feat(plan-01): Phase 1 — relocate harness code to packages/casan-harness (symlink facade)

Physically move the pure-code subtrees out of .specify into the package, leaving compat symlinks at the old .specify/<dir> paths so every existing reference (internal CASAN_HARNESS_ROOT + external CI/docker/mjs) keeps resolving. Runtime state stays put. Moved (git mv): scripts/ tests/ security/ templates/ config/ governance/ memory/ .specify/<dir> -> packages/casan-harness/<dir> (+ .specify/<dir> symlink) Stays in .specify (state/governance/domain, handled later): logs/ agentops/ level5/ init-options.json traceability-map.json Python `.resolve()` self-location followed the compat symlink into packages and lost the app root; generate-casan-demo-context.py, generate-agentops-dashboard.py and dashboard-server.py now walk UP for the `.specify` state marker instead of a fixed parent depth (fixes "missing trace files" in run-casan4). Full gate: PASS=64 FAIL=0 SKIP=3 (CASAN_CI_STEP_TIMEOUT_SEC=1200 — track-a ~450s runs close to the 600s default and can tip over under load; this is timing variance, not a regression — it passed cleanly with headroom). Runtime log/audit artifacts kept unstaged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-08 00:06:00 +09:00
parent 2c765c9a45
commit 664bd1f00c
229 changed files with 268 additions and 3 deletions
@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN Plan-16 SEC-23 (MT-01) — tenant-partitioned state store + cross-tenant guard.
+#
+# Harness state (audit chains, control-plane settings, telemetry, logs, kill-switch)
+# used to live in SHARED global files, so a run for tenant A could read/modify
+# tenant B's state directly — bypassing RBAC (which only guarded the API, not the
+# files). This resolves every state path under a per-tenant root and refuses any
+# access that escapes the caller's own tenant partition (reusing the SEC-28 realpath
+# guard). Deny-by-default; secure-by-default in prod (missing tenant = fail-closed).
+#
+# Tenant id: CASAN_TENANT_ID (allowlist [A-Za-z0-9_-]+, no path traversal). Unset →
+# 'default' in dev, but REFUSED under CASAN_PROFILE=prod.
+#
+# Usage:
+#   tenant-store.sh id                      # print resolved tenant id
+#   tenant-store.sh root                    # print this tenant's state root (0700)
+#   tenant-store.sh init                    # create tenant root with 0700 perms
+#   tenant-store.sh resolve <logical-name>  # print tenant-scoped path for a state file
+#   tenant-store.sh guard <path>            # exit 0 if path is inside own tenant root, else DENY
+# Env: CASAN_TENANT_STATE_ROOT (default .specify/state/tenants)
+# Exit: 0 ok · 3 denied (reason on stderr) · 64 usage.
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/casan-paths.sh"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+STATE_ROOT="${CASAN_TENANT_STATE_ROOT:-$CASAN_STATE_ROOT/state/tenants}"
+
+die() { echo "TENANT_DENIED reason=$1" >&2; exit 3; }
+
+resolve_tenant_id() {
+  local t="${CASAN_TENANT_ID:-}"
+  if [[ -z "$t" ]]; then
+    [[ "${CASAN_PROFILE:-}" == "prod" ]] && die "tenant_id_required_in_prod"
+    t="default"
+  fi
+  [[ "$t" =~ ^[A-Za-z0-9_-]+$ ]] || die "tenant_id_invalid(${t})"
+  printf '%s' "$t"
+}
+
+tenant_root() {
+  local t; t="$(resolve_tenant_id)" || exit 3
+  printf '%s/%s' "$STATE_ROOT" "$t"
+}
+
+ensure_root() {
+  local root="$1"
+  mkdir -p "$root" || die "mkdir_failed(${root})"
+  chmod 700 "$STATE_ROOT" 2>/dev/null || true
+  chmod 700 "$root" 2>/dev/null || true
+}
+
+CMD="${1:-}"; shift || true
+case "$CMD" in
+  id)
+    resolve_tenant_id; echo
+    ;;
+  root)
+    tenant_root; echo
+    ;;
+  init)
+    root="$(tenant_root)" || exit 3
+    ensure_root "$root"
+    echo "$root"
+    ;;
+  resolve)
+    name="${1:-}"; [[ -n "$name" ]] || die "logical_name_required"
+    case "$name" in
+      /*|*..*) die "logical_name_invalid(${name})" ;;
+    esac
+    root="$(tenant_root)" || exit 3
+    ensure_root "$root"
+    mkdir -p "$(dirname "$root/$name")" 2>/dev/null || true
+    printf '%s/%s\n' "$root" "$name"
+    ;;
+  guard)
+    target="${1:-}"; [[ -n "$target" ]] || die "target_required"
+    root="$(tenant_root)" || exit 3
+    ensure_root "$root"
+    if bash "$SCRIPT_DIR/path-guard.sh" "$target" "$root" >/dev/null 2>&1; then
+      echo "TENANT_OK path within own tenant root"
+      exit 0
+    fi
+    die "cross_tenant_access(target=${target})"
+    ;;
+  *)
+    echo "Usage: tenant-store.sh {id|root|init|resolve <name>|guard <path>}" >&2
+    exit 64
+    ;;
+esac