feat: add production Core runtime modes

packages/casan-devkit/tests/hybrid-install-tests.sh

@@ -181,11 +181,14 @@ PID=$(python3 -c 'import json;print(json.load(open("'"$PROJ2"'/.casan/config.jso
 MODE=$(python3 -c 'import json;print(json.load(open("'"$PROJ2"'/.casan/config.json"))["enforcement_mode"])' 2>/dev/null)
 [[ "$MODE" == "enforce" ]] && pass "production init defaults to enforce mode" || fail "default mode is not enforce ($MODE)"
 DEFAULT_LEVEL=$(python3 -c 'import json;print(json.load(open("'"$PROJ2"'/.casan/config.json"))["target_level"])' 2>/dev/null)
+DEFAULT_RUNTIME=$(python3 -c 'import json;print(json.load(open("'"$PROJ2"'/.casan/config.json"))["runtime_mode"])' 2>/dev/null)
 [[ "$DEFAULT_LEVEL" == "1" ]] \
+  && [[ "$DEFAULT_RUNTIME" == "managed" ]] \
+  && [ ! -d "$PROJ2/.casan/runtime" ] \
   && [ ! -d "$PROJ2/.gitea" ] \
   && [ ! -d "$PROJ2/apps" ] \
-  && pass "existing-project init defaults to core without CI/domain scaffold" \
-  || fail "default init did not stay at core (level=$DEFAULT_LEVEL)"
+  && pass "existing-project init defaults to managed Core without vendoring" \
+  || fail "default init mode is unclear (level=$DEFAULT_LEVEL runtime=$DEFAULT_RUNTIME)"
 
 echo "===== ⑦ init MERGES into an existing shell (agents/skills/hooks preserved) ====="
 EXP="$WORK/existing"; mkdir -p "$EXP/.claude/agents" "$EXP/.claude/skills" "$EXP/.codex"
@@ -254,6 +257,53 @@ LVL_DOWN=$( ( cd "$L2" && "$DKC" level show --json ) | python3 -c 'import json,s
   && pass "default init downgrades existing DevKit adoption to clean core" \
   || fail "default init left Level 2 artifacts after core downgrade"
 
+VENDORED="$WORK/vendored-core"; mkdir -p "$VENDORED"
+VENDORED_OUT=$(cd "$VENDORED" && "$DKC" init --runtime vendored --project vendored-core --client claude --non-interactive)
+VENDORED_ROOT="$VENDORED/.casan/runtime/casan-core"
+echo "$VENDORED_OUT" | grep -q "Runtime.*Vendored" \
+  && pass "vendored init clearly reports runtime placement" \
+  || fail "vendored init output does not explain runtime mode ($VENDORED_OUT)"
+[ -x "$VENDORED_ROOT/bin/casan" ] \
+  && [ -f "$VENDORED_ROOT/packages/casan-harness/scripts/bash/casan-harness.sh" ] \
+  && [ ! -d "$VENDORED_ROOT/packages/casan-harness/tests" ] \
+  && [ ! -d "$VENDORED_ROOT/packages/casan-harness/level5" ] \
+  && pass "vendored mode installs only production Core inside the project" \
+  || fail "vendored Core layout is incomplete or contains source-only files"
+( cd "$VENDORED" && "$VENDORED_ROOT/bin/casan" version >/dev/null ) \
+  && pass "project-vendored Core includes a working local CLI" \
+  || fail "project-vendored CLI cannot resolve its Core runtime"
+( cd "$VENDORED" && "$DKC" verify-harness >/dev/null ) \
+  && pass "global launcher resolves and verifies the project-vendored Core" \
+  || fail "vendored Core is not honored by the global launcher"
+( cd "$VENDORED" && "$DKC" doctor --client claude >/dev/null ) \
+  && pass "project hooks execute against the verified vendored Core" \
+  || fail "project hook cannot execute against vendored Core"
+mv "$VENDORED_ROOT" "$VENDORED_ROOT.missing"
+VENDORED_MISSING_RC=0
+( cd "$VENDORED" && "$DKC" version >/dev/null 2>&1 ) || VENDORED_MISSING_RC=$?
+mv "$VENDORED_ROOT.missing" "$VENDORED_ROOT"
+[ "$VENDORED_MISSING_RC" -ne 0 ] \
+  && pass "vendored contract fails closed instead of falling back to global Core" \
+  || fail "missing vendored Core silently fell back to the global runtime"
+( cd "$VENDORED" && "$DKC" init --project vendored-core --client none --non-interactive >/dev/null )
+[ -d "$VENDORED_ROOT/packages/casan-harness" ] \
+  && pass "re-init preserves the project's selected vendored runtime mode" \
+  || fail "re-init silently changed the project's runtime mode"
+( cd "$VENDORED" && "$DKC" init --runtime managed --project vendored-core --client none --non-interactive >/dev/null )
+[ ! -d "$VENDORED/.casan/runtime" ] \
+  && pass "switching back to managed mode removes the old vendored runtime" \
+  || fail "managed re-init left a stale vendored runtime"
+
+VENDORED_ESCAPE="$WORK/vendored-escape"; VENDORED_OUTSIDE="$WORK/vendored-outside"
+mkdir -p "$VENDORED_ESCAPE/.casan" "$VENDORED_OUTSIDE"
+ln -s "$VENDORED_OUTSIDE" "$VENDORED_ESCAPE/.casan/runtime"
+VENDORED_ESCAPE_RC=0
+( cd "$VENDORED_ESCAPE" && "$DKC" init --runtime vendored --project vendored-escape --client none --non-interactive >/dev/null 2>&1 ) || VENDORED_ESCAPE_RC=$?
+[ "$VENDORED_ESCAPE_RC" -ne 0 ] \
+  && [ ! -e "$VENDORED_OUTSIDE/casan-core" ] \
+  && pass "vendored install rejects a runtime path escaping through symlink" \
+  || fail "vendored install followed an unsafe project symlink"
+
 echo "===== ⑨ SAFETY: init refuses to adopt a CASAN source hub into itself ====="
 HUB="$WORK/fakehub"
 mkdir -p "$HUB/packages/casan-harness/scripts/bash" \
@@ -370,6 +420,9 @@ INIT_OUT=$(cd "$UN" && "$DKC" init --level devkit --project uninstall-project --
 echo "$INIT_OUT" | grep -q "CASAN initialized" \
   && pass "init defaults to concise human-readable output" \
   || fail "init human output missing ($INIT_OUT)"
+echo "$INIT_OUT" | grep -q "Runtime.*Managed" \
+  && pass "init output clearly identifies managed runtime and path" \
+  || fail "init output hides runtime placement ($INIT_OUT)"
 if echo "$INIT_OUT" | head -1 | grep -q '^[[:space:]]*{'; then
   fail "init still defaults to raw JSON"
 else
@@ -432,6 +485,14 @@ PY
   && pass "legacy uninstall preserves user Gitea workflow and removes CASAN workflow" \
   || fail "uninstall removed a user workflow or retained the CASAN workflow"
 
+UN_VENDORED="$WORK/uninstall-vendored"; mkdir -p "$UN_VENDORED"
+( cd "$UN_VENDORED" && "$DKC" init --runtime vendored --project uninstall-vendored --client none --non-interactive >/dev/null )
+( cd "$UN_VENDORED" && "$DKC" uninstall >/dev/null )
+[ ! -d "$UN_VENDORED/.casan/runtime" ] \
+  && [ ! -f "$UN_VENDORED/.casan/config.json" ] \
+  && pass "uninstall removes the complete project-vendored Core" \
+  || fail "uninstall left vendored Core or active project config"
+
 echo ""
 echo "===== HYBRID INSTALL SUMMARY: PASS=$PASS FAIL=$FAIL ====="
 [[ "$FAIL" -eq 0 ]] || exit 1