Resolve every root by marker walk-up instead of a fixed depth that only lands on the
app via the .specify compat symlink, so the harness runs correctly when invoked by its
real packages/casan-harness path — proven by a full gate run via that path: 64/0/0.
- 95 scripts/tests: PROJECT_ROOT/ROOT "$SCRIPT_DIR/../.."-style computations -> $CASAN_APP_ROOT.
- 6 leaf scripts (infra-lab, context-validate, secrets-scan, path-guard, toolchain-verify,
phase2-sourcegen) now source casan-paths + use CASAN_APP_ROOT.
- run-casan4: source casan-paths as a package sibling (facade-independent), PROJECT_ROOT=CASAN_APP_ROOT.
- 8 Python files: project_root()/REPO_ROOT/bundle_root walk UP for the .specify marker
(control-plane-settings, loop_common, model-call, context-compress, test-integrity,
bundle-integrity, traceability-matrix; generate-* fixed earlier).
- evidence-pack-build.py + traceability-matrix.py: domain refs -> apps/okr/domain
(input/, corpus/redteam-vectors.jsonl, traceability-map.json).
- ci-harness-gate.sh: export CASAN_TESTS_DIR/CASAN_TEST_MANIFEST/CASAN_BUNDLE_ROOT so the
integrity Python resolves via the harness root regardless of invocation path; ROOT=CASAN_APP_ROOT.
- Remove the domain compat symlinks from packages/casan-harness/security (redteam-corpus,
redteam-vectors, benign-corpus) — packages now holds NO domain data.
Both invocation paths pass (compat facade still present): .specify/... and packages/...
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Physically move the pure-code subtrees out of .specify into the package, leaving
compat symlinks at the old .specify/<dir> paths so every existing reference (internal
CASAN_HARNESS_ROOT + external CI/docker/mjs) keeps resolving. Runtime state stays put.
Moved (git mv): scripts/ tests/ security/ templates/ config/ governance/ memory/
.specify/<dir> -> packages/casan-harness/<dir> (+ .specify/<dir> symlink)
Stays in .specify (state/governance/domain, handled later): logs/ agentops/ level5/
init-options.json traceability-map.json
Python `.resolve()` self-location followed the compat symlink into packages and lost
the app root; generate-casan-demo-context.py, generate-agentops-dashboard.py and
dashboard-server.py now walk UP for the `.specify` state marker instead of a fixed
parent depth (fixes "missing trace files" in run-casan4).
Full gate: PASS=64 FAIL=0 SKIP=3 (CASAN_CI_STEP_TIMEOUT_SEC=1200 — track-a ~450s runs
close to the 600s default and can tip over under load; this is timing variance, not a
regression — it passed cleanly with headroom). Runtime log/audit artifacts kept unstaged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
