feat(plan-01): Phase 3 — split domain OKR data into apps/okr/domain

Separate per-project domain data from the reusable harness so packages/casan-harness
holds no domain artifacts. Domain data physically relocated to apps/okr/domain, with
compat symlinks at the old paths (Python + app + evidence-log refs keep resolving).

Moved -> apps/okr/domain (+ compat symlink at old path):
  golden-runs/           (was .specify/level5/golden-runs)
  corpus/{redteam-corpus.jsonl,redteam-vectors.jsonl,benign-corpus/}
                         (was packages/casan-harness/security/*)
  traceability-map.json  (was .specify/traceability-map.json)
  input/                 (was docs/input — OKR requirement/architecture)

casan-paths.sh: add CASAN_DOMAIN_ROOT (apps/okr/domain; env-overridable so Plan-06 can
point a second app at its own domain; falls back to .specify pre-split).

Harness bash refs repointed to $CASAN_DOMAIN_ROOT: run-casan4 (golden), phase3-redteam
(corpus), phase-h4-multilingual/split-inject (benign-corpus), phase10-traceability (map),
benign-fp-report (corpus+vectors). Python + app refs still resolve via the compat
symlinks (repointed in Phase 4 when the symlinks are removed).

Full gate: PASS=64 FAIL=0 SKIP=3 (CASAN_CI_STEP_TIMEOUT_SEC=1200). A first gate run
crawled under host load avg ~30 (Ollama + system); re-run at lower load passed clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
2026-07-08 10:01:15 +09:00
co-authored by Claude Opus 4.8
parent d54d7f5f4c
commit f2ea5590b1
28 changed files with 142 additions and 122 deletions
@@ -67,6 +67,19 @@ if [[ -z "${CASAN_GOVERNANCE_ROOT:-}" ]]; then
CASAN_GOVERNANCE_ROOT="$CASAN_STATE_ROOT/level5/central-governance"
fi
# Domain (DATA) root: per-project golden-runs, red-team/benign corpus, requirement
# input, traceability map — the reusable harness must NOT bake these in. Lives at
# apps/okr/domain (compat symlinks bridge the pre-move .specify paths). A different
# app sets CASAN_DOMAIN_ROOT to its own apps/<project>/domain (Plan-06 reuse).
if [[ -z "${CASAN_DOMAIN_ROOT:-}" ]]; then
if [[ -d "$CASAN_APP_ROOT/apps/okr/domain" ]]; then
CASAN_DOMAIN_ROOT="$CASAN_APP_ROOT/apps/okr/domain"
else
# Fallback for the pre-split monolithic layout: domain data co-located in .specify.
CASAN_DOMAIN_ROOT="$CASAN_STATE_ROOT"
fi
fi
# NOTE: roots are deliberately NOT exported. Each script/test sources this resolver
# and self-derives its roots from its OWN location (BASH_SOURCE), matching the original
# per-script `PROJECT_ROOT="$SCRIPT_DIR/../../.."` semantics. Exporting them would leak