Task 1.2: introduce a single path resolver so no harness script hardcodes
`.specify/...` scattered across the tree. casan-paths.sh resolves four roots
(HARNESS/STATE/GOVERNANCE/APP) by marker-based walk-up from its own location —
never `git rev-parse` (git root is the repo PARENT here, not the app dir).
- 101 bash scripts/tests: 238 hardcoded `$PROJECT_ROOT/.specify/...` refs rewritten
to CASAN_HARNESS_ROOT (code) / CASAN_STATE_ROOT (logs,state) / CASAN_GOVERNANCE_ROOT.
Sandbox test vars ($WORK/$TP/$FP/$T1_WORK) left untouched.
- Roots are NOT exported: each script/subprocess self-resolves from its own tree,
matching the original per-script semantics and preserving hermetic sandbox isolation
(node casan-step.mjs, copied telemetry/rollback scripts must not inherit real roots).
- Sandbox tests that copy a harness script now also copy casan-paths.sh (its new
sibling dependency): adversarial (verify-audit-chain/verify-tool-audit/rollback) +
track-a (security-check/telemetry-integrity).
- control-plane-settings.json reclassified as STATE (untracked runtime store).
Roots all still resolve to `.specify` in this monolithic layout, so behavior is
unchanged. Full gate: PASS=64 FAIL=0 SKIP=3 (adversarial 44/0, track-a 25/0).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
C3 (V19) data-exfil-guard.sh: destination-aware egress checkpoint built on the
H4 detectors. cloud/artifact boundaries fail closed on any secret; audit
boundary emits a PII-masked copy (fail closed on an unmaskable secret).
Covers secret-to-cloud, artifact-leaks-env, and PII-in-audit.
C6 (V22) sandbox-run.sh: static policy pre-check (BLOCK on reading ~/.ssh/creds,
network egress, fork bomb, writes outside workspace, huge-file/disk-fill) plus
ulimit file-size/CPU backstops and the wall-clock timeout. HONEST SCOPE: this
is not kernel isolation — the production target (docker --network=none
--read-only --pids-limit / nsjail) is documented as TODO(C6-prod). Process cap
is opt-in so it never breaks legitimate commands on a busy host.
phase2-track-c-tests.sh: 29 adversarial checks (C1 13, C2 6, C3 4, C6 6).
Baselines preserved: run-casan4 35/35, adversarial 44/44.
Running total: 35 + 44 + 25 + 29 = 133 checks.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
