feat(plan-01): Phase 4a — make harness location-independent (facade-free capable)

Resolve every root by marker walk-up instead of a fixed depth that only lands on the app via the .specify compat symlink, so the harness runs correctly when invoked by its real packages/casan-harness path — proven by a full gate run via that path: 64/0/0. - 95 scripts/tests: PROJECT_ROOT/ROOT "$SCRIPT_DIR/../.."-style computations -> $CASAN_APP_ROOT. - 6 leaf scripts (infra-lab, context-validate, secrets-scan, path-guard, toolchain-verify, phase2-sourcegen) now source casan-paths + use CASAN_APP_ROOT. - run-casan4: source casan-paths as a package sibling (facade-independent), PROJECT_ROOT=CASAN_APP_ROOT. - 8 Python files: project_root()/REPO_ROOT/bundle_root walk UP for the .specify marker (control-plane-settings, loop_common, model-call, context-compress, test-integrity, bundle-integrity, traceability-matrix; generate-* fixed earlier). - evidence-pack-build.py + traceability-matrix.py: domain refs -> apps/okr/domain (input/, corpus/redteam-vectors.jsonl, traceability-map.json). - ci-harness-gate.sh: export CASAN_TESTS_DIR/CASAN_TEST_MANIFEST/CASAN_BUNDLE_ROOT so the integrity Python resolves via the harness root regardless of invocation path; ROOT=CASAN_APP_ROOT. - Remove the domain compat symlinks from packages/casan-harness/security (redteam-corpus, redteam-vectors, benign-corpus) — packages now holds NO domain data. Both invocation paths pass (compat facade still present): .specify/... and packages/... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-08 10:50:50 +09:00
parent f2ea5590b1
commit 3adc48ed82
114 changed files with 198 additions and 119 deletions
@@ -24,7 +24,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 LOG="$CASAN_STATE_ROOT/logs/level5/action-gate.jsonl"
 mkdir -p "$(dirname "$LOG")"
 # shellcheck source=casan-log.sh
@@ -22,7 +22,7 @@ fi

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 LOG_DIR="$CASAN_STATE_ROOT/logs"
 TRACE_DIR="$LOG_DIR/trace"
 # SEC-23 (MT-01): telemetry dir is tenant-scoped when CASAN_METRICS_DIR is set
@@ -22,7 +22,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 AGENTOPS_DIR="${CASAN_AGENTOPS_DIR:-$CASAN_HARNESS_ROOT/agentops}"
 STATE="$AGENTOPS_DIR/alert-dispatch-state.jsonl"
 DEADLETTER="$AGENTOPS_DIR/alert-deadletter.jsonl"
@@ -29,7 +29,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 GOV_DIR="$CASAN_GOVERNANCE_ROOT"
 REVIEWERS_FILE="${CASAN_REVIEWERS_FILE:-$GOV_DIR/reviewers.registry}"
 REVIEWERS_DIR="${CASAN_REVIEWERS_DIR:-$GOV_DIR/reviewers}"
@@ -12,7 +12,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 HEAD_FILE="${1:-$CASAN_STATE_ROOT/logs/audit/audit-head.txt}"
 LEDGER="${2:-${CASAN_WORM_LEDGER:-$CASAN_STATE_ROOT/logs/worm/anchor-ledger.jsonl}}"
 mkdir -p "$(dirname "$LEDGER")"
@@ -21,7 +21,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 SEC_DIR="$CASAN_HARNESS_ROOT/security"
 CORPUS_DIR="$CASAN_DOMAIN_ROOT/corpus/benign-corpus"
 VECTORS="$CASAN_DOMAIN_ROOT/corpus/redteam-vectors.jsonl"
@@ -23,6 +23,19 @@ import glob
 import hashlib
 import json
 import os
+
+
+def _casan_app_root():
+    # Plan-01: walk UP for the `.specify` state marker (harness code lives in
+    # packages/casan-harness/, so a fixed __file__ depth would mis-root).
+    _d = os.path.abspath(os.path.dirname(__file__))
+    _p = _d
+    while _p != os.path.dirname(_p):
+        if os.path.isdir(os.path.join(_p, ".specify")):
+            return _p
+        _p = os.path.dirname(_p)
+    return os.path.abspath(os.path.join(_d, "..", "..", ".."))
+
 import shutil
 import subprocess
 import sys
@@ -48,7 +61,7 @@ EXCLUDE_SUBSTR = ["/logs/", "/output/", "bundle-integrity", "test-integrity"]

 def bundle_root() -> str:
    return os.environ.get("CASAN_BUNDLE_ROOT") or os.path.join(
-        os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "..")), ".specify")
+        _casan_app_root(), ".specify")


 def manifest_path() -> str:
@@ -23,7 +23,7 @@ fi

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 # SEC-23 (MT-01): make state (control-plane settings, telemetry, audit) tenant-scoped
 # when CASAN_TENANT_ID is set, so a run for tenant A never touches tenant B's state.
 # No-op when no tenant is set (baseline unchanged); invalid tenant fails closed.
@@ -13,9 +13,17 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+ROOT="$CASAN_APP_ROOT"
 TESTS="$CASAN_HARNESS_ROOT/tests"

+# Plan-01: the integrity Python self-locates via __file__ and would mis-root when the
+# package is invoked by its real path (no .specify facade). Export the harness-relative
+# locations so test-integrity.py / bundle-integrity.py resolve correctly whether the gate
+# is reached via .specify/... (compat symlink) or packages/casan-harness/... directly.
+export CASAN_TESTS_DIR="$CASAN_HARNESS_ROOT/tests"
+export CASAN_TEST_MANIFEST="$CASAN_HARNESS_ROOT/tests/test-integrity-manifest.json"
+export CASAN_BUNDLE_ROOT="$CASAN_HARNESS_ROOT"
+
 PASS=0
 FAIL=0
 SKIP=0
@@ -23,7 +23,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+ROOT="$CASAN_APP_ROOT"
 PROVIDER_LOG="${CASAN_PROVIDER_LOG:-$CASAN_STATE_ROOT/logs/level5/provider-usage.jsonl}"
 CIRCUIT_BREAKER_THRESHOLD="${CIRCUIT_BREAKER_THRESHOLD:-5}"
 CIRCUIT_WINDOW="${CIRCUIT_WINDOW:-10}"
@@ -19,6 +19,19 @@ model, so it cannot be used as a path to evade H4.
 import argparse
 import json
 import os
+
+
+def _casan_app_root():
+    # Plan-01: walk UP for the `.specify` state marker (harness code lives in
+    # packages/casan-harness/, so a fixed __file__ depth would mis-root).
+    _d = os.path.abspath(os.path.dirname(__file__))
+    _p = _d
+    while _p != os.path.dirname(_p):
+        if os.path.isdir(os.path.join(_p, ".specify")):
+            return _p
+        _p = os.path.dirname(_p)
+    return os.path.abspath(os.path.join(_d, "..", "..", ".."))
+
 import re
 import sys

@@ -30,7 +43,7 @@ def compression_enabled() -> bool:
    store_file = os.environ.get(
        "CASAN_CP_STORE_FILE",
        os.path.join(
-            os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "..")),
+            _casan_app_root(),
            ".specify/level5/control-plane-settings.json",
        ),
    )
@@ -19,7 +19,8 @@ fi
 CTX_DIR="$(cd "$(dirname "$CTX")" && pwd)"
 # Resolve paths relative to the repo root (3 levels up from this script).
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+source "$SCRIPT_DIR/casan-paths.sh"
+PROJECT_ROOT="$CASAN_APP_ROOT"

 python - "$CTX" "$PROJECT_ROOT" "${CASAN_CONTEXT_TTL_SECONDS:-0}" <<'PY'
 import os, re, sys, subprocess
@@ -51,7 +51,13 @@ GENESIS_HASH = "0" * 64


 def project_root() -> str:
-    return os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", ".."))
+    d = os.path.abspath(os.path.dirname(__file__))
+    p = d
+    while p != os.path.dirname(p):
+        if os.path.isdir(os.path.join(p, ".specify")):
+            return p
+        p = os.path.dirname(p)
+    return os.path.abspath(os.path.join(d, "..", "..", ".."))


 def _tenant_id():
@@ -20,7 +20,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 # SEC-23 (MT-03): per-tenant cost/quota. With no explicit log arg, a tenant run
 # evaluates its OWN usage log so one tenant's spend never counts against another's
 # budget (noisy-neighbor isolation). No tenant set -> the shared default log.
@@ -18,7 +18,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 AGENTOPS_DIR="${CASAN_AGENTOPS_DIR:-$CASAN_HARNESS_ROOT/agentops}"
 PID_FILE="$AGENTOPS_DIR/dashboard.pid"
 PORT_FILE="$AGENTOPS_DIR/dashboard.port"
@@ -16,7 +16,7 @@ fi

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 mkdir -p "$(dirname "$REPORT")" "$CASAN_STATE_ROOT/logs/level5"

 python - "$GOLDEN" "$CANDIDATE" "$REPORT" <<'PY'
@@ -85,9 +85,9 @@ def main():
                sys.executable,
                traceability_script,
                "--requirements",
-                os.path.join(root, "docs/input/okr-requirement.md"),
+                os.path.join(root, "apps/okr/domain/input/okr-requirement.md"),
                "--map",
-                os.path.join(root, ".specify/traceability-map.json"),
+                os.path.join(root, "apps/okr/domain/traceability-map.json"),
                "--out",
                traceability_out,
                "--gate",
@@ -145,7 +145,7 @@ def main():
            fp = json.load(open(fp_json, encoding="utf-8"))
        except ValueError:
            fp = None
-    vectors_path = os.path.join(root, ".specify/security/redteam-vectors.jsonl")
+    vectors_path = os.path.join(root, "apps/okr/domain/corpus/redteam-vectors.jsonl")
    vectors = read_jsonl(vectors_path)
    reports["redteam-result.json"] = {
        "run_id": run_id, "vectors_defined": len(vectors),
@@ -22,7 +22,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 # shellcheck source=casan-log.sh
 source "$SCRIPT_DIR/casan-log.sh"

@@ -19,7 +19,7 @@ fi

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 LOG_DIR="$CASAN_STATE_ROOT/logs"
 TRACE_DIR="$LOG_DIR/trace"
 AUDIT_DIR="$LOG_DIR/audit"
@@ -13,7 +13,7 @@ fi

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 LOG_DIR="$CASAN_STATE_ROOT/logs/level5"
 OUT="$LOG_DIR/provider-usage.jsonl"
 mkdir -p "$LOG_DIR"
@@ -16,7 +16,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 SEC_DIR="$CASAN_HARNESS_ROOT/security"
 LOG="$CASAN_STATE_ROOT/logs/level5/incidents.jsonl"
 RUNBOOK="$SEC_DIR/incident-runbook.md"
@@ -7,7 +7,8 @@ set -uo pipefail
 #   infra-lab.sh start|stop|status|verify|env

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+source "$SCRIPT_DIR/casan-paths.sh"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 COMPOSE="$PROJECT_ROOT/infra/local-prod/docker-compose.yml"
 CMD="${1:-status}"

@@ -18,7 +18,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 KS_DIR="${CASAN_KILLSWITCH_DIR:-$CASAN_STATE_ROOT/logs/level5/kill-switch}"
 mkdir -p "$KS_DIR"

@@ -58,7 +58,13 @@ class PolicyError(Exception):


 def project_root() -> str:
-    return os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", ".."))
+    d = os.path.abspath(os.path.dirname(__file__))
+    p = d
+    while p != os.path.dirname(p):
+        if os.path.isdir(os.path.join(p, ".specify")):
+            return p
+        p = os.path.dirname(p)
+    return os.path.abspath(os.path.join(d, "..", "..", ".."))


 def now_iso() -> str:
@@ -23,6 +23,19 @@ Usage:
 import argparse
 import json
 import os
+
+
+def _casan_app_root():
+    # Plan-01: walk UP for the `.specify` state marker (harness code lives in
+    # packages/casan-harness/, so a fixed __file__ depth would mis-root).
+    _d = os.path.abspath(os.path.dirname(__file__))
+    _p = _d
+    while _p != os.path.dirname(_p):
+        if os.path.isdir(os.path.join(_p, ".specify")):
+            return _p
+        _p = os.path.dirname(_p)
+    return os.path.abspath(os.path.join(_d, "..", "..", ".."))
+
 import subprocess
 import sys
 import time
@@ -31,7 +44,7 @@ from datetime import datetime, timezone

 OLLAMA_HOST = "127.0.0.1:11434"          # the only allowed ollama endpoint
 ALLOWED_CLOUD = {"api.anthropic.com", "api.openai.com"}
-REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", ".."))
+REPO_ROOT = _casan_app_root()
 PROVIDER_LOG = os.path.join(REPO_ROOT, ".specify/logs/level5/provider-usage.jsonl")

 # SEC-21 (ARCH-07): a 180s-per-call timeout across many pipeline steps let a hung
@@ -22,7 +22,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 PIN_FILE="${CASAN_MODEL_DIGEST_PIN:-$CASAN_HARNESS_ROOT/security/model-digest.pin}"
 mkdir -p "$(dirname "$PIN_FILE")"
 CMD="${1:-verify}"
@@ -35,7 +35,7 @@ fi

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 LOG_DIR="$CASAN_STATE_ROOT/logs/level5"
 mkdir -p "$LOG_DIR" "$(dirname "$OUTPUT_FILE")"
 FALLBACK_LOG="$LOG_DIR/fallback.jsonl"
@@ -12,7 +12,8 @@ set -uo pipefail
 # Exit:   0 inside the root, 1 outside / unresolvable.

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+source "$SCRIPT_DIR/casan-paths.sh"
+PROJECT_ROOT="$CASAN_APP_ROOT"

 TARGET="${1:-}"
 ROOT="${2:-$PROJECT_ROOT}"
@@ -21,7 +21,7 @@ fi

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 OUT="${2:-$CASAN_STATE_ROOT/logs/level5/provider-usage.jsonl}"
 mkdir -p "$(dirname "$OUT")"

@@ -13,7 +13,7 @@ ROLLBACK_COMMAND="${3:-}"

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 LOG_DIR="$CASAN_STATE_ROOT/logs/level5"
 BACKUP_DIR="$LOG_DIR/rollback-backups"
 TX_LOG="$LOG_DIR/rollback-transactions.jsonl"
@@ -15,7 +15,8 @@ set -uo pipefail
 # Exit: 0 all checks pass, 1 violation found, 2 scan error.

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+source "$SCRIPT_DIR/casan-paths.sh"
+ROOT="$CASAN_APP_ROOT"
 PASS=0; FAIL=0; WARN=0

 ok()   { echo "  PASS  $1"; PASS=$((PASS+1)); }
@@ -19,7 +19,7 @@ fi

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 LOG_DIR="$CASAN_STATE_ROOT/logs"
 TRACE_DIR="$LOG_DIR/trace"
 AUDIT_DIR="$LOG_DIR/audit"
@@ -8,7 +8,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+ROOT="$CASAN_APP_ROOT"
 PASS=0; FAIL=0; SKIP=0
 run() {  # <name> <command...>
  local name="$1"; shift
@@ -22,7 +22,7 @@ set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"

 AUDIT_LOG="${1:-$CASAN_STATE_ROOT/logs/audit/audit.jsonl}"
 AUDIT_DIR="$(dirname "$AUDIT_LOG")"
@@ -9,7 +9,7 @@ set -euo pipefail
 MODE="${1:-}"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 GOV_DIR="$CASAN_GOVERNANCE_ROOT"
 BUNDLE="$GOV_DIR/policy-bundle.yaml"
 MANIFEST="$GOV_DIR/policy-manifest.json"
@@ -21,7 +21,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 SEC_DIR="$CASAN_HARNESS_ROOT/security"
 # shellcheck source=casan-log.sh
 source "$SCRIPT_DIR/casan-log.sh"
@@ -25,7 +25,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 L5_DIR="$CASAN_STATE_ROOT/logs/level5"
 COST_DIR="$CASAN_STATE_ROOT/logs/cost"
 mkdir -p "$L5_DIR"
@@ -24,7 +24,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 STATE_ROOT="${CASAN_TENANT_STATE_ROOT:-$CASAN_STATE_ROOT/state/tenants}"

 die() { echo "TENANT_DENIED reason=$1" >&2; exit 3; }
@@ -36,7 +36,13 @@ CHECK_RE = re.compile(r'(?:(?<![\w])pass\s+")|(?:\bexpect_rc\s)')


 def project_root() -> str:
-    return os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", ".."))
+    d = os.path.abspath(os.path.dirname(__file__))
+    p = d
+    while p != os.path.dirname(p):
+        if os.path.isdir(os.path.join(p, ".specify")):
+            return p
+        p = os.path.dirname(p)
+    return os.path.abspath(os.path.join(d, "..", "..", ".."))


 def tests_dir() -> str:
@@ -13,7 +13,7 @@ fi

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 REGISTRY="$CASAN_HARNESS_ROOT/level5/tool-registry.yaml"
 LOG_DIR="$CASAN_STATE_ROOT/logs/level5"
 AUDIT_DIR="$CASAN_STATE_ROOT/logs/audit"
@@ -16,7 +16,8 @@ set -uo pipefail
 # Exit:   0 ok, 1 missing/shadowed/untrusted.

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+source "$SCRIPT_DIR/casan-paths.sh"
+PROJECT_ROOT="$CASAN_APP_ROOT"

 REQUIRED=("$@")
 if [[ ${#REQUIRED[@]} -eq 0 ]]; then
@@ -16,7 +16,16 @@ FR_RE = re.compile(r"\|\s*(FR-\d+)\s*\|\s*([^|]+?)\s*\|")


 def project_root() -> str:
-    return os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", ".."))
+    # Plan-01: harness code lives in packages/casan-harness/; a fixed __file__ parent
+    # depth lands on the package, not the app. Walk UP for the `.specify` state marker
+    # so this resolves the app root whether invoked via packages/... or the .specify facade.
+    d = os.path.abspath(os.path.dirname(__file__))
+    p = d
+    while p != os.path.dirname(p):
+        if os.path.isdir(os.path.join(p, ".specify")):
+            return p
+        p = os.path.dirname(p)
+    return os.path.abspath(os.path.join(d, "..", "..", ".."))


 def parse_requirements(path: str):
@@ -102,8 +111,8 @@ def resolve_files(root: str, values):
 def main() -> int:
    root = project_root()
    ap = argparse.ArgumentParser()
-    ap.add_argument("--requirements", default=os.path.join(root, "docs/input/okr-requirement.md"))
-    ap.add_argument("--map", default=os.path.join(root, ".specify/traceability-map.json"))
+    ap.add_argument("--requirements", default=os.path.join(root, "apps/okr/domain/input/okr-requirement.md"))
+    ap.add_argument("--map", default=os.path.join(root, "apps/okr/domain/traceability-map.json"))
    ap.add_argument("--out", default=os.path.join(root, "docs/output/casan/traceability-matrix.json"))
    ap.add_argument("--gate", action="store_true")
    args = ap.parse_args()
@@ -7,7 +7,7 @@ set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 AUDIT_LOG="${1:-$CASAN_STATE_ROOT/logs/audit/audit.jsonl}"

 if [[ ! -f "$AUDIT_LOG" ]]; then
@@ -12,7 +12,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 HEAD_FILE="${1:-$CASAN_STATE_ROOT/logs/audit/audit-head.txt}"
 LEDGER="${2:-${CASAN_WORM_LEDGER:-$CASAN_STATE_ROOT/logs/worm/anchor-ledger.jsonl}}"

@@ -5,7 +5,7 @@ set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 REGISTRY="$CASAN_HARNESS_ROOT/level5/project-registry.json"
 PACKAGE="$CASAN_HARNESS_ROOT/level5/harness-package.json"

@@ -9,7 +9,7 @@ set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 LOG="${1:-$CASAN_STATE_ROOT/logs/audit/tool-calls.jsonl}"

 if [[ ! -f "$LOG" ]]; then
@@ -1 +0,0 @@
-../../../apps/okr/domain/corpus/benign-corpus
@@ -1 +0,0 @@
-../../../apps/okr/domain/corpus/redteam-corpus.jsonl
@@ -1 +0,0 @@
-../../../apps/okr/domain/corpus/redteam-vectors.jsonl
@@ -15,7 +15,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 SCRIPTS="$CASAN_HARNESS_ROOT/scripts/bash"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
@@ -10,7 +10,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 S="$CASAN_HARNESS_ROOT/scripts/bash"
 SB="$S/sandbox-container.sh"
 WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
@@ -9,7 +9,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 S="$CASAN_HARNESS_ROOT/scripts/bash"
 WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
 export CASAN_KILLSWITCH_DIR="$WORK/ks"      # isolate the kill-switch state
@@ -7,7 +7,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 CP="$CASAN_HARNESS_ROOT/scripts/bash/control-plane-settings.py"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
@@ -8,7 +8,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 GR="$CASAN_HARNESS_ROOT/scripts/bash/governance-report.py"
 CPS="$CASAN_HARNESS_ROOT/scripts/bash/control-plane-settings.py"
 WORK="$(mktemp -d)"
@@ -11,7 +11,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 SC="$CASAN_HARNESS_ROOT/scripts/bash/security-check.sh"
 CORPUS="$CASAN_DOMAIN_ROOT/corpus/benign-corpus"
 WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
@@ -11,7 +11,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 S="$CASAN_HARNESS_ROOT/scripts/bash"
 SC="$S/security-check.sh"
 CORPUS="$CASAN_DOMAIN_ROOT/corpus/benign-corpus"
@@ -13,7 +13,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 S="$CASAN_HARNESS_ROOT/scripts/bash"
 REG="$CASAN_GOVERNANCE_ROOT/reviewers.registry"
 WORK="$(mktemp -d)"; RV="$WORK/reviewers"; mkdir -p "$RV"
@@ -11,7 +11,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 S="$CASAN_HARNESS_ROOT/scripts/bash"
 WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
 PASS=0; FAIL=0
@@ -10,7 +10,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 S="$CASAN_HARNESS_ROOT/scripts/bash"
 WORK="$(mktemp -d)"
 SINK_PID=""; API_PID=""
@@ -17,7 +17,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 CONV="$CASAN_HARNESS_ROOT/scripts/bash/loop-convergence.py"
 POLICY="$CASAN_HARNESS_ROOT/config/loop-policy.yaml"

@@ -19,7 +19,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 GATE="$CASAN_HARNESS_ROOT/scripts/bash/loop-gate.py"

 WORK="$(mktemp -d)"
@@ -17,7 +17,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 GOV="$CASAN_HARNESS_ROOT/scripts/bash/loop-governor.py"
 POLICY="$CASAN_HARNESS_ROOT/config/loop-policy.yaml"

@@ -18,7 +18,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 BIN="$CASAN_HARNESS_ROOT/scripts/bash"
 META="$BIN/loop-metaloop.py"
 GOV="$BIN/loop-governor.py"
@@ -18,7 +18,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 BIN="$CASAN_HARNESS_ROOT/scripts/bash"
 RUN="$BIN/loop-run.sh"
 TRACE="$BIN/loop-trace.py"
@@ -17,7 +17,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 TRACE="$CASAN_HARNESS_ROOT/scripts/bash/loop-trace.py"

 WORK="$(mktemp -d)"
@@ -7,7 +7,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 S="$CASAN_HARNESS_ROOT/scripts/bash"
 PF="$S/harness-preflight.sh"
 ROUTER="$S/model-router.sh"
@@ -6,7 +6,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 S="$CASAN_HARNESS_ROOT/scripts/bash"

 PASS=0; FAIL=0; SKIP=0
@@ -7,7 +7,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 RAI="$CASAN_HARNESS_ROOT/scripts/bash/rai-guard.py"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
@@ -15,7 +15,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 RBAC="$CASAN_HARNESS_ROOT/scripts/bash/rbac-check.py"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
@@ -7,7 +7,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 RBAC="$CASAN_HARNESS_ROOT/scripts/bash/rbac-check.py"

 PASS=0; FAIL=0
@@ -13,7 +13,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 BASH_DIR="$CASAN_HARNESS_ROOT/scripts/bash"
 WORK="$(mktemp -d)"

@@ -16,7 +16,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 BASH_DIR="$CASAN_HARNESS_ROOT/scripts/bash"
 WORK="$(mktemp -d)"

@@ -15,7 +15,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 RM="$CASAN_HARNESS_ROOT/scripts/bash/rollback-manager.sh"
 TX_LOG="$CASAN_STATE_ROOT/logs/level5/rollback-transactions.jsonl"
 WORK="$(mktemp -d)"
@@ -12,7 +12,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 GATE="$CASAN_HARNESS_ROOT/scripts/bash/action-gate.sh"
 WORK="$(mktemp -d)"

@@ -13,7 +13,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 BASH_DIR="$CASAN_HARNESS_ROOT/scripts/bash"
 AUDIT="$CASAN_STATE_ROOT/logs/audit/audit.jsonl"
 WORK="$(mktemp -d)"
@@ -16,7 +16,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 CP="$CASAN_HARNESS_ROOT/scripts/bash/control-plane-settings.py"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
@@ -14,7 +14,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 S="$CASAN_HARNESS_ROOT/scripts/bash"
 REG="$CASAN_GOVERNANCE_ROOT/reviewers.registry"
 WORK="$(mktemp -d)"; RV="$WORK/reviewers"; mkdir -p "$RV"
@@ -12,7 +12,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 PM="$CASAN_HARNESS_ROOT/scripts/bash/pii-mask.py"
 RULES="$CASAN_HARNESS_ROOT/security/pii-rules.yaml"
 WORK="$(mktemp -d)"
@@ -13,7 +13,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 BASH_DIR="$CASAN_HARNESS_ROOT/scripts/bash"
 WORK="$(mktemp -d)"
 # security-check / drift-detect touch shared logs; restore on exit.
@@ -16,7 +16,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 S="$CASAN_HARNESS_ROOT/scripts/bash"
 GATE="$S/tool-registry-gate.sh"
 WORK="$(mktemp -d)"
@@ -13,7 +13,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 DD="$CASAN_HARNESS_ROOT/scripts/bash/drift-detect.sh"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
@@ -14,7 +14,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 S="$CASAN_HARNESS_ROOT/scripts/bash"
 FETCH="$S/provider-usage-fetch.sh"
 WORK="$(mktemp -d)"
@@ -18,7 +18,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 MDC="$CASAN_HARNESS_ROOT/scripts/bash/model-digest-check.sh"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
@@ -11,7 +11,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 S="$CASAN_HARNESS_ROOT/scripts/bash"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
@@ -17,7 +17,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 BASH_DIR="$CASAN_HARNESS_ROOT/scripts/bash"
 BI="$BASH_DIR/bundle-integrity.py"
 WORK="$(mktemp -d)"
@@ -16,7 +16,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 BASH_DIR="$CASAN_HARNESS_ROOT/scripts/bash"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
@@ -15,7 +15,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 TI="$CASAN_HARNESS_ROOT/scripts/bash/test-integrity.py"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
@@ -13,7 +13,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 CP="$CASAN_HARNESS_ROOT/scripts/bash/control-plane-settings.py"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
@@ -15,7 +15,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 BASH_DIR="$CASAN_HARNESS_ROOT/scripts/bash"
 TV="$BASH_DIR/toolchain-verify.sh"
 WORK="$(mktemp -d)"
@@ -13,7 +13,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 MC="$CASAN_HARNESS_ROOT/scripts/bash/model-call.py"
 WORK="$(mktemp -d)"
 trap 'git -C "$PROJECT_ROOT" checkout -- .specify/logs/level5/provider-usage.jsonl 2>/dev/null; rm -rf "$WORK"' EXIT
@@ -19,7 +19,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 S="$CASAN_HARNESS_ROOT/scripts/bash"
 AV="$S/approval-verify.sh"
 WORK="$(mktemp -d)"
@@ -17,7 +17,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 S="$CASAN_HARNESS_ROOT/scripts/bash"
 RBAC="$S/rbac-check.py"
 HARNESS="$S/casan-harness.sh"
@@ -11,7 +11,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 S="$CASAN_HARNESS_ROOT/scripts/bash"
 RV="$S/tenant-registry-verify.sh"
 TC="$S/tenant-crypt.sh"
@@ -14,7 +14,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 S="$CASAN_HARNESS_ROOT/scripts/bash"
 HARNESS="$S/casan-harness.sh"
 KS="$S/kill-switch.sh"
@@ -17,7 +17,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 S="$CASAN_HARNESS_ROOT/scripts/bash"
 CPS="$S/control-plane-settings.py"
 TS="$S/tenant-store.sh"
@@ -16,7 +16,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 TS="$CASAN_HARNESS_ROOT/scripts/bash/tenant-store.sh"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
@@ -13,7 +13,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 SCI="$CASAN_HARNESS_ROOT/scripts/bash/supply-chain-integrity.sh"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
@@ -13,7 +13,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 AA="$CASAN_HARNESS_ROOT/scripts/bash/artifact-attest.sh"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
@@ -16,7 +16,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"
 SCS="$CASAN_HARNESS_ROOT/scripts/bash/stored-content-scan.sh"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
@@ -12,7 +12,7 @@ set -uo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROJECT_ROOT="$CASAN_APP_ROOT"

 PASS=0; FAIL=0
 pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`../../../apps/okr/domain/corpus/benign-corpus`
				`@@ -1 +0,0 @@`
				`../../../apps/okr/domain/corpus/redteam-corpus.jsonl`