feat: add production Core runtime modes

packages/casan-devkit/templates/project/casan-hook.py

@@ -1,13 +1,13 @@
 #!/usr/bin/env python3
-"""Project-local bootstrap for CASAN's globally installed agentic adapters.
+"""Project-local bootstrap for CASAN's managed or vendored agentic adapters.
 
 This file is intentionally small and stdlib-only.  It is the stable command
-target committed by `casan init`; the policy implementation remains in the
-versioned global CASAN installation.  On every hook invocation it:
+target committed by `casan init`; the policy implementation is resolved from
+the project lock. On every hook invocation it:
 
 1. locates the project and loads `.casan/config.json`;
 2. applies the project's enforcement/integration settings to the process;
-3. resolves the pinned global harness and verifies its live integrity hash;
+3. resolves the pinned managed/vendored Core and verifies its live integrity hash;
 4. dispatches stdin/stdout to the selected client adapter.
 
 The bootstrap never calls a model.
@@ -46,8 +46,22 @@ def find_project_root(start):
     return None
 
 
-def harness_candidates(lock):
+def harness_candidates(lock, project_root):
     values = []
+    runtime_path = lock.get("runtime_path")
+    if lock.get("runtime_mode") == "vendored":
+        if not isinstance(runtime_path, str) or os.path.isabs(runtime_path):
+            return values
+        normalized = os.path.normpath(runtime_path)
+        candidate = os.path.abspath(os.path.join(project_root, normalized))
+        try:
+            inside_project = os.path.commonpath(
+                (project_root, candidate)) == project_root
+        except ValueError:
+            inside_project = False
+        if not inside_project:
+            return values
+        return [os.path.join(candidate, "packages", "casan-harness")]
     explicit = os.environ.get("CASAN_HARNESS_ROOT")
     if explicit:
         values.append(explicit)
@@ -69,8 +83,8 @@ def harness_candidates(lock):
     return values
 
 
-def resolve_harness(lock):
-    for candidate in harness_candidates(lock):
+def resolve_harness(lock, project_root):
+    for candidate in harness_candidates(lock, project_root):
         root = os.path.abspath(os.path.expanduser(candidate))
         if os.path.isfile(os.path.join(root, "scripts", "python",
                                        "agentic_bridge.py")):
@@ -178,7 +192,7 @@ def main(argv=None):
          "vscode-copilot": "vscode"}.get(item, item) for item in enabled)
 
     lock = load_json(os.path.join(root, ".casan", "version.lock"))
-    harness = resolve_harness(lock)
+    harness = resolve_harness(lock, root)
     if not harness:
         return emit_failure(client, event, "pinned global harness not found",
                             enforce)