feat(plan-01): Phase 4c — hard cutoff, remove .specify compat facade

Repoint every remaining literal `.specify/...` / `docs/input` reference to the real
package/domain location and delete all compat symlinks. The harness now runs purely via
packages/casan-harness/... with no .specify facade; .specify holds ONLY runtime state
(logs/, agentops/alerts.log, level5/central-governance).

Refs fixed (Phase 0.5 only caught `$VAR/.specify/` — these were bare/`__file__`/literal):
- secrets-scan.sh: scan-target excludes -> packages/casan-harness/... (+ apps/okr/domain/corpus)
- loop_common.py: loop-policy.yaml -> harness config (package-relative)
- evidence-pack-build.py: judge-gate test + traceability-matrix.py -> harness/sibling
- phase10-traceability: REQ -> $CASAN_DOMAIN_ROOT/input
- run-casan-pipeline.mjs: model-fallback/drift-detect/rollback-manager -> HARNESS_BASH,
  golden -> GOLDEN_PLAN (apps/okr/domain), with .specify/logs state kept
- casan-step.mjs: requirement fallback restored to docs/input for hermetic sandboxes
- descriptive config (tool-registry/harness-package/drift-policy/hallucination/risk-registry/
  loop-policy.schema + docstrings) repointed for accuracy
- policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest regenerated +
  re-signed (POLICY_HASHES_VALID files=8, POLICY_SIGNATURE_VALID)

Removed 22 .specify code/config symlinks + docs/input symlink.
Full gate via packages path, NO facade: PASS=64 FAIL=0 SKIP=3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/agentops/alerts.yaml

@@ -1 +0,0 @@
-../../packages/casan-harness/agentops/alerts.yaml

AINative_OKR_CASAN5/.specify/agentops/hallucination-tracking.yaml

@@ -1 +0,0 @@
-../../packages/casan-harness/agentops/hallucination-tracking.yaml

AINative_OKR_CASAN5/.specify/agentops/metrics.yaml

@@ -1 +0,0 @@
-../../packages/casan-harness/agentops/metrics.yaml

AINative_OKR_CASAN5/.specify/agentops/rate-limits.yaml

@@ -1 +0,0 @@
-../../packages/casan-harness/agentops/rate-limits.yaml

AINative_OKR_CASAN5/.specify/agentops/tracking.yaml

@@ -1 +0,0 @@
-../../packages/casan-harness/agentops/tracking.yaml

AINative_OKR_CASAN5/.specify/config

@@ -1 +0,0 @@
-../packages/casan-harness/config

AINative_OKR_CASAN5/.specify/governance

@@ -1 +0,0 @@
-../packages/casan-harness/governance

AINative_OKR_CASAN5/.specify/init-options.json

@@ -1 +0,0 @@
-../packages/casan-harness/init-options.json

AINative_OKR_CASAN5/.specify/level5/drift-policy.yaml

@@ -1 +0,0 @@
-../../packages/casan-harness/level5/drift-policy.yaml

AINative_OKR_CASAN5/.specify/level5/golden-runs

@@ -1 +0,0 @@
-../../apps/okr/domain/golden-runs

AINative_OKR_CASAN5/.specify/level5/harness-package.json

@@ -1 +0,0 @@
-../../packages/casan-harness/level5/harness-package.json

AINative_OKR_CASAN5/.specify/level5/kpi-schema.yaml

@@ -1 +0,0 @@
-../../packages/casan-harness/level5/kpi-schema.yaml

AINative_OKR_CASAN5/.specify/level5/model-fallback.yaml

@@ -1 +0,0 @@
-../../packages/casan-harness/level5/model-fallback.yaml

AINative_OKR_CASAN5/.specify/level5/project-registry.json

@@ -1 +0,0 @@
-../../packages/casan-harness/level5/project-registry.json

AINative_OKR_CASAN5/.specify/level5/provider-usage-sample.json

@@ -1 +0,0 @@
-../../packages/casan-harness/level5/provider-usage-sample.json

AINative_OKR_CASAN5/.specify/level5/tool-registry.yaml

@@ -1 +0,0 @@
-../../packages/casan-harness/level5/tool-registry.yaml

AINative_OKR_CASAN5/.specify/memory

@@ -1 +0,0 @@
-../packages/casan-harness/memory

AINative_OKR_CASAN5/.specify/scripts

@@ -1 +0,0 @@
-../packages/casan-harness/scripts

AINative_OKR_CASAN5/.specify/security

@@ -1 +0,0 @@
-../packages/casan-harness/security

AINative_OKR_CASAN5/.specify/templates

@@ -1 +0,0 @@
-../packages/casan-harness/templates

AINative_OKR_CASAN5/.specify/tests

@@ -1 +0,0 @@
-../packages/casan-harness/tests

AINative_OKR_CASAN5/.specify/traceability-map.json

@@ -1 +0,0 @@
-../apps/okr/domain/traceability-map.json

AINative_OKR_CASAN5/docs/input

@@ -1 +0,0 @@
-../apps/okr/domain/input

AINative_OKR_CASAN5/packages/casan-harness/agentops/hallucination-tracking.yaml

@@ -10,7 +10,7 @@ tracking:
 steps_with_tracking:
   - step: step-1-srs
     reference_docs:
-      - docs/input/okr-requirement.md
+      - apps/okr/domain/input/okr-requirement.md
     signals:
       - ungrounded_feature_claim
       - invented_requirement

AINative_OKR_CASAN5/packages/casan-harness/config/loop-policy.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://casan.fpt/loop-policy.schema.json",
   "title": "CASAN Loop Budget Governor policy",
-  "description": "Schema for .specify/config/loop-policy.yaml (Plan-17 Track 1). Budgets are non-negative numbers; on_exceed is halt|escalate. Absence of a rule means the strictest built-in ceiling applies (deny-by-default).",
+  "description": "Schema for packages/casan-harness/config/loop-policy.yaml (Plan-17 Track 1). Budgets are non-negative numbers; on_exceed is halt|escalate. Absence of a rule means the strictest built-in ceiling applies (deny-by-default).",
   "type": "object",
   "required": ["version", "profiles"],
   "additionalProperties": false,

AINative_OKR_CASAN5/packages/casan-harness/governance/risk-registry.yaml

@@ -83,7 +83,7 @@ reporting:
 
   enabled: true
   frequency: daily
-  output: ".specify/governance/risk-report.md"
+  output: "packages/casan-harness/governance/risk-report.md"
 
 review:
 
@@ -93,6 +93,6 @@ review:
 auto_update:
   enabled: true
   trigger: new_action_type_detected
-  script: .specify/scripts/powershell/update-risk-registry.ps1
+  script: packages/casan-harness/scripts/powershell/update-risk-registry.ps1
   default_risk_for_unknown_action: high
   note: "Unknown actions default to high-risk (fail-secure). Run update-risk-registry.ps1 to register."

AINative_OKR_CASAN5/packages/casan-harness/level5/drift-policy.yaml

@@ -1,7 +1,7 @@
 version: 1.0
 description: CASAN Level 5 drift detection policy
 
-golden_dir: .specify/level5/golden-runs
+golden_dir: apps/okr/domain/golden-runs
 evidence_dir: docs/output/casan/level5-evidence
 
 thresholds:

AINative_OKR_CASAN5/packages/casan-harness/level5/harness-package.json

@@ -17,8 +17,8 @@
     "python": ">=3.9"
   },
   "entrypoints": {
-    "wrapper": ".specify/scripts/bash/casan-harness.sh",
+    "wrapper": "packages/casan-harness/scripts/bash/casan-harness.sh",
-    "test": ".specify/tests/run-casan4-harness-tests.sh",
+    "test": "packages/casan-harness/tests/run-casan4-harness-tests.sh",
     "dashboard": "docs/output/casan/agentops-dashboard.html"
   }
 }

AINative_OKR_CASAN5/packages/casan-harness/level5/tool-registry.yaml

@@ -18,7 +18,7 @@ tools:
     allowed_agents: "boss,implement-agent"
     rollback:
       strategy: git_patch_reverse
-      script: .specify/scripts/bash/rollback-manager.sh
+      script: packages/casan-harness/scripts/bash/rollback-manager.sh
 
   - id: migration
     owner: database-owner
@@ -29,7 +29,7 @@ tools:
     allowed_agents: "boss,implement-agent"
     rollback:
       strategy: migration_down_or_restore
-      script: .specify/scripts/bash/rollback-manager.sh
+      script: packages/casan-harness/scripts/bash/rollback-manager.sh
 
   - id: deploy
     owner: release-manager
@@ -41,7 +41,7 @@ tools:
     allowed_agents: "boss,release-manager"
     rollback:
       strategy: previous_release
-      script: .specify/scripts/bash/rollback-manager.sh
+      script: packages/casan-harness/scripts/bash/rollback-manager.sh
 
   - id: external_api
     owner: platform-team
@@ -52,7 +52,7 @@ tools:
     allowed_agents: "boss,implement-agent"
     rollback:
       strategy: compensating_request
-      script: .specify/scripts/bash/rollback-manager.sh
+      script: packages/casan-harness/scripts/bash/rollback-manager.sh
 
   - id: db_write
     owner: database-owner
@@ -63,7 +63,7 @@ tools:
     allowed_agents: "boss,implement-agent"
     rollback:
       strategy: restore_from_backup
-      script: .specify/scripts/powershell/rollback-manager.ps1
+      script: packages/casan-harness/scripts/powershell/rollback-manager.ps1
 
   - id: write_file
     owner: engineering
@@ -74,7 +74,7 @@ tools:
     allowed_agents: "boss,implement-agent,design-agent"
     rollback:
       strategy: delete_or_restore
-      script: .specify/scripts/bash/rollback-manager.sh
+      script: packages/casan-harness/scripts/bash/rollback-manager.sh
 
 level5_gate:
   required_fields:

AINative_OKR_CASAN5/packages/casan-harness/scripts/bash/evidence-pack-build.py

@@ -21,6 +21,9 @@ import os
 import subprocess
 import sys
 
+# Plan-01: this script lives at <harness>/scripts/bash/; the harness root is two levels up.
+_HARNESS = os.path.abspath(os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", ".."))
+
 
 def read_jsonl(path):
     rows = []
@@ -73,11 +76,11 @@ def main():
     # H3 eval scorecard (best effort — reference known evidence)
     reports["h3-eval-scorecard.json"] = {
         "harness": "H3-eval", "run_id": run_id,
-        "judge_gate_tests": os.path.exists(os.path.join(root, ".specify/tests/phase3-judge-gate-tests.sh")),
+        "judge_gate_tests": os.path.exists(os.path.join(_HARNESS, "tests/phase3-judge-gate-tests.sh")),
         "note": "judge-gate fail-before/fix cycle proven by phase3-judge-gate-tests.sh",
     }
     traceability_out = os.path.join(pack_dir, "traceability-matrix.json")
-    traceability_script = os.path.join(root, ".specify/scripts/bash/traceability-matrix.py")
+    traceability_script = os.path.join(os.path.dirname(os.path.abspath(__file__)), "traceability-matrix.py")
     traceability_rc = 1
     if os.path.isfile(traceability_script):
         traceability_rc = subprocess.run(

AINative_OKR_CASAN5/packages/casan-harness/scripts/bash/loop_common.py

@@ -136,7 +136,9 @@ def policy_path() -> str:
     explicit = os.environ.get("CASAN_LOOP_POLICY_FILE")
     if explicit:
         return explicit
-    return os.path.join(project_root(), ".specify/config/loop-policy.yaml")
+    # Plan-01: loop-policy.yaml is harness config, not app state — resolve it inside the
+    # package (this file lives at <harness>/scripts/bash/), independent of any .specify facade.
+    return os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "config", "loop-policy.yaml"))
 
 
 def load_policy():

AINative_OKR_CASAN5/packages/casan-harness/scripts/bash/pii-mask.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""CASAN H4 PII masker driven by .specify/security/pii-rules.yaml.
+"""CASAN H4 PII masker driven by packages/casan-harness/security/pii-rules.yaml.
 
 Reads content on stdin, applies every `action: mask` rule from the rules
 file, and writes the masked content to stdout. Type-specific replacement

AINative_OKR_CASAN5/packages/casan-harness/scripts/bash/secrets-scan.sh

@@ -39,14 +39,15 @@ fi
 # Exclude known test-fixture files and evidence directories that intentionally
 # contain the pattern as test data.
 FIXTURE_EXCLUDES=(
-  ".specify/tests/"
+  "packages/casan-harness/tests/"
   "docs/output/casan/evidence/"
-  ".specify/security/"
+  "packages/casan-harness/security/"
-  ".specify/scripts/bash/security-check.sh"
+  "apps/okr/domain/corpus/"
-  ".specify/scripts/bash/verify-audit-chain.sh"
+  "packages/casan-harness/scripts/bash/security-check.sh"
-  ".specify/scripts/bash/verify-tool-audit.sh"
+  "packages/casan-harness/scripts/bash/verify-audit-chain.sh"
-  ".specify/scripts/bash/tool-audit-lib.sh"
+  "packages/casan-harness/scripts/bash/verify-tool-audit.sh"
-  ".specify/scripts/bash/governance-check.sh"
+  "packages/casan-harness/scripts/bash/tool-audit-lib.sh"
+  "packages/casan-harness/scripts/bash/governance-check.sh"
 )
 build_exclude_args() {
   for ex in "${FIXTURE_EXCLUDES[@]}"; do printf -- "--exclude-dir=%s " "$ex"; done

AINative_OKR_CASAN5/packages/casan-harness/scripts/bash/traceability-matrix.py

@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
 """CASAN Plan-10 traceability matrix generator/gate.
 
-Parses FR-* requirements from docs/input/okr-requirement.md and checks each
+Parses FR-* requirements from apps/okr/domain/input/okr-requirement.md and checks each
 requirement has at least one existing code file and one existing test file.
 """
 import argparse

AINative_OKR_CASAN5/packages/casan-harness/tests/phase10-traceability-tests.sh

@@ -17,7 +17,7 @@ PASS=0; FAIL=0
 pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
 fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
 
-REQ="$PROJECT_ROOT/docs/input/okr-requirement.md"
+REQ="$CASAN_DOMAIN_ROOT/input/okr-requirement.md"
 MAP="$CASAN_DOMAIN_ROOT/traceability-map.json"
 OUT="$WORK/traceability-matrix.json"
 

AINative_OKR_CASAN5/scripts/casan-log.mjs

@@ -1,5 +1,5 @@
 // CASAN shared log helper (Node side).
-// Taxonomy (shared with .specify/scripts/bash/casan-log.sh):
+// Taxonomy (shared with packages/casan-harness/scripts/bash/casan-log.sh):
 //   error(0) < warn(1) < info(2) < debug(3) < trace(4), default info.
 // All lines go to stderr so stdout stays reserved for existing outputs.
 

AINative_OKR_CASAN5/scripts/casan-step.mjs

@@ -252,7 +252,7 @@ switch (step) {
       extraInstructions: 'Create an SRS with purpose, scope, functional requirements, non-functional requirements, and traceable FR IDs.',
     });
     write(srsPath, generated.content);
-    report(`docs/output/output_logs/${featureId}/reports/01-srs-report.md`, '# STEP 1: SRS Generation Report', `Generated ${srsPath} from docs/input/okr-requirement.md. source=${generated.source} note=${generated.note}.`, 'APPROVED', [srsPath]);
+    report(`docs/output/output_logs/${featureId}/reports/01-srs-report.md`, '# STEP 1: SRS Generation Report', `Generated ${srsPath} from apps/okr/domain/input/okr-requirement.md. source=${generated.source} note=${generated.note}.`, 'APPROVED', [srsPath]);
     break;
   }
   case '02-bd': {

AINative_OKR_CASAN5/scripts/run-casan-pipeline.mjs

@@ -10,10 +10,15 @@ const dryRun = process.argv.includes('--dry-run');
 
 const featureId = '001-okr-web-app';
 const root = process.cwd();
-// Plan-01: harness relocated to packages/casan-harness/; fall back to the .specify facade.
+// Plan-01: harness relocated to packages/casan-harness/, domain to apps/okr/domain/;
-const HARNESS = existsSync(join(root, 'packages/casan-harness/scripts/bash/casan-harness.sh'))
+// fall back to the pre-move paths so this runner works from either layout.
-  ? 'packages/casan-harness/scripts/bash/casan-harness.sh'
+const HARNESS_BASH = existsSync(join(root, 'packages/casan-harness/scripts/bash'))
-  : '.specify/scripts/bash/casan-harness.sh';
+  ? 'packages/casan-harness/scripts/bash'
+  : '.specify/scripts/bash';
+const HARNESS = `${HARNESS_BASH}/casan-harness.sh`;
+const GOLDEN_PLAN = existsSync(join(root, 'apps/okr/domain/golden-runs/okr-plan.golden.txt'))
+  ? 'apps/okr/domain/golden-runs/okr-plan.golden.txt'
+  : '.specify/level5/golden-runs/okr-plan.golden.txt';
 const logDir = `docs/output/output_logs/${featureId}`;
 const casanDir = `${logDir}/casan`;
 const reportsDir = `${logDir}/reports`;
@@ -340,7 +345,7 @@ runHarness({ id: '07-plan-attempt-2', agent: 'speckit.plan', step: '05-plan', at
 const fallbackOut = `${casanDir}/model-fallback-output.txt`;
 log('debug', 'boss', `model-fallback invoked (real primary failure) → ${fallbackOut}`);
 execFileSync(
-  '.specify/scripts/bash/model-fallback.sh',
+  `/model-fallback.sh`,
   [
     fallbackOut,
     // Real primary failure: reading a nonexistent path exits non-zero (not a
@@ -361,8 +366,8 @@ appendBoss(`Model fallback invoked; output ${fallbackOut}`);
 const driftCandidate = `${casanDir}/drift-plan-candidate.txt`;
 copyFileSync(fallbackOut, driftCandidate);
 log('debug', 'boss', 'drift-detect: fallback output vs golden baseline');
-execFileSync('.specify/scripts/bash/drift-detect.sh', [
+execFileSync(`/drift-detect.sh`, [
-  '.specify/level5/golden-runs/okr-plan.golden.txt',
+  GOLDEN_PLAN,
   driftCandidate,
   '.specify/logs/level5/okr-plan-drift-report.json',
 ], { cwd: root, stdio: 'inherit' });
@@ -390,7 +395,7 @@ copyFileSync(rollbackTarget, rollbackBackup);
 writeFileSync(`${rollbackDir}/rollback-before.txt`, readFileSync(rollbackTarget, 'utf8'), 'utf8');
 writeFileSync(rollbackTarget, 'changed content that must be undone\n', 'utf8');
 writeFileSync(`${rollbackDir}/rollback-changed.txt`, readFileSync(rollbackTarget, 'utf8'), 'utf8');
-const record = execFileSync('.specify/scripts/bash/rollback-manager.sh', [
+const record = execFileSync(`/rollback-manager.sh`, [
   'record',
   'restore rollback target evidence file',
   `cp ${rollbackBackup} ${rollbackTarget}`,
@@ -400,7 +405,7 @@ const tx = record.match(/transaction_id=([^\s]+)/)?.[1];
 if (!tx) {
   throw new Error('rollback transaction id not found');
 }
-const execute = execFileSync('.specify/scripts/bash/rollback-manager.sh', ['execute', tx], {
+const execute = execFileSync(`/rollback-manager.sh`, ['execute', tx], {
   cwd: root,
   encoding: 'utf8',
 });