gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(structure): promote app to repo root + remove redundant workspace cruft

Browse Source 
Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.

- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
  .specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
  active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
  launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
  tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
  README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
  artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
  - .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
    working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
    -> packages/casan-harness/... (.specify/logs state kept)
  - .claude/launch.json, .gitea/*-runbook.md: path prefixes
  - CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
  - policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.

Full gate from the new root: PASS=64 FAIL=0 SKIP=3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
2026-07-08 13:26:36 +09:00
co-authored by Claude Opus 4.8
parent 7101af9fd4
commit 36a4812ef3
925 changed files with 410 additions and 18001 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/casan-harness/scripts/bash/approval-sign.sh
Executable
+39
View File
@@ -0,0 +1,39 @@
#!/usr/bin/env bash
set -uo pipefail
# CASAN H5 — Reviewer-side approval signer (Approval-identity MVP · C4 / V20).
#
# A reviewer runs this to APPROVE a specific high-risk request by signing the
# canonical assertion with THEIR OWN private key. The resulting signature is
# handed to governance-check.sh via CASAN_APPROVAL_SIG (with CASAN_APPROVER=<id>
# and CASAN_APPROVAL_STRICT=1). The private key stays with the reviewer / in an
# IdP-issued credential — never in the pipeline env.
#
# Assertion (must match approval-verify.sh):
# casan-approval|v1|<action>|<actor>|<input_sha256>|<approver_id>
#
# Usage:
# approval-sign.sh <action> <actor> <input-file> <approver-id> <privkey> <out-sig>
# Exit: 0 signed, 64 usage, 1 sign error.
ACTION="${1:-}"; ACTOR="${2:-}"; INPUT_FILE="${3:-}"; APPROVER="${4:-}"; PRIV="${5:-}"; OUT="${6:-}"
if [[ -z "$ACTION" || -z "$ACTOR" || -z "$INPUT_FILE" || -z "$APPROVER" || -z "$PRIV" || -z "$OUT" ]]; then
echo "Usage: approval-sign.sh <action> <actor> <input-file> <approver-id> <privkey> <out-sig>" >&2
exit 64
fi
[[ -f "$INPUT_FILE" ]] || { echo "approval-sign: input file not found: $INPUT_FILE" >&2; exit 1; }
[[ -f "$PRIV" ]] || { echo "approval-sign: private key not found: $PRIV" >&2; exit 1; }
command -v openssl >/dev/null 2>&1 || { echo "approval-sign: openssl required" >&2; exit 1; }
hash_file() {
if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | awk '{print $1}'
else shasum -a 256 "$1" | awk '{print $1}'; fi
}
INPUT_SHA="$(hash_file "$INPUT_FILE")"
MSG="casan-approval|v1|$ACTION|$ACTOR|$INPUT_SHA|$APPROVER"
TMP="$(mktemp)"; trap 'rm -f "$TMP"' EXIT
printf '%s' "$MSG" > "$TMP"
openssl dgst -sha256 -sign "$PRIV" -out "$OUT" "$TMP" \
|| { echo "approval-sign: signing failed" >&2; exit 1; }
echo "APPROVAL_SIGNED approver=$APPROVER action=$ACTION sig=$OUT"