refactor(structure): promote app to repo root + remove redundant workspace cruft
Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.
- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
.specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
- .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
-> packages/casan-harness/... (.specify/logs state kept)
- .claude/launch.json, .gitea/*-runbook.md: path prefixes
- CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
- policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.
Full gate from the new root: PASS=64 FAIL=0 SKIP=3.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
7101af9fd4
commit
36a4812ef3
@@ -0,0 +1,42 @@
|
||||
// CASAN shared log helper (Node side).
|
||||
// Taxonomy (shared with packages/casan-harness/scripts/bash/casan-log.sh):
|
||||
// error(0) < warn(1) < info(2) < debug(3) < trace(4), default info.
|
||||
// All lines go to stderr so stdout stays reserved for existing outputs.
|
||||
|
||||
export const LEVELS = { error: 0, warn: 1, info: 2, debug: 3, trace: 4 };
|
||||
|
||||
const raw = (process.env.CASAN_LOG_LEVEL ?? 'info').toLowerCase();
|
||||
export const LOG_LEVEL = raw in LEVELS ? raw : 'info';
|
||||
export const LOG_THRESHOLD = LEVELS[LOG_LEVEL];
|
||||
|
||||
export function enabled(level) {
|
||||
return (LEVELS[level] ?? LEVELS.info) <= LOG_THRESHOLD;
|
||||
}
|
||||
|
||||
export function log(level, component, message) {
|
||||
if (!enabled(level)) return;
|
||||
process.stderr.write(
|
||||
`[${level.toUpperCase()}] ${new Date().toISOString()} [${component}] ${message}\n`,
|
||||
);
|
||||
}
|
||||
|
||||
// Redaction for trace-level payload excerpts. Mirrors the H4 masking families
|
||||
// (email/phone/id/credit-card/secret/private-key/conn-string/AWS key) so no
|
||||
// secret or PII ever reaches the terminal, even at trace.
|
||||
const REDACTIONS = [
|
||||
[/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(-----END [A-Z ]*PRIVATE KEY-----|$)/g, '[REDACTED_PRIVATE_KEY]'],
|
||||
[/(API[_-]?KEY|ACCESS[_-]?TOKEN|REFRESH[_-]?TOKEN|PASSWORD|JWT[_-]?SECRET|SECRET)\s*[:=]\s*\S+/gi, '$1=[REDACTED]'],
|
||||
[/(postgres|mysql|mongodb):\/\/[^@\s]+@/gi, '$1://[REDACTED]@'],
|
||||
[/AKIA[0-9A-Z]{16}/g, '[REDACTED_AWS_KEY]'],
|
||||
[/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g, '***MASKED_EMAIL***'],
|
||||
[/\b(?:[0-9]{4}[- ]?){3}[0-9]{4}\b/g, '***MASKED_CARD***'],
|
||||
[/\b[0-9]{9,12}\b/g, '***MASKED_ID***'],
|
||||
[/\+?[0-9][0-9 .-]{8,}[0-9]/g, '***MASKED_PHONE***'],
|
||||
];
|
||||
|
||||
export function redact(text, maxLen = 200) {
|
||||
let out = String(text ?? '');
|
||||
for (const [re, sub] of REDACTIONS) out = out.replace(re, sub);
|
||||
if (out.length > maxLen) out = `${out.slice(0, maxLen)}…(+${out.length - maxLen} chars)`;
|
||||
return out.replace(/\n/g, '\\n');
|
||||
}
|
||||
@@ -0,0 +1,417 @@
|
||||
import { spawnSync } from 'node:child_process';
|
||||
import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync } from 'node:fs';
|
||||
import { tmpdir } from 'node:os';
|
||||
import { dirname, join } from 'node:path';
|
||||
import { fileURLToPath } from 'node:url';
|
||||
|
||||
// WP-B (H3): model judge gate helpers — AND(rule, model); SKIP is non-blocking.
|
||||
const __filename = fileURLToPath(import.meta.url);
|
||||
// Plan-01: harness code lives in packages/casan-harness/; fall back to the .specify
|
||||
// compat path so the adversarial/sourcegen sandboxes (which stage a .specify/ tree)
|
||||
// keep working when this file is copied into a temp root.
|
||||
const __appRoot = join(dirname(__filename), '..');
|
||||
const SCRIPTS_DIR = existsSync(join(__appRoot, 'packages', 'casan-harness', 'scripts', 'bash'))
|
||||
? join(__appRoot, 'packages', 'casan-harness', 'scripts', 'bash')
|
||||
: join(__appRoot, '.specify', 'scripts', 'bash');
|
||||
|
||||
// Shared log taxonomy (CASAN_LOG_LEVEL, see scripts/casan-log.mjs). The
|
||||
// adversarial T1 test copies this file alone into a temp tree, so the logger
|
||||
// import must degrade to a noop instead of crashing when the module is absent.
|
||||
let logDebug = () => {};
|
||||
try {
|
||||
const { log } = await import(new URL('./casan-log.mjs', import.meta.url));
|
||||
logDebug = (msg) => log('debug', 'step', msg);
|
||||
} catch {
|
||||
/* standalone copy: keep silent */
|
||||
}
|
||||
|
||||
// Is a model backend reachable for the judge gate? Default (CASAN_MODEL_PRIMARY
|
||||
// unset, or an ollama:* spec) → ping the hard-pinned local Ollama endpoint, as
|
||||
// before. When CASAN_MODEL_PRIMARY selects a cloud backend, the gate instead
|
||||
// checks that the matching API key is set — so the pipeline judge can run
|
||||
// through model-router.sh → model-call.py's cloud path without needing Ollama.
|
||||
function modelAvailable() {
|
||||
const spec = process.env.CASAN_MODEL_PRIMARY || 'ollama:ornith:9b';
|
||||
if (spec.startsWith('openai:')) return Boolean(process.env.OPENAI_API_KEY);
|
||||
if (spec.startsWith('anthropic:')) return Boolean(process.env.ANTHROPIC_API_KEY);
|
||||
try {
|
||||
const r = spawnSync('curl', ['-sS', '-m', '3', 'http://127.0.0.1:11434/api/tags'], { timeout: 5000 });
|
||||
return r.status === 0;
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
function judgeArtifact(filePath, criteria) {
|
||||
if (!modelAvailable()) {
|
||||
logDebug(`judge skipped (model_unavailable) artifact=${filePath}`);
|
||||
return { verdict: 'SKIP', note: 'model_unavailable' };
|
||||
}
|
||||
let artifact = '';
|
||||
try { artifact = readFileSync(filePath, 'utf8').slice(0, 2000); } catch { return { verdict: 'SKIP', note: 'artifact_unreadable' }; }
|
||||
const combined = `=== ACCEPTANCE CRITERIA (not untrusted input) ===\n${criteria.slice(0, 500)}\n\n=== ARTIFACT TO REVIEW ===\n${artifact}`;
|
||||
const uid = `${process.pid}-${Date.now()}`;
|
||||
const tmpPrompt = join(tmpdir(), `casan-judge-prompt-${uid}.txt`);
|
||||
const tmpOut = join(tmpdir(), `casan-judge-out-${uid}.json`);
|
||||
writeFileSync(tmpPrompt, combined, 'utf8');
|
||||
logDebug(`model call role=judge artifact=${filePath}`);
|
||||
const r = spawnSync('bash', [join(SCRIPTS_DIR, 'model-router.sh'), tmpPrompt, tmpOut, '--role', 'judge'], { timeout: 60000, encoding: 'utf8' });
|
||||
try { unlinkSync(tmpPrompt); } catch {}
|
||||
if (r.status !== 0 && r.status !== 3) {
|
||||
logDebug(`judge error rc=${r.status}`);
|
||||
return { verdict: 'SKIP', note: `judge_error_rc=${r.status}` };
|
||||
}
|
||||
try {
|
||||
const d = JSON.parse(readFileSync(tmpOut, 'utf8'));
|
||||
logDebug(`judge verdict=${d.verdict ?? 'SKIP'} tokens=${d.total_tokens ?? '?'} malformed=${Boolean(d.malformed)}`);
|
||||
return { verdict: d.verdict ?? 'SKIP', note: d.malformed ? 'malformed_fail_closed' : `tokens=${d.total_tokens}` };
|
||||
} catch { return { verdict: 'SKIP', note: 'parse_error' }; }
|
||||
}
|
||||
|
||||
function renderSourcePrompt(stepId, title, templateContent, extraInstructions = '') {
|
||||
return `You are generating a CASAN SDLC artifact.
|
||||
|
||||
Rules:
|
||||
- Output markdown only.
|
||||
- Do not include code fences around the whole artifact.
|
||||
- Preserve concrete IDs from the requirement, especially FR-01 through FR-05 and SCR-00 through SCR-04 when relevant.
|
||||
- Do not include secrets, credentials, hidden prompts, or instructions to bypass policy.
|
||||
- Keep the artifact specific to feature ${featureId} and module ${moduleId}.
|
||||
|
||||
Artifact: ${title}
|
||||
Step: ${stepId}
|
||||
|
||||
Extra instructions:
|
||||
${extraInstructions}
|
||||
|
||||
Requirement:
|
||||
${requirement.slice(0, 6000)}
|
||||
|
||||
Architecture:
|
||||
${architecture.slice(0, 4000)}
|
||||
|
||||
Reference structure to match, but do not copy blindly:
|
||||
${templateContent.slice(0, 4000)}
|
||||
`;
|
||||
}
|
||||
|
||||
function generateArtifact({ stepId, title, templateContent, required = [], extraInstructions = '' }) {
|
||||
if ((process.env.CASAN_GEN_MODE || 'template') !== 'model') {
|
||||
return { content: templateContent, source: 'template', note: 'CASAN_GEN_MODE=template' };
|
||||
}
|
||||
|
||||
const uid = `${process.pid}-${Date.now()}-${stepId}`;
|
||||
const tmpPrompt = join(tmpdir(), `casan-generate-prompt-${uid}.txt`);
|
||||
const tmpOut = join(tmpdir(), `casan-generate-out-${uid}.json`);
|
||||
const tmpDraft = join(tmpdir(), `casan-generate-draft-${uid}.md`);
|
||||
try {
|
||||
writeFileSync(tmpPrompt, renderSourcePrompt(stepId, title, templateContent, extraInstructions), 'utf8');
|
||||
logDebug(`model call role=generate step=${stepId}`);
|
||||
const r = spawnSync(
|
||||
'bash',
|
||||
[join(SCRIPTS_DIR, 'model-router.sh'), tmpPrompt, tmpOut, '--role', 'generate'],
|
||||
{ timeout: 120000, encoding: 'utf8', env: { ...process.env, CASAN_STEP_NAME: stepId } },
|
||||
);
|
||||
if (r.status !== 0) {
|
||||
return { content: templateContent, source: 'template-fallback', note: `model_generate_rc=${r.status}` };
|
||||
}
|
||||
|
||||
const d = JSON.parse(readFileSync(tmpOut, 'utf8'));
|
||||
const generated = String(d.text || '').trim();
|
||||
if (generated.length < 80) {
|
||||
return { content: templateContent, source: 'template-fallback', note: 'model_output_too_short' };
|
||||
}
|
||||
const missing = required.filter((token) => !generated.includes(token));
|
||||
if (missing.length > 0) {
|
||||
return { content: templateContent, source: 'template-fallback', note: `missing_required=${missing.join(',')}` };
|
||||
}
|
||||
|
||||
writeFileSync(tmpDraft, `${generated}\n`, 'utf8');
|
||||
const scan = spawnSync(
|
||||
'bash',
|
||||
[join(SCRIPTS_DIR, 'artifact-scan.sh'), tmpDraft, `sourcegen-${stepId}`],
|
||||
{ timeout: 30000, encoding: 'utf8' },
|
||||
);
|
||||
if (scan.status !== 0) {
|
||||
return { content: templateContent, source: 'template-fallback', note: `artifact_scan_rc=${scan.status}` };
|
||||
}
|
||||
return { content: `${generated}\n`, source: 'model', note: `tokens=${d.total_tokens ?? '?'}` };
|
||||
} catch (err) {
|
||||
return { content: templateContent, source: 'template-fallback', note: `generate_error=${err?.name || 'Error'}` };
|
||||
} finally {
|
||||
for (const path of [tmpPrompt, tmpOut, tmpDraft]) {
|
||||
try { unlinkSync(path); } catch {}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// T1: Real rollback wiring — checkpoint before overwrite, restore on REJECTED verdict
|
||||
function checkpointArtifact(filePath) {
|
||||
try { readFileSync(filePath, 'utf8'); } catch { return null; } // file absent → nothing to checkpoint
|
||||
const r = spawnSync('bash', [join(SCRIPTS_DIR, 'rollback-manager.sh'), 'checkpoint', filePath],
|
||||
{ encoding: 'utf8', timeout: 10000 });
|
||||
if (r.status !== 0) return null;
|
||||
const m = (r.stdout || '').match(/transaction_id=(\S+)/);
|
||||
logDebug(`checkpoint artifact=${filePath} tx=${m ? m[1] : 'none'}`);
|
||||
return m ? m[1] : null;
|
||||
}
|
||||
|
||||
function executeRollback(txId) {
|
||||
if (!txId) return false;
|
||||
const r = spawnSync('bash', [join(SCRIPTS_DIR, 'rollback-manager.sh'), 'execute', txId],
|
||||
{ encoding: 'utf8', timeout: 10000 });
|
||||
logDebug(`rollback execute tx=${txId} rc=${r.status}`);
|
||||
return r.status === 0;
|
||||
}
|
||||
|
||||
const step = process.argv[2];
|
||||
const attempt = process.argv[3] ?? '1';
|
||||
const outputPath = process.env.CASAN_OUTPUT;
|
||||
const featureId = '001-okr-web-app';
|
||||
const moduleId = 'MOD-01';
|
||||
|
||||
if (!outputPath) {
|
||||
throw new Error('CASAN_OUTPUT is required');
|
||||
}
|
||||
|
||||
logDebug(`step=${step} attempt=${attempt} output=${outputPath}`);
|
||||
|
||||
const dirs = [
|
||||
`docs/output/output_logs/${featureId}/reports`,
|
||||
'docs/output/ipa-docs/srs',
|
||||
'docs/output/ipa-docs/bd',
|
||||
'docs/output/ipa-docs/dd',
|
||||
'docs/output/ipa-docs/testcase',
|
||||
`docs/output/specs/${featureId}/contracts`,
|
||||
];
|
||||
dirs.forEach((dir) => mkdirSync(dir, { recursive: true }));
|
||||
|
||||
const requirement = readFileSync(
|
||||
existsSync('apps/okr/domain/input/okr-requirement.md')
|
||||
? 'apps/okr/domain/input/okr-requirement.md'
|
||||
: 'docs/input/okr-requirement.md', 'utf8');
|
||||
const architecture = readFileSync('docs/technical_architecture.md', 'utf8');
|
||||
|
||||
function write(path, content) {
|
||||
mkdirSync(dirname(path), { recursive: true });
|
||||
writeFileSync(path, content, 'utf8');
|
||||
return path;
|
||||
}
|
||||
|
||||
function resultBlock({ status = 'COMPLETE', verdict = 'APPROVED', artifacts = [], issues = [] }) {
|
||||
return `\n<!-- STEP-RESULT\nstatus: ${status}\nverdict: ${verdict}\nartifacts:\n${artifacts.map((artifact) => ` - ${artifact}`).join('\n')}\ncritical-issues:\n${issues.length === 0 ? ' - none' : issues.map((issue) => ` - ${issue}`).join('\n')}\n/STEP-RESULT -->\n`;
|
||||
}
|
||||
|
||||
function report(path, title, body, verdict = 'APPROVED', artifacts = [], issues = []) {
|
||||
finalTitle = title;
|
||||
finalBody = body;
|
||||
finalVerdict = verdict;
|
||||
finalArtifacts = artifacts;
|
||||
finalIssues = issues;
|
||||
write(path, `${title}\n\n${body}\n${resultBlock({ verdict, artifacts, issues })}`);
|
||||
}
|
||||
|
||||
const srsPath = `docs/output/ipa-docs/srs/srs-mod01-okr-management.md`;
|
||||
const bdPath = `docs/output/ipa-docs/bd/bd-mod01-okr-management.md`;
|
||||
const specPath = `docs/output/specs/${featureId}/spec.md`;
|
||||
const planPath = `docs/output/specs/${featureId}/plan.md`;
|
||||
const dataModelPath = `docs/output/specs/${featureId}/data-model.md`;
|
||||
const researchPath = `docs/output/specs/${featureId}/research.md`;
|
||||
const quickstartPath = `docs/output/specs/${featureId}/quickstart.md`;
|
||||
const contractPath = `docs/output/specs/${featureId}/contracts/openapi.md`;
|
||||
const ddPath = `docs/output/ipa-docs/dd/dd-mod01-okr-management.md`;
|
||||
const testcasePath = `docs/output/ipa-docs/testcase/testcase-mod01-okr-management.md`;
|
||||
const tasksPath = `docs/output/specs/${featureId}/tasks.md`;
|
||||
const codeReviewPath = `docs/output/output_logs/${featureId}/reports/11-review-code-report.md`;
|
||||
let finalTitle = `# ${step}`;
|
||||
let finalBody = '';
|
||||
let finalVerdict = 'APPROVED';
|
||||
let finalArtifacts = [];
|
||||
let finalIssues = [];
|
||||
|
||||
// Sidecar stores the checkpoint tx-id between step 05-plan and step 06-reviewplan
|
||||
const CHECKPOINT_SIDECAR = `docs/output/specs/${featureId}/plan.checkpoint.txid`;
|
||||
|
||||
const backendFiles = [
|
||||
'backend/src/auth/auth.service.ts',
|
||||
'backend/src/objectives/objectives.service.ts',
|
||||
'backend/src/key-results/key-results.service.ts',
|
||||
'backend/test/e2e.test.ts',
|
||||
'backend/test/services.test.ts',
|
||||
];
|
||||
|
||||
switch (step) {
|
||||
case '01-srs': {
|
||||
const frCount = (requirement.match(/FR-\d+/g) ?? []).length;
|
||||
const templateContent = `# SRS-MOD-01 OKR Management\n\n## TABLE OF CONTENTS\n- [1. Purpose](#1-purpose)\n- [2. Scope](#2-scope)\n- [3. Functional Requirements](#3-functional-requirements)\n- [4. Non Functional Requirements](#4-non-functional-requirements)\n\n## 1. Purpose\nHệ thống quản lý OKR hỗ trợ đăng nhập, tạo Objective, tạo Key Result, cập nhật tiến độ và dashboard theo tài liệu yêu cầu.\n\n## 2. Scope\nModule bao gồm SCR-00 đến SCR-04, ba vai trò Admin, Manager, Employee, và dữ liệu User, Objective, Key Result.\n\n## 3. Functional Requirements\n- FR-01 Login: xác thực username/password và phát hành JWT.\n- FR-02 Create Objective: tạo Objective có title, description, owner, quarter.\n- FR-03 Create Key Result: tạo Key Result gắn với Objective.\n- FR-04 Update Progress: cập nhật progress 0-100 và ghi lịch sử cập nhật.\n- FR-05 Dashboard: hiển thị danh sách OKR theo quyền truy cập.\n\n## 4. Non Functional Requirements\n- Authentication required.\n- API response target dưới 2 giây.\n- SQLite được chọn cho kiểm thử không cần Docker.\n\n## Metrics\nFunctional requirements extracted: ${frCount}.\n`;
|
||||
const generated = generateArtifact({
|
||||
stepId: '01-srs',
|
||||
title: 'Software Requirements Specification',
|
||||
templateContent,
|
||||
required: ['FR-01', 'FR-02', 'FR-03', 'FR-04', 'FR-05'],
|
||||
extraInstructions: 'Create an SRS with purpose, scope, functional requirements, non-functional requirements, and traceable FR IDs.',
|
||||
});
|
||||
write(srsPath, generated.content);
|
||||
report(`docs/output/output_logs/${featureId}/reports/01-srs-report.md`, '# STEP 1: SRS Generation Report', `Generated ${srsPath} from apps/okr/domain/input/okr-requirement.md. source=${generated.source} note=${generated.note}.`, 'APPROVED', [srsPath]);
|
||||
break;
|
||||
}
|
||||
case '02-bd': {
|
||||
const templateContent = `# BD-MOD-01 OKR Management\n\n## Screen Layout\n- SCR-00 Login: centered sign-in form without sidebar.\n- SCR-01 Dashboard: fixed sidebar, fixed header, filter bar, OKR list.\n- SCR-02 Detail: objective overview, tabs, key result list.\n- SCR-03 Create Objective: title, description, owner, quarter, save.\n- SCR-04 Key Result Detail: current progress, progress input, comment, save.\n\n## API Boundary\nFrontend calls backend only through src/lib/api.ts and uses cookie/JWT auth.\n`;
|
||||
const generated = generateArtifact({
|
||||
stepId: '02-bd',
|
||||
title: 'Business Design',
|
||||
templateContent,
|
||||
required: ['SCR-00', 'SCR-01', 'SCR-02', 'SCR-03', 'SCR-04', 'API Boundary'],
|
||||
extraInstructions: 'Create a business design with screen layout for SCR-00 through SCR-04 and an API Boundary section.',
|
||||
});
|
||||
write(bdPath, generated.content);
|
||||
report(`docs/output/output_logs/${featureId}/reports/02-bd-report.md`, '# STEP 2: Business Design Report', `Generated ${bdPath}. source=${generated.source} note=${generated.note}.`, 'APPROVED', [bdPath]);
|
||||
break;
|
||||
}
|
||||
case '03-spec': {
|
||||
write(specPath, `# Feature Specification: OKR Web App\n\n## Feature ID\n${featureId}\n\n## Requirements\n- FR-01: Login authenticates username/email plus password and returns standard envelope.\n- FR-02: Objective creation validates title, owner, and quarter.\n- FR-03: Key Result creation validates objective, title, values, deadline, and progress.\n- FR-04: Progress update accepts 0-100 and stores a ProgressUpdate record.\n- FR-05: Dashboard list filters by role: ADMIN and MANAGER see all; EMPLOYEE sees own objectives.\n\n## Acceptance Criteria\n- Employee cannot read or update another employee objective or key result.\n- Manager can read all seeded objectives.\n- Invalid quarter format returns validation error.\n- Golden objective response fails on drift.\n\n## Source Trace\nRequirement characters read: ${requirement.length}. Architecture characters read: ${architecture.length}.\n`);
|
||||
report(`docs/output/output_logs/${featureId}/reports/03-spec-report.md`, '# STEP 3: Specify Report', `Generated ${specPath}.`, 'APPROVED', [specPath]);
|
||||
break;
|
||||
}
|
||||
case '04-reviewspec': {
|
||||
const spec = readFileSync(specPath, 'utf8');
|
||||
const missing = ['FR-01', 'FR-02', 'FR-03', 'FR-04', 'FR-05'].filter((id) => !spec.includes(id));
|
||||
let verdict = missing.length === 0 ? 'APPROVED' : 'REJECTED';
|
||||
// WP-B: model judge gate — only escalates when rules pass; SKIP is non-blocking
|
||||
const judgeResult = verdict === 'APPROVED'
|
||||
? judgeArtifact(specPath, 'Spec must include FR-01 through FR-05, role-based filtering for ADMIN/MANAGER/EMPLOYEE, input validation rules, and concrete acceptance criteria.')
|
||||
: { verdict: 'SKIP', note: 'rule_already_rejected' };
|
||||
if (judgeResult.verdict === 'REJECTED') verdict = 'REJECTED';
|
||||
const judgeNote = `model-judge: ${judgeResult.verdict} (${judgeResult.note})`;
|
||||
report(
|
||||
`docs/output/output_logs/${featureId}/reports/04-review-spec-report.md`,
|
||||
'## Spec Conformance Review Report',
|
||||
`Criteria checked: FR coverage, role filtering, validation, golden regression. Missing: ${missing.join(', ') || 'none'}. ${judgeNote}.`,
|
||||
verdict,
|
||||
[specPath],
|
||||
missing,
|
||||
);
|
||||
break;
|
||||
}
|
||||
case '05-plan': {
|
||||
const incomplete = attempt === '1';
|
||||
// T1: checkpoint existing plan before overwriting so rollback-manager.sh execute can restore it
|
||||
if (attempt !== '1') {
|
||||
const txId = checkpointArtifact(planPath);
|
||||
if (txId) {
|
||||
try { writeFileSync(CHECKPOINT_SIDECAR, txId, 'utf8'); } catch {}
|
||||
}
|
||||
}
|
||||
write(planPath, `# Implementation Plan: OKR Web App\n\n## Stack\nNestJS, Prisma Client, SQLite, React, Vite, Tailwind, Zod, TanStack Query.\n\n## Backend Modules\n- auth: JWT login and cookie issuance.\n- users: admin/manager user list.\n- objectives: role-filtered list, detail, create.\n- key-results: detail, create, progress update.\n\n## Tests\n- Backend service tests.\n- Backend HTTP e2e tests.\n${incomplete ? '- TODO: define golden regression and rollback strategy.\n' : '- Golden regression test compares seeded manager objectives with backend/test/golden/objectives.manager.json.\n- Rollback strategy restores changed artifacts from backups through rollback-manager.sh.\n'}\n## Build\nRun npm test and npm run build for backend and frontend.\n`);
|
||||
if (!incomplete) {
|
||||
write(dataModelPath, '# Data Model\n\nUser 1:N Objective. Objective 1:N KeyResult. KeyResult 1:N ProgressUpdate. Role/status are SQLite strings constrained in service/types.\n');
|
||||
write(researchPath, '# Research\n\nSQLite selected to satisfy no Docker/Postgres e2e. Prisma Client remains application ORM. Node built-in sqlite applies migration SQL because Prisma schema-engine push fails in this Node 24 local environment.\n');
|
||||
write(quickstartPath, '# Quickstart\n\n1. npm install\n2. npm run db:setup -w backend\n3. npm run seed -w backend\n4. npm run dev -w backend\n5. npm run dev -w frontend\n');
|
||||
write(contractPath, '# API Contract\n\nPOST /auth/login\nGET /objectives\nGET /objectives/:id\nPOST /objectives\nGET /key-results/:id\nPOST /key-results\nPATCH /key-results/:id/progress\n');
|
||||
}
|
||||
report(`docs/output/output_logs/${featureId}/reports/05-plan-report-attempt-${attempt}.md`, `# STEP 5: Plan Report Attempt ${attempt}`, `Generated ${planPath}.`, 'APPROVED', [planPath]);
|
||||
break;
|
||||
}
|
||||
case '06-reviewplan': {
|
||||
const plan = readFileSync(planPath, 'utf8');
|
||||
const required = ['Golden regression test', 'Rollback strategy', 'Backend Modules', 'Tests'];
|
||||
const missing = required.filter((phrase) => !plan.includes(phrase));
|
||||
const artifactMissing = [dataModelPath, researchPath, quickstartPath, contractPath].filter((path) => {
|
||||
try {
|
||||
readFileSync(path, 'utf8');
|
||||
return false;
|
||||
} catch {
|
||||
return true;
|
||||
}
|
||||
});
|
||||
const issues = [...missing.map((item) => `missing plan criterion: ${item}`), ...artifactMissing.map((item) => `missing artifact: ${item}`)];
|
||||
let verdict = issues.length === 0 ? 'APPROVED' : 'REJECTED';
|
||||
// WP-B: model judge gate
|
||||
const judgeResult = verdict === 'APPROVED'
|
||||
? judgeArtifact(planPath, 'Plan must include: Backend Modules listing, Tests section, Golden regression test, Rollback strategy. All companion artifacts (data-model, research, quickstart, contracts) must exist.')
|
||||
: { verdict: 'SKIP', note: 'rule_already_rejected' };
|
||||
if (judgeResult.verdict === 'REJECTED') verdict = 'REJECTED';
|
||||
const judgeNote = `model-judge: ${judgeResult.verdict} (${judgeResult.note})`;
|
||||
// T1: on REJECTED, execute rollback to restore the previously checkpointed plan
|
||||
let rollbackNote = '';
|
||||
if (verdict === 'REJECTED') {
|
||||
let txId = null;
|
||||
try { txId = readFileSync(CHECKPOINT_SIDECAR, 'utf8').trim(); } catch {}
|
||||
if (txId) {
|
||||
const restored = executeRollback(txId);
|
||||
rollbackNote = restored
|
||||
? ` Rollback executed: plan restored to pre-overwrite state (tx=${txId}).`
|
||||
: ` Rollback attempted but failed (tx=${txId}).`;
|
||||
}
|
||||
}
|
||||
report(
|
||||
`docs/output/output_logs/${featureId}/reports/06-review-plan-report-attempt-${attempt}.md`,
|
||||
`## Plan Conformance Review Report — Attempt ${attempt}`,
|
||||
`Criteria checked against plan.md and required companion artifacts. ${judgeNote}. Verdict is ${verdict}.${rollbackNote}`,
|
||||
verdict,
|
||||
[planPath, dataModelPath, researchPath, quickstartPath, contractPath],
|
||||
issues,
|
||||
);
|
||||
break;
|
||||
}
|
||||
case '07-dd': {
|
||||
write(ddPath, `# DD-MOD-01 OKR Management\n\n## Backend Design\nControllers are thin and call AuthService, UsersService, ObjectivesService, KeyResultsService. PrismaService is the only database access layer.\n\n## Authorization\nJwtAuthGuard verifies Bearer/cookie token. Employees are constrained to ownerId == user.sub. Managers/Admins read all objectives.\n\n## Progress Calculation\nKeyResultsService updates progress in a transaction, writes ProgressUpdate, then recalculates objective status.\n`);
|
||||
report(`docs/output/output_logs/${featureId}/reports/07-dd-report.md`, '# STEP 7: Detail Design Report', `Generated ${ddPath}.`, 'APPROVED', [ddPath]);
|
||||
break;
|
||||
}
|
||||
case '08-testkit': {
|
||||
write(testcasePath, `# Test Cases MOD-01\n\n- TC-01 login rejects wrong password.\n- TC-02 employee list returns only own objectives.\n- TC-03 manager list returns all seeded objectives.\n- TC-04 invalid objective payload returns 400.\n- TC-05 progress patch updates a key result and stores progress.\n- TC-06 golden manager objective response fails on drift.\n`);
|
||||
report(`docs/output/output_logs/${featureId}/reports/08-testkit-report.md`, '# STEP 8: Testkit Report', `Generated ${testcasePath}.`, 'APPROVED', [testcasePath]);
|
||||
break;
|
||||
}
|
||||
case '09-tasks': {
|
||||
write(tasksPath, `# Tasks\n\n- [X] Backend auth module with JWT and bcrypt.\n- [X] Backend users/objectives/key-results modules.\n- [X] Prisma schema, SQLite migration SQL, idempotent seed.\n- [X] Frontend login, dashboard, objective detail, create objective, key result detail.\n- [X] Backend service and e2e tests.\n- [X] Golden regression fixture and deliberate failure evidence.\n- [X] Build/test logs captured.\n`);
|
||||
report(`docs/output/output_logs/${featureId}/reports/09-tasks-report.md`, '# STEP 9: Tasks Report', `Generated ${tasksPath}.`, 'APPROVED', [tasksPath]);
|
||||
break;
|
||||
}
|
||||
case '10-reviewcode': {
|
||||
const missingFiles = backendFiles.filter((path) => {
|
||||
try {
|
||||
readFileSync(path, 'utf8');
|
||||
return false;
|
||||
} catch {
|
||||
return true;
|
||||
}
|
||||
});
|
||||
const serviceText = backendFiles.map((path) => readFileSync(path, 'utf8')).join('\n');
|
||||
const issues = [];
|
||||
if (!serviceText.includes('PrismaService')) issues.push('PrismaService not used');
|
||||
if (!serviceText.includes('ForbiddenException')) issues.push('authorization exception not found');
|
||||
if (!serviceText.includes('golden objective list response does not drift')) issues.push('golden test not found');
|
||||
issues.push(...missingFiles.map((path) => `missing file: ${path}`));
|
||||
let verdict = issues.length === 0 ? 'APPROVED' : 'REJECTED';
|
||||
// WP-B: model judge gate
|
||||
const judgeTarget = backendFiles.find((p) => { try { readFileSync(p, 'utf8'); return true; } catch { return false; } }) ?? codeReviewPath;
|
||||
const judgeResult = verdict === 'APPROVED'
|
||||
? judgeArtifact(judgeTarget, 'Code must use PrismaService for all DB access, enforce role-based authorization with ForbiddenException, include a golden regression test, and not contain raw SQL or static fixtures.')
|
||||
: { verdict: 'SKIP', note: 'rule_already_rejected' };
|
||||
if (judgeResult.verdict === 'REJECTED') verdict = 'REJECTED';
|
||||
const judgeNote = `model-judge: ${judgeResult.verdict} (${judgeResult.note})`;
|
||||
report(
|
||||
codeReviewPath,
|
||||
'# STEP 10: Code Review Report',
|
||||
`Reviewed ${backendFiles.length} backend/test files. DB data usage verification: Prisma Client used, frontend API client used, seed data exists, no static endpoint data found. ${judgeNote}.`,
|
||||
verdict,
|
||||
[...backendFiles, 'frontend/src/lib/api.ts', 'backend/prisma/seed.ts'],
|
||||
issues,
|
||||
);
|
||||
break;
|
||||
}
|
||||
default:
|
||||
throw new Error(`Unknown step: ${step}`);
|
||||
}
|
||||
|
||||
writeFileSync(
|
||||
outputPath,
|
||||
`${finalTitle}\n\n${finalBody}\n\nGenerated by ${step} attempt ${attempt} for ${featureId}.\n${resultBlock({
|
||||
verdict: finalVerdict,
|
||||
artifacts: finalArtifacts,
|
||||
issues: finalIssues,
|
||||
})}`,
|
||||
'utf8',
|
||||
);
|
||||
@@ -0,0 +1,420 @@
|
||||
import { execFileSync } from 'node:child_process';
|
||||
import { existsSync, appendFileSync, copyFileSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs';
|
||||
import { dirname, join } from 'node:path';
|
||||
import { enabled, log, redact, LOG_LEVEL } from './casan-log.mjs';
|
||||
|
||||
// --dry-run: walk the FULL 13-STEP diagram with stub agents. Every stub still
|
||||
// goes through casan-harness.sh (H4-in -> H5 -> H6 -> exec -> H4-out), so log
|
||||
// levels and pipeline-run.jsonl can be demonstrated deterministically offline.
|
||||
const dryRun = process.argv.includes('--dry-run');
|
||||
|
||||
const featureId = '001-okr-web-app';
|
||||
const root = process.cwd();
|
||||
// Plan-01: harness relocated to packages/casan-harness/, domain to apps/okr/domain/;
|
||||
// fall back to the pre-move paths so this runner works from either layout.
|
||||
const HARNESS_BASH = existsSync(join(root, 'packages/casan-harness/scripts/bash'))
|
||||
? 'packages/casan-harness/scripts/bash'
|
||||
: '.specify/scripts/bash';
|
||||
const HARNESS = `${HARNESS_BASH}/casan-harness.sh`;
|
||||
const GOLDEN_PLAN = existsSync(join(root, 'apps/okr/domain/golden-runs/okr-plan.golden.txt'))
|
||||
? 'apps/okr/domain/golden-runs/okr-plan.golden.txt'
|
||||
: '.specify/level5/golden-runs/okr-plan.golden.txt';
|
||||
const logDir = `docs/output/output_logs/${featureId}`;
|
||||
const casanDir = `${logDir}/casan`;
|
||||
const reportsDir = `${logDir}/reports`;
|
||||
const contextPath = dryRun ? `${logDir}/pipeline-context.dryrun.yaml` : `${logDir}/pipeline-context.yaml`;
|
||||
const bossLog = dryRun ? `${logDir}/00-boss.dryrun.log.md` : `${logDir}/00-boss.log.md`;
|
||||
const runLogPath = '.specify/logs/pipeline-run.jsonl';
|
||||
const runId = `${dryRun ? 'dry' : 'run'}-${new Date().toISOString().replace(/[:.]/g, '-')}-${process.pid}`;
|
||||
|
||||
// Map casan-step keys -> STEP ids of the FULL diagram
|
||||
// (optimize-docs/CASAN_PIPELINE_WORKFLOW.md section 1). STEP4/10/12/13 have no
|
||||
// real agent step yet; they run as stubs in --dry-run only.
|
||||
const DIAGRAM_STEP = {
|
||||
'01-srs': 'STEP1',
|
||||
'02-bd': 'STEP2',
|
||||
'03-spec': 'STEP3',
|
||||
'04-reviewspec': 'STEP5',
|
||||
'05-plan': 'STEP6',
|
||||
'06-reviewplan': 'STEP7',
|
||||
'07-dd': 'STEP8',
|
||||
'08-testkit': 'STEP8b',
|
||||
'09-tasks': 'STEP9',
|
||||
'10-reviewcode': 'STEP11',
|
||||
};
|
||||
|
||||
const FULL_DIAGRAM = [
|
||||
['STEP1', 'okr.srs'],
|
||||
['STEP2', 'okr.bd'],
|
||||
['STEP3', 'speckit.specify'],
|
||||
['STEP4', 'speckit.clarify'],
|
||||
['STEP5', 'okr.reviewspec'],
|
||||
['STEP6', 'speckit.plan'],
|
||||
['STEP7', 'okr.reviewplan'],
|
||||
['STEP8', 'okr.dd'],
|
||||
['STEP8b', 'okr.testkit'],
|
||||
['STEP9', 'speckit.tasks'],
|
||||
['STEP10', 'speckit.implement'],
|
||||
['STEP11', 'okr.reviewcode'],
|
||||
['STEP12', 'okr.testkit run-tests'],
|
||||
['STEP13', 'deploy'],
|
||||
];
|
||||
|
||||
const summaryRows = [];
|
||||
const loopsFired = [];
|
||||
|
||||
mkdirSync(casanDir, { recursive: true });
|
||||
mkdirSync(reportsDir, { recursive: true });
|
||||
writeFileSync(
|
||||
contextPath,
|
||||
`feature-id: ${featureId}\nmodule-id: MOD-01\nmodule-keyword: okr-management\ntech-stack: NestJS + Prisma + SQLite + React + Vite + Tailwind\nsteps:\n`,
|
||||
'utf8',
|
||||
);
|
||||
writeFileSync(bossLog, `# Boss Log ${featureId}\n\n`, 'utf8');
|
||||
|
||||
log('info', 'boss', `pipeline start run_id=${runId} mode=${dryRun ? 'dry-run' : 'real'} log_level=${LOG_LEVEL}`);
|
||||
|
||||
function appendBoss(line) {
|
||||
const ts = new Date().toISOString();
|
||||
writeFileSync(bossLog, `${readFileSync(bossLog, 'utf8')}- ${ts} ${line}\n`, 'utf8');
|
||||
}
|
||||
|
||||
function appendRunLog(record) {
|
||||
mkdirSync(dirname(runLogPath), { recursive: true });
|
||||
appendFileSync(runLogPath, `${JSON.stringify(record)}\n`, 'utf8');
|
||||
}
|
||||
|
||||
function latestAgentTrace(stepName) {
|
||||
const traceDir = '.specify/logs/trace';
|
||||
const files = readdirSync(traceDir)
|
||||
.filter((file) => file.startsWith('agentops-') && file.endsWith('.json'))
|
||||
.map((file) => join(traceDir, file))
|
||||
.sort((a, b) => statSync(b).mtimeMs - statSync(a).mtimeMs);
|
||||
for (const file of files) {
|
||||
const record = JSON.parse(readFileSync(file, 'utf8'));
|
||||
if (record.step === stepName) {
|
||||
return { traceId: record.trace_id, path: file, status: record.status, record };
|
||||
}
|
||||
}
|
||||
throw new Error(`No trace found for ${stepName}`);
|
||||
}
|
||||
|
||||
function verdictFromOutput(path) {
|
||||
const text = readFileSync(path, 'utf8');
|
||||
const match = text.match(/verdict:\s*([A-Z_]+)/);
|
||||
return match?.[1] ?? 'UNKNOWN';
|
||||
}
|
||||
|
||||
function appendContext({ id, agent, output, trace }) {
|
||||
const verdict = verdictFromOutput(output);
|
||||
const existing = readFileSync(contextPath, 'utf8');
|
||||
writeFileSync(
|
||||
contextPath,
|
||||
`${existing} - id: ${id}\n agent: ${agent}\n artifact: ${output}\n verdict: ${verdict}\n trace_id: ${trace.traceId}\n trace_file: ${trace.path}\n status: ${trace.status}\n`,
|
||||
'utf8',
|
||||
);
|
||||
}
|
||||
|
||||
function readPhaseReport(path) {
|
||||
try {
|
||||
return JSON.parse(readFileSync(path, 'utf8'));
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
function phasesBrief(phases) {
|
||||
if (!phases?.phases?.length) return 'unavailable';
|
||||
return `${phases.phases.map((p) => `${p.phase}:rc=${p.rc}`).join(' → ')} (cache=${phases.cache})`;
|
||||
}
|
||||
|
||||
// Shared post-execution bookkeeping for real and dry-run steps: human logs at
|
||||
// info/debug, one machine-readable line per step in pipeline-run.jsonl.
|
||||
function recordStep({ diagram, id, agent, attempt, verdict, ms, trace, phases, input, output, error }) {
|
||||
const tokens = trace?.record?.total_tokens ?? null;
|
||||
log('info', 'boss', `${diagram} · ${agent} · verdict=${verdict} · ${ms}ms · attempt=${attempt}`);
|
||||
log(
|
||||
'debug',
|
||||
'boss',
|
||||
`${diagram} detail id=${id} trace_id=${trace?.traceId ?? 'n/a'} status=${trace?.status ?? 'n/a'} tokens=${tokens ?? '?'} input=${input} output=${output} harness=${phasesBrief(phases)}`,
|
||||
);
|
||||
appendRunLog({
|
||||
ts: new Date().toISOString(),
|
||||
run_id: runId,
|
||||
mode: dryRun ? 'dry-run' : 'real',
|
||||
step: diagram,
|
||||
id,
|
||||
agent,
|
||||
attempt: Number(attempt),
|
||||
verdict,
|
||||
error: error ?? null,
|
||||
ms,
|
||||
tokens,
|
||||
trace_id: trace?.traceId ?? null,
|
||||
harness: phases?.phases ?? null,
|
||||
cache: phases?.cache ?? null,
|
||||
input,
|
||||
output,
|
||||
});
|
||||
summaryRows.push({ diagram, id, agent, attempt, verdict, ms, tokens });
|
||||
}
|
||||
|
||||
// The diagram's self-correcting loops. Logged whenever a review verdict makes
|
||||
// the Boss re-run an earlier step (STEP5->STEP3, STEP7->STEP6, STEP11->STEP10,
|
||||
// STEP12->STEP6).
|
||||
function logLoop(fromStep, verdict, toStep, note) {
|
||||
const line = `LOOP ${fromStep} verdict=${verdict} → ${toStep} (${note})`;
|
||||
loopsFired.push(line);
|
||||
log('warn', 'boss', line);
|
||||
}
|
||||
|
||||
function runHarness({ id, agent, step, attempt = '1' }) {
|
||||
const diagram = DIAGRAM_STEP[step] ?? step;
|
||||
const input = `${casanDir}/${id}-input.txt`;
|
||||
const output = `${casanDir}/${id}-output.md`;
|
||||
const phaseReport = `${casanDir}/${id}-phases.json`;
|
||||
const payload = `feature ${featureId}\nstep ${id}\nagent ${agent}\nattempt ${attempt}\nsource docs/input/okr-requirement.md\n`;
|
||||
writeFileSync(input, payload, 'utf8');
|
||||
appendBoss(`START ${id} ${agent} attempt ${attempt}`);
|
||||
log('debug', 'boss', `${diagram} start agent=${agent} attempt=${attempt} action=agent_step_${id}`);
|
||||
if (enabled('trace')) log('trace', 'boss', `${diagram} input payload (redacted): ${redact(payload)}`);
|
||||
const startedAt = Date.now();
|
||||
try {
|
||||
execFileSync(
|
||||
HARNESS,
|
||||
[input, output, `agent_step_${id}`, '--', 'node', 'scripts/casan-step.mjs', step, attempt],
|
||||
{
|
||||
cwd: root,
|
||||
stdio: 'inherit',
|
||||
env: {
|
||||
...process.env,
|
||||
CASAN_AGENT: agent,
|
||||
CASAN_AGENT_NAME: agent,
|
||||
CASAN_STEP_NAME: id,
|
||||
CASAN_PHASE_REPORT: phaseReport,
|
||||
},
|
||||
},
|
||||
);
|
||||
} catch (error) {
|
||||
const ms = Date.now() - startedAt;
|
||||
const phases = readPhaseReport(phaseReport);
|
||||
log('error', 'boss', `${diagram} · ${agent} · FAILED rc=${error.status ?? '?'} · ${ms}ms · harness=${phasesBrief(phases)}`);
|
||||
recordStep({ diagram, id, agent, attempt, verdict: 'ERROR', ms, trace: null, phases, input, output, error: `harness rc=${error.status ?? 'unknown'}` });
|
||||
throw error;
|
||||
}
|
||||
const ms = Date.now() - startedAt;
|
||||
const trace = latestAgentTrace(id);
|
||||
appendContext({ id, agent, output, trace });
|
||||
const verdict = verdictFromOutput(output);
|
||||
appendBoss(`END ${id} verdict ${verdict} trace ${trace.traceId}`);
|
||||
const phases = readPhaseReport(phaseReport);
|
||||
recordStep({ diagram, id, agent, attempt, verdict, ms, trace, phases, input, output });
|
||||
if (enabled('trace')) log('trace', 'boss', `${diagram} output excerpt (redacted): ${redact(readFileSync(output, 'utf8'))}`);
|
||||
return { output, verdict, trace };
|
||||
}
|
||||
|
||||
function printSummary() {
|
||||
if (!enabled('info')) return;
|
||||
const lines = [];
|
||||
lines.push('');
|
||||
lines.push(`═══ CASAN pipeline summary · run_id=${runId} · mode=${dryRun ? 'dry-run' : 'real'} ═══`);
|
||||
lines.push('STEP | agent | verdict | attempts | last ms | tokens');
|
||||
lines.push('--------|------------------------|-----------|----------|---------|-------');
|
||||
for (const [diagram, defaultAgent] of FULL_DIAGRAM) {
|
||||
const rows = summaryRows.filter((r) => r.diagram === diagram);
|
||||
if (rows.length === 0) {
|
||||
lines.push(`${diagram.padEnd(7)} | ${defaultAgent.padEnd(22)} | — | 0 | — | — (not in this run${dryRun ? '' : '; stub available via --dry-run'})`);
|
||||
continue;
|
||||
}
|
||||
const last = rows[rows.length - 1];
|
||||
lines.push(
|
||||
`${diagram.padEnd(7)} | ${last.agent.padEnd(22)} | ${String(last.verdict).padEnd(9)} | ${String(rows.length).padEnd(8)} | ${String(last.ms).padEnd(7)} | ${last.tokens ?? '—'}`,
|
||||
);
|
||||
}
|
||||
lines.push('');
|
||||
lines.push(loopsFired.length ? `Loops fired:\n${loopsFired.map((l) => ` - ${l}`).join('\n')}` : 'Loops fired: none');
|
||||
lines.push(`Machine-readable log: ${runLogPath} (jq 'select(.run_id=="${runId}")' — 1 dòng/step)`);
|
||||
console.log(lines.join('\n'));
|
||||
}
|
||||
|
||||
// ───────────────────────────── dry-run mode ─────────────────────────────
|
||||
// Stub every agent call but keep the production wrapper in the loop. The stub
|
||||
// command writes a deterministic artifact containing the wanted verdict, so
|
||||
// the Boss's verdict parsing, loop handling, and logging all run for real.
|
||||
function runDryStep({ diagram, agent, attempt = '1', verdict = 'APPROVED', extraEnv = {} }) {
|
||||
const id = `dry-${diagram}-attempt-${attempt}`;
|
||||
const input = `${casanDir}/${id}-input.txt`;
|
||||
const output = `${casanDir}/${id}-output.md`;
|
||||
const phaseReport = `${casanDir}/${id}-phases.json`;
|
||||
const payload = `feature ${featureId}\nstep ${diagram}\nagent ${agent}\nattempt ${attempt}\nmode dry-run stub\n`;
|
||||
writeFileSync(input, payload, 'utf8');
|
||||
appendBoss(`START ${id} ${agent} attempt ${attempt} (dry-run stub)`);
|
||||
log('debug', 'boss', `${diagram} start agent=${agent} attempt=${attempt} action=agent_step_${id} (stub agent, harness thật)`);
|
||||
if (enabled('trace')) log('trace', 'boss', `${diagram} input payload (redacted): ${redact(payload)}`);
|
||||
const stubCmd = `printf '# %s dry-run stub artifact\\n\\nverdict: %s\\n' '${diagram}' '${verdict}' > "$CASAN_OUTPUT"`;
|
||||
const startedAt = Date.now();
|
||||
execFileSync(
|
||||
HARNESS,
|
||||
[input, output, `agent_step_${id}`, '--', 'bash', '-c', stubCmd],
|
||||
{
|
||||
cwd: root,
|
||||
stdio: 'inherit',
|
||||
env: {
|
||||
...process.env,
|
||||
CASAN_AGENT: agent,
|
||||
CASAN_AGENT_NAME: agent,
|
||||
CASAN_STEP_NAME: id,
|
||||
CASAN_PHASE_REPORT: phaseReport,
|
||||
...extraEnv,
|
||||
},
|
||||
},
|
||||
);
|
||||
const ms = Date.now() - startedAt;
|
||||
const trace = latestAgentTrace(id);
|
||||
appendContext({ id, agent, output, trace });
|
||||
const got = verdictFromOutput(output);
|
||||
appendBoss(`END ${id} verdict ${got} trace ${trace.traceId}`);
|
||||
recordStep({ diagram, id, agent, attempt, verdict: got, ms, trace, phases: readPhaseReport(phaseReport), input, output });
|
||||
return got;
|
||||
}
|
||||
|
||||
if (dryRun) {
|
||||
const agentOf = Object.fromEntries(FULL_DIAGRAM);
|
||||
for (const diagram of ['STEP1', 'STEP2', 'STEP3', 'STEP4', 'STEP5']) {
|
||||
runDryStep({ diagram, agent: agentOf[diagram] });
|
||||
}
|
||||
// STEP6 -> STEP7 with the BACK-TO-PLAN loop firing once (attempt 1 REJECTED).
|
||||
runDryStep({ diagram: 'STEP6', agent: agentOf.STEP6 });
|
||||
let v = runDryStep({ diagram: 'STEP7', agent: agentOf.STEP7, verdict: 'REJECTED' });
|
||||
if (v === 'REJECTED') {
|
||||
logLoop('STEP7', v, 'STEP6', 'BACK-TO-PLAN: re-plan attempt 2');
|
||||
runDryStep({ diagram: 'STEP6', agent: agentOf.STEP6, attempt: '2' });
|
||||
v = runDryStep({ diagram: 'STEP7', agent: agentOf.STEP7, attempt: '2' });
|
||||
}
|
||||
for (const diagram of ['STEP8', 'STEP8b', 'STEP9', 'STEP10', 'STEP11']) {
|
||||
runDryStep({ diagram, agent: agentOf[diagram] });
|
||||
}
|
||||
// STEP12 run-tests with the FAIL -> STEP6 loop firing once.
|
||||
v = runDryStep({ diagram: 'STEP12', agent: agentOf.STEP12, verdict: 'FAIL' });
|
||||
if (v === 'FAIL') {
|
||||
logLoop('STEP12', v, 'STEP6', 'tests FAIL: re-plan then re-test');
|
||||
runDryStep({ diagram: 'STEP6', agent: agentOf.STEP6, attempt: '3' });
|
||||
v = runDryStep({ diagram: 'STEP12', agent: agentOf.STEP12, attempt: '2', verdict: 'PASS' });
|
||||
}
|
||||
// STEP13's payload mentions "deploy", which H5 correctly classifies as
|
||||
// high-risk → approval required. Simulate a distinct human approver so the
|
||||
// dry-run walks the real approval path (separation of duties holds:
|
||||
// actor=developer != approver=qa-lead).
|
||||
log('debug', 'boss', 'STEP13 is high-risk (deploy): supplying human approval approver=qa-lead for the dry-run');
|
||||
runDryStep({
|
||||
diagram: 'STEP13',
|
||||
agent: agentOf.STEP13,
|
||||
extraEnv: { CASAN_APPROVAL_DECISION: 'approve', CASAN_APPROVER: 'qa-lead' },
|
||||
});
|
||||
printSummary();
|
||||
log('info', 'boss', `dry-run complete. Boss log: ${bossLog}. Context: ${contextPath}.`);
|
||||
process.exit(0);
|
||||
}
|
||||
|
||||
// ───────────────────────────── real pipeline ─────────────────────────────
|
||||
const sequence = [
|
||||
{ id: '01-srs', agent: 'okr.srs', step: '01-srs' },
|
||||
{ id: '02-bd', agent: 'okr.bd', step: '02-bd' },
|
||||
{ id: '03-spec', agent: 'speckit.specify', step: '03-spec' },
|
||||
{ id: '04-reviewspec', agent: 'okr.reviewspec', step: '04-reviewspec' },
|
||||
{ id: '05-plan-attempt-1', agent: 'speckit.plan', step: '05-plan', attempt: '1' },
|
||||
];
|
||||
|
||||
for (const item of sequence) {
|
||||
const { verdict } = runHarness(item);
|
||||
if (item.step === '04-reviewspec' && verdict === 'REJECTED') {
|
||||
// Diagram loop STEP5 -> STEP3. The current sequence expects APPROVED here;
|
||||
// if a rejection ever happens we surface the loop instead of hiding it.
|
||||
logLoop('STEP5', verdict, 'STEP3', 'review-spec rejected; sequence continues but needs attention');
|
||||
}
|
||||
}
|
||||
|
||||
const reviewPlan1 = runHarness({ id: '06-reviewplan-attempt-1', agent: 'okr.reviewplan', step: '06-reviewplan', attempt: '1' });
|
||||
if (reviewPlan1.verdict === 'REJECTED') {
|
||||
logLoop('STEP7', reviewPlan1.verdict, 'STEP6', 'BACK-TO-PLAN: retrying plan with missing criteria fixed');
|
||||
}
|
||||
|
||||
appendBoss('BACK-TO-PLAN triggered by reviewplan rejection; retrying plan with missing criteria fixed.');
|
||||
runHarness({ id: '07-plan-attempt-2', agent: 'speckit.plan', step: '05-plan', attempt: '2' });
|
||||
|
||||
const fallbackOut = `${casanDir}/model-fallback-output.txt`;
|
||||
log('debug', 'boss', `model-fallback invoked (real primary failure) → ${fallbackOut}`);
|
||||
execFileSync(
|
||||
`/model-fallback.sh`,
|
||||
[
|
||||
fallbackOut,
|
||||
// Real primary failure: reading a nonexistent path exits non-zero (not a
|
||||
// hardcoded `exit 9` stub) — the fallback route is driven by a genuine error.
|
||||
'--primary',
|
||||
'cat /nonexistent/casan/primary-model-endpoint',
|
||||
'--fallback',
|
||||
'printf "Generate a safe OKR plan for employee ***MASKED_EMAIL***.\\nExpected sections:\\n- Objective\\n- Key Results\\n- Security gate\\n- Governance decision\\n- AgentOps metrics\\n"',
|
||||
],
|
||||
{ cwd: root, stdio: 'inherit' },
|
||||
);
|
||||
appendBoss(`Model fallback invoked; output ${fallbackOut}`);
|
||||
|
||||
// Drift: compare this run's fallback plan output against the committed golden
|
||||
// baseline. A clean run matches the golden (similarity=1.0 → no drift). The
|
||||
// ability to DETECT real drift (similarity<1.0 on differing docs) is proven
|
||||
// independently in adversarial-harness-tests.sh (H7 drift, two different files).
|
||||
const driftCandidate = `${casanDir}/drift-plan-candidate.txt`;
|
||||
copyFileSync(fallbackOut, driftCandidate);
|
||||
log('debug', 'boss', 'drift-detect: fallback output vs golden baseline');
|
||||
execFileSync(`/drift-detect.sh`, [
|
||||
GOLDEN_PLAN,
|
||||
driftCandidate,
|
||||
'.specify/logs/level5/okr-plan-drift-report.json',
|
||||
], { cwd: root, stdio: 'inherit' });
|
||||
appendBoss('Drift detection invoked: fallback output vs golden baseline.');
|
||||
|
||||
const reviewPlan2 = runHarness({ id: '08-reviewplan-attempt-2', agent: 'okr.reviewplan', step: '06-reviewplan', attempt: '2' });
|
||||
if (reviewPlan2.verdict === 'REJECTED') {
|
||||
logLoop('STEP7', reviewPlan2.verdict, 'STEP6', 'BACK-TO-PLAN attempt 2 still rejected');
|
||||
}
|
||||
runHarness({ id: '09-dd', agent: 'okr.dd', step: '07-dd' });
|
||||
runHarness({ id: '10-testkit', agent: 'okr.testkit', step: '08-testkit' });
|
||||
runHarness({ id: '11-tasks', agent: 'speckit.tasks', step: '09-tasks' });
|
||||
const reviewCode = runHarness({ id: '12-reviewcode', agent: 'okr.reviewcode', step: '10-reviewcode' });
|
||||
if (reviewCode.verdict === 'REJECTED') {
|
||||
// Diagram loop STEP11 -> STEP10 (implement is not an agent step yet).
|
||||
logLoop('STEP11', reviewCode.verdict, 'STEP10', 'review-code rejected; implement step must be re-run');
|
||||
}
|
||||
|
||||
const rollbackDir = 'docs/output/casan/app-evidence';
|
||||
mkdirSync(rollbackDir, { recursive: true });
|
||||
const rollbackTarget = `${rollbackDir}/rollback-target.txt`;
|
||||
const rollbackBackup = `${rollbackDir}/rollback-target.backup.txt`;
|
||||
writeFileSync(rollbackTarget, 'original pipeline rollback content\n', 'utf8');
|
||||
copyFileSync(rollbackTarget, rollbackBackup);
|
||||
writeFileSync(`${rollbackDir}/rollback-before.txt`, readFileSync(rollbackTarget, 'utf8'), 'utf8');
|
||||
writeFileSync(rollbackTarget, 'changed content that must be undone\n', 'utf8');
|
||||
writeFileSync(`${rollbackDir}/rollback-changed.txt`, readFileSync(rollbackTarget, 'utf8'), 'utf8');
|
||||
const record = execFileSync(`/rollback-manager.sh`, [
|
||||
'record',
|
||||
'restore rollback target evidence file',
|
||||
`cp ${rollbackBackup} ${rollbackTarget}`,
|
||||
], { cwd: root, encoding: 'utf8' });
|
||||
writeFileSync(`${rollbackDir}/rollback-record.stdout`, record, 'utf8');
|
||||
const tx = record.match(/transaction_id=([^\s]+)/)?.[1];
|
||||
if (!tx) {
|
||||
throw new Error('rollback transaction id not found');
|
||||
}
|
||||
const execute = execFileSync(`/rollback-manager.sh`, ['execute', tx], {
|
||||
cwd: root,
|
||||
encoding: 'utf8',
|
||||
});
|
||||
writeFileSync(`${rollbackDir}/rollback-execute.stdout`, execute, 'utf8');
|
||||
writeFileSync(`${rollbackDir}/rollback-after.txt`, readFileSync(rollbackTarget, 'utf8'), 'utf8');
|
||||
appendBoss(`Rollback transaction ${tx} executed; before/changed/after evidence captured.`);
|
||||
log('debug', 'boss', `rollback transaction ${tx} recorded + executed (evidence under ${rollbackDir})`);
|
||||
|
||||
printSummary();
|
||||
const summary = `Pipeline complete. Context: ${contextPath}. Boss log: ${bossLog}. Last step artifacts under ${reportsDir}.\n`;
|
||||
writeFileSync(`${rollbackDir}/pipeline-summary.txt`, summary, 'utf8');
|
||||
console.log(summary);
|
||||
@@ -0,0 +1,93 @@
|
||||
#!/usr/bin/env bash
|
||||
# Setup act_runner on the CI runner VPS (161.33.149.243).
|
||||
#
|
||||
# Prerequisites (run on CI runner VPS as ubuntu):
|
||||
# 1. Get a runner registration token from Gitea:
|
||||
# http://161.33.139.73:3000 → Site Administration → Runners → "Create Runner"
|
||||
# 2. Generate a deploy SSH key for accessing the web VPS:
|
||||
# ssh-keygen -t ed25519 -f /tmp/deploy_key -N ""
|
||||
# ssh-copy-id -i /tmp/deploy_key.pub ubuntu@161.33.139.73
|
||||
# Add /tmp/deploy_key (private) as Gitea secret: DEPLOY_SSH_KEY
|
||||
# rm /tmp/deploy_key
|
||||
#
|
||||
# Usage:
|
||||
# RUNNER_TOKEN=<token-from-gitea> bash setup-ci-runner.sh
|
||||
#
|
||||
set -euo pipefail
|
||||
|
||||
GITEA_URL="http://161.33.139.73:3000"
|
||||
RUNNER_NAME="casan-ci-runner"
|
||||
RUNNER_VERSION="v0.2.12"
|
||||
INSTALL_DIR="/opt/act-runner"
|
||||
|
||||
if [[ -z "${RUNNER_TOKEN:-}" ]]; then
|
||||
echo "ERROR: RUNNER_TOKEN env var is required."
|
||||
echo " Get it from: $GITEA_URL → Site Administration → Runners → Create Runner"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "=== Installing act_runner $RUNNER_VERSION ==="
|
||||
sudo mkdir -p "$INSTALL_DIR"
|
||||
sudo curl -fsSL \
|
||||
"https://gitea.com/gitea/act_runner/releases/download/${RUNNER_VERSION}/act_runner-${RUNNER_VERSION}-linux-amd64" \
|
||||
-o "$INSTALL_DIR/act_runner"
|
||||
sudo chmod +x "$INSTALL_DIR/act_runner"
|
||||
|
||||
echo "=== Writing runner config ==="
|
||||
sudo tee "$INSTALL_DIR/config.yaml" > /dev/null <<'CONFIG'
|
||||
log:
|
||||
level: info
|
||||
|
||||
runner:
|
||||
name: "casan-ci-runner"
|
||||
capacity: 1
|
||||
labels:
|
||||
- "ci-runner:docker://catthehacker/ubuntu:act-22.04"
|
||||
fetch_interval: 5s
|
||||
fetch_timeout: 60s
|
||||
|
||||
container:
|
||||
# host network so the job container can reach Gitea at 161.33.139.73:3000
|
||||
network: host
|
||||
# 2 GB RAM available on CI runner — builds need up to 1.5 GB
|
||||
options: "--memory 1536m --cpus 1.5"
|
||||
valid_volumes:
|
||||
- "**"
|
||||
CONFIG
|
||||
|
||||
echo "=== Registering runner with Gitea ==="
|
||||
cd "$INSTALL_DIR"
|
||||
sudo ./act_runner register \
|
||||
--instance "$GITEA_URL" \
|
||||
--token "$RUNNER_TOKEN" \
|
||||
--name "$RUNNER_NAME" \
|
||||
--no-interactive
|
||||
|
||||
echo "=== Installing systemd service ==="
|
||||
sudo tee /etc/systemd/system/act-runner.service > /dev/null <<'SERVICE'
|
||||
[Unit]
|
||||
Description=Gitea act_runner (CI builds)
|
||||
After=docker.service
|
||||
Requires=docker.service
|
||||
|
||||
[Service]
|
||||
User=ubuntu
|
||||
Group=docker
|
||||
WorkingDirectory=/opt/act-runner
|
||||
ExecStart=/opt/act-runner/act_runner daemon --config /opt/act-runner/config.yaml
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
SERVICE
|
||||
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable act-runner
|
||||
sudo systemctl start act-runner
|
||||
|
||||
echo ""
|
||||
echo "=== CI runner setup complete ==="
|
||||
echo "Check status: sudo systemctl status act-runner"
|
||||
echo "View logs: sudo journalctl -u act-runner -f"
|
||||
echo "Verify in Gitea: $GITEA_URL/-/admin/runners"
|
||||
Reference in New Issue
Block a user