolver so no harness script hardcodes
`.specify/...` scattered across the tree. casan-paths.sh resolves four roots
(HARNESS/STATE/GOVERNANCE/APP) by marker-based walk-up from its own location —
never `git rev-parse` (git root is the repo PARENT here, not the app dir).

- 101 bash scripts/tests: 238 hardcoded `$PROJECT_ROOT/.specify/...` refs rewritten
  to CASAN_HARNESS_ROOT (code) / CASAN_STATE_ROOT (logs,state) / CASAN_GOVERNANCE_ROOT.
  Sandbox test vars ($WORK/$TP/$FP/$T1_WORK) left untouched.
- Roots are NOT exported: each script/subprocess self-resolves from its own tree,
  matching the original per-script semantics and preserving hermetic sandbox isolation
  (node casan-step.mjs, copied telemetry/rollback scripts must not inherit real roots).
- Sandbox tests that copy a harness script now also copy casan-paths.sh (its new
  sibling dependency): adversarial (verify-audit-chain/verify-tool-audit/rollback) +
  track-a (security-check/telemetry-integrity).
- control-plane-settings.json reclassified as STATE (untracked runtime store).

Roots all still resolve to `.specify` in this monolithic layout, so behavior is
unchanged. Full gate: PASS=64 FAIL=0 SKIP=3 (adversarial 44/0, track-a 25/0).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
2026-07-07 22:07:41 +09:00
co-authored by Claude Opus 4.8
parent 61c3a7c648
commit 2c765c9a45
102 changed files with 1605 additions and 1429 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AINative_OKR_CASAN5/.specify/tests/phase-sec05-tests.sh
+7 -6
View File
@@ -12,18 +12,19 @@ set -uo pipefail
# Deterministic; hermetic (backs up + restores the audit + governance dirs).
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
BASH_DIR="$PROJECT_ROOT/.specify/scripts/bash"
AUDIT="$PROJECT_ROOT/.specify/logs/audit/audit.jsonl"
BASH_DIR="$CASAN_HARNESS_ROOT/scripts/bash"
AUDIT="$CASAN_STATE_ROOT/logs/audit/audit.jsonl"
WORK="$(mktemp -d)"
# Back up + restore the state governance-check mutates.
BK="$WORK/backup"; mkdir -p "$BK"
cp -a "$PROJECT_ROOT/.specify/logs/audit" "$BK/audit" 2>/dev/null || true
cp -a "$PROJECT_ROOT/.specify/level5/central-governance" "$BK/central-governance" 2>/dev/null || true
cp -a "$CASAN_STATE_ROOT/logs/audit" "$BK/audit" 2>/dev/null || true
cp -a "$CASAN_GOVERNANCE_ROOT" "$BK/central-governance" 2>/dev/null || true
restore_state() {
rm -rf "$PROJECT_ROOT/.specify/logs/audit"; cp -a "$BK/audit" "$PROJECT_ROOT/.specify/logs/audit" 2>/dev/null || true
rm -rf "$PROJECT_ROOT/.specify/level5/central-governance"; cp -a "$BK/central-governance" "$PROJECT_ROOT/.specify/level5/central-governance" 2>/dev/null || true
rm -rf "$CASAN_STATE_ROOT/logs/audit"; cp -a "$BK/audit" "$CASAN_STATE_ROOT/logs/audit" 2>/dev/null || true
rm -rf "$CASAN_GOVERNANCE_ROOT"; cp -a "$BK/central-governance" "$CASAN_GOVERNANCE_ROOT" 2>/dev/null || true
}
trap 'restore_state; rm -rf "$WORK"' EXIT