CASAN/skills/casan/SKILL.md

name, description

name	description
casan	Operate the CASAN governed AI coding assurance runtime. Use when adopting CASAN into a repository, configuring Claude Code or Codex hooks, checking readiness or runtime integrity, running governance gates, inspecting assurance reports, exporting evidence, or diagnosing CASAN installation and enforcement problems.

CASAN

Use the installed CASAN CLI as the only operational entry point. This skill is an operator facade; it does not duplicate the assurance kernel and installing the plugin alone does not enable enforcement.

Resolve the runtime

1. Work from the target repository root.
2. Resolve casan with command -v casan.
3. If it is unavailable, report that the DevKit runtime must be installed. Do not install into the user's home directory unless the user explicitly asks.
4. If the current checkout is the CASAN source hub and installation is requested, use sh install.sh --level devkit on macOS/Linux or pwsh ./install.ps1 on Windows.
5. Never treat plugin registration as proof that project hooks or enforcement are active.

Route the request

• Adopt or reconfigure a repository: run casan init. Preserve an existing runtime and enforcement choice unless the user explicitly changes it.
• Configure automation: run casan init --non-interactive --edition core --runtime managed --mode enforce --client claude,codex and adjust only the options the user requested.
• Diagnose an installation or project: run casan doctor, then casan readiness --refresh and casan verify-harness as needed.
• Verify governance: run casan gate for project checks and casan verify for audit, tool, and policy verification.
• Inspect evidence: use casan report latest, casan view, or casan report export according to the requested output.
• Inspect the product selection: use casan edition show. Do not equate an installed edition with CASAN Maturity L1-L5.

Preserve the trust boundary

• Check .casan/config.json, .casan/version.lock, and the selected client hook projection before claiming CASAN is active.
• Require the user to review and trust native client hooks where the client exposes a trust step.
• Never edit version.lock to suppress integrity drift. Restore or reinstall the approved runtime and rerun casan verify-harness.
• Never silently change observe to enforce, switch managed/vendored mode, or enable additional client integrations.
• Keep generated evidence and state in the target project. Do not write runtime state into the plugin cache or global version directory.

Report results

State the resolved runtime, project edition, enforcement mode, configured clients, commands run, and any failing assurance control. Distinguish a missing optional Domain Pipeline or provider telemetry integration from a failed Core assurance control.