Task 1.2: introduce a single path resolver so no harness script hardcodes
`.specify/...` scattered across the tree. casan-paths.sh resolves four roots
(HARNESS/STATE/GOVERNANCE/APP) by marker-based walk-up from its own location —
never `git rev-parse` (git root is the repo PARENT here, not the app dir).
- 101 bash scripts/tests: 238 hardcoded `$PROJECT_ROOT/.specify/...` refs rewritten
to CASAN_HARNESS_ROOT (code) / CASAN_STATE_ROOT (logs,state) / CASAN_GOVERNANCE_ROOT.
Sandbox test vars ($WORK/$TP/$FP/$T1_WORK) left untouched.
- Roots are NOT exported: each script/subprocess self-resolves from its own tree,
matching the original per-script semantics and preserving hermetic sandbox isolation
(node casan-step.mjs, copied telemetry/rollback scripts must not inherit real roots).
- Sandbox tests that copy a harness script now also copy casan-paths.sh (its new
sibling dependency): adversarial (verify-audit-chain/verify-tool-audit/rollback) +
track-a (security-check/telemetry-integrity).
- control-plane-settings.json reclassified as STATE (untracked runtime store).
Roots all still resolve to `.specify` in this monolithic layout, so behavior is
unchanged. Full gate: PASS=64 FAIL=0 SKIP=3 (adversarial 44/0, track-a 25/0).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Closes the last fully-[planned] Track-C dimension (was scored 1).
- incident.sh raise <event>: classify severity via incident-severity.map
(LOW/MED/HIGH/CRIT), record a structured entry (owner routing), and for
HIGH/CRIT auto-engage the scoped kill-switch + dispatch an alert (reuses H6
alert-dispatch.sh). Exit 2 on HIGH/CRIT so a pipeline gate goes red.
- kill-switch.sh engage/clear/check/status, scoped by project/model/provider
(+ global). `check` exits 2 when engaged so gates honor it.
- casan-harness.sh honors an engaged kill-switch before running (opt-in
CASAN_KILLSWITCH_ENFORCE=1, default OFF → baseline unchanged).
- incident-runbook.md: severity→owner→response + postmortem template + prod TODO.
- phase-c7-incident-tests.sh: 15 checks — severity grading, auto kill-switch on
HIGH/CRIT, MED-only records, lifecycle, global scope, structured record, and
the production wrapper refusing to run under an engaged switch.
Baselines: run-casan4 35/35, adversarial 44/44. New suite total: 175 → 190.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
