Task 1.2: introduce a single path resolver so no harness script hardcodes
`.specify/...` scattered across the tree. casan-paths.sh resolves four roots
(HARNESS/STATE/GOVERNANCE/APP) by marker-based walk-up from its own location —
never `git rev-parse` (git root is the repo PARENT here, not the app dir).
- 101 bash scripts/tests: 238 hardcoded `$PROJECT_ROOT/.specify/...` refs rewritten
to CASAN_HARNESS_ROOT (code) / CASAN_STATE_ROOT (logs,state) / CASAN_GOVERNANCE_ROOT.
Sandbox test vars ($WORK/$TP/$FP/$T1_WORK) left untouched.
- Roots are NOT exported: each script/subprocess self-resolves from its own tree,
matching the original per-script semantics and preserving hermetic sandbox isolation
(node casan-step.mjs, copied telemetry/rollback scripts must not inherit real roots).
- Sandbox tests that copy a harness script now also copy casan-paths.sh (its new
sibling dependency): adversarial (verify-audit-chain/verify-tool-audit/rollback) +
track-a (security-check/telemetry-integrity).
- control-plane-settings.json reclassified as STATE (untracked runtime store).
Roots all still resolve to `.specify` in this monolithic layout, so behavior is
unchanged. Full gate: PASS=64 FAIL=0 SKIP=3 (adversarial 44/0, track-a 25/0).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
evidence-pack.sh {pack|verify-pack} assembles a per-run proof pack from REAL
on-disk logs (summaries only — no raw secret/PII copied; decision-log passes the
data-exfil guard or the pack aborts). Produces the standard set: run-summary,
h1..h7 reports, redteam-result, benign-fp-report, artifact-manifest, decision-log,
plus a signed manifest head (evidence-pack.sig).
Tamper-evident: verify-pack recomputes every file hash vs artifact-manifest.json
(any change fails) and verifies the RSA signature over manifest-head.txt (a
manifest re-forge fails without the off-repo key).
Certified run: run-summary.certified is true ONLY when required gates pass
(H4 exercised, H5 audit chain valid, H5 telemetry verified, no unresolved cost
spike, benign-FP within budget) and none was silently skipped — missing evidence
records an honest reason and does NOT certify.
CLI mapping: `casan pack <id>` -> evidence-pack.sh pack; `casan verify-pack <id>`
-> evidence-pack.sh verify-pack. phase3-evidence-pack-tests.sh covers it.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
