refactor(structure): promote app to repo root + remove redundant workspace cruft

Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.

- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
  .specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
  active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
  launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
  tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
  README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
  artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
  - .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
    working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
    -> packages/casan-harness/... (.specify/logs state kept)
  - .claude/launch.json, .gitea/*-runbook.md: path prefixes
  - CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
  - policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.

Full gate from the new root: PASS=64 FAIL=0 SKIP=3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/launch.json

@@ -1,4 +1,4 @@
 { "version":"0.0.1","configurations":[
   { "name":"casan-dash","runtimeExecutable":"python3",
-    "runtimeArgs":["-m","http.server","8100","--directory","/Users/thanhnguyen/Documents/AI/HarnessHkt/Harness_Hakathon/Output_CASAN5_REFINED/AINative_OKR_CASAN5/docs/output/casan"],
+    "runtimeArgs":["-m","http.server","8100","--directory","/Users/thanhnguyen/Documents/AI/HarnessHkt/Harness_Hakathon/Output_CASAN5_REFINED/docs/output/casan"],
     "port":8100 } ] }

.gitea/vault-setup-runbook.md

@@ -148,7 +148,7 @@ From macOS with the project checked out:
 export VAULT_ADDR=http://161.33.139.73:8200
 export VAULT_TOKEN=<TOKEN>
 
-cd Output_CASAN5_REFINED/AINative_OKR_CASAN5
+cd Output_CASAN5_REFINED  # repo root (app promoted from AINative_OKR_CASAN5/)
 
 # Test sign-policy-bundle with Vault
 bash packages/casan-harness/scripts/bash/sign-policy-bundle.sh sign

.gitea/vps-setup-runbook.md

@@ -49,7 +49,7 @@ You should see "Runners" menu item (confirming Actions is enabled).
 
 From your local machine:
 ```bash
-scp AINative_OKR_CASAN5/.gitea/act-runner-config.yaml \
+scp .gitea/act-runner-config.yaml \
     ubuntu@161.33.139.73:/opt/gitea/act-runner-config.yaml
 ```
 
@@ -162,7 +162,7 @@ On the VPS (or via Gitea web UI), create a new repository:
 
 On your local machine:
 ```bash
-cd Output_CASAN5_REFINED/AINative_OKR_CASAN5
+cd Output_CASAN5_REFINED  # repo root (app promoted from AINative_OKR_CASAN5/)
 
 # Add Gitea as remote
 git remote add gitea ssh://git@161.33.139.73:2222/<YOUR_USER>/casan5.git

.gitea/workflows/ci.yml

@@ -10,9 +10,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-# All run steps execute inside AINative_OKR_CASAN5/ (the app directory).
+# All run steps execute inside  (the app directory).
 # actions/* steps still reference $GITHUB_WORKSPACE root, so paths in `with:` blocks
-# must include AINative_OKR_CASAN5/ prefix.
+# must include  prefix.
 
 jobs:
   # ──────────────────────────────────────────────────────────────────────────
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     defaults:
       run:
-        working-directory: AINative_OKR_CASAN5
+        working-directory: .
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -34,7 +34,7 @@ jobs:
         with:
           node-version: "20"
           cache: "npm"
-          cache-dependency-path: AINative_OKR_CASAN5/package-lock.json
+          cache-dependency-path: package-lock.json
 
       - name: Install frontend dependencies
         run: npm ci -w frontend
@@ -53,7 +53,7 @@ jobs:
     needs: [frontend-tests]
     defaults:
       run:
-        working-directory: AINative_OKR_CASAN5
+        working-directory: .
     env:
       VAULT_ADDR: "http://vault:8200"
       VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
@@ -67,7 +67,7 @@ jobs:
         with:
           node-version: "20"
           cache: "npm"
-          cache-dependency-path: AINative_OKR_CASAN5/package-lock.json
+          cache-dependency-path: package-lock.json
 
       - name: Install test tools
         run: |
@@ -82,31 +82,31 @@ jobs:
       - name: Vault KMS — enable transit + pre-create keys
         run: |
           if curl -sf "$VAULT_ADDR/v1/sys/health" >/dev/null 2>&1; then
-            bash .specify/scripts/bash/vault-kms.sh enable-transit
+            bash packages/casan-harness/scripts/bash/vault-kms.sh enable-transit
-            bash .specify/scripts/bash/vault-kms.sh ensure-key casan-policy-key
+            bash packages/casan-harness/scripts/bash/vault-kms.sh ensure-key casan-policy-key
-            bash .specify/scripts/bash/vault-kms.sh ensure-key casan-audit-key
+            bash packages/casan-harness/scripts/bash/vault-kms.sh ensure-key casan-audit-key
             echo "VAULT_KMS_READY"
           else
             echo "VAULT_KMS_SKIP (unreachable — will use local-file fallback)"
           fi
 
       - name: Run CASAN4 harness tests (35 tests)
-        run: bash .specify/tests/run-casan4-harness-tests.sh
+        run: bash packages/casan-harness/tests/run-casan4-harness-tests.sh
 
       - name: Run adversarial harness tests (44 tests)
-        run: bash .specify/tests/adversarial-harness-tests.sh
+        run: bash packages/casan-harness/tests/adversarial-harness-tests.sh
 
       - name: Sign audit chain head via Vault KMS (H5)
-        run: bash .specify/scripts/bash/sign-audit-head.sh
+        run: bash packages/casan-harness/scripts/bash/sign-audit-head.sh
 
       - name: Sign policy bundle via Vault KMS (H5)
-        run: bash .specify/scripts/bash/sign-policy-bundle.sh sign
+        run: bash packages/casan-harness/scripts/bash/sign-policy-bundle.sh sign
 
       - name: Verify audit chain (anchor=signed expected in CI)
-        run: bash .specify/scripts/bash/verify-audit-chain.sh
+        run: bash packages/casan-harness/scripts/bash/verify-audit-chain.sh
 
       - name: Security gate — aggregate verdict (PASS=11 FAIL=0 SKIP=0)
-        run: bash .specify/scripts/bash/security-gate.sh
+        run: bash packages/casan-harness/scripts/bash/security-gate.sh
 
       - name: Upload test evidence
         if: always()
@@ -114,8 +114,8 @@ jobs:
         with:
           name: casan-evidence-${{ github.run_number }}
           path: |
-            AINative_OKR_CASAN5/docs/output/casan/evidence/harness-test-report.md
+            docs/output/casan/evidence/harness-test-report.md
-            AINative_OKR_CASAN5/docs/output/casan/evidence/
+            docs/output/casan/evidence/
           retention-days: 14
 
   # ──────────────────────────────────────────────────────────────────────────
@@ -141,7 +141,7 @@ jobs:
   #
   # One-time CI runner setup:
   #   ssh ubuntu@161.33.149.243
-  #   RUNNER_TOKEN=<from Gitea admin> bash AINative_OKR_CASAN5/scripts/setup-ci-runner.sh
+  #   RUNNER_TOKEN=<from Gitea admin> bash scripts/setup-ci-runner.sh
   # ──────────────────────────────────────────────────────────────────────────
   deploy-okr:
     name: "Build & Deploy OKR → /opt/webapps/okr"
@@ -150,7 +150,7 @@ jobs:
     if: github.ref == 'refs/heads/main' && github.event_name == 'push'
     defaults:
       run:
-        working-directory: AINative_OKR_CASAN5
+        working-directory: .
     env:
       JWT_SECRET: ${{ secrets.JWT_SECRET }}
       WEB_VPS: "ubuntu@161.33.139.73"

.gitea/workflows/harness-ci.yml

@@ -29,9 +29,9 @@ jobs:
           npm --version
 
       - name: Install npm dependencies
-        working-directory: AINative_OKR_CASAN5
+        working-directory: .
         run: npm ci
 
       - name: Run CASAN harness gate
-        working-directory: AINative_OKR_CASAN5
+        working-directory: .
         run: bash packages/casan-harness/scripts/bash/ci-harness-gate.sh