thanhnvandClaude Opus 4.8
3adc48ed82
Resolve every root by marker walk-up instead of a fixed depth that only lands on the app via the .specify compat symlink, so the harness runs correctly when invoked by its real packages/casan-harness path — proven by a full gate run via that path: 64/0/0. - 95 scripts/tests: PROJECT_ROOT/ROOT "$SCRIPT_DIR/../.."-style computations -> $CASAN_APP_ROOT. - 6 leaf scripts (infra-lab, context-validate, secrets-scan, path-guard, toolchain-verify, phase2-sourcegen) now source casan-paths + use CASAN_APP_ROOT. - run-casan4: source casan-paths as a package sibling (facade-independent), PROJECT_ROOT=CASAN_APP_ROOT. - 8 Python files: project_root()/REPO_ROOT/bundle_root walk UP for the .specify marker (control-plane-settings, loop_common, model-call, context-compress, test-integrity, bundle-integrity, traceability-matrix; generate-* fixed earlier). - evidence-pack-build.py + traceability-matrix.py: domain refs -> apps/okr/domain (input/, corpus/redteam-vectors.jsonl, traceability-map.json). - ci-harness-gate.sh: export CASAN_TESTS_DIR/CASAN_TEST_MANIFEST/CASAN_BUNDLE_ROOT so the integrity Python resolves via the harness root regardless of invocation path; ROOT=CASAN_APP_ROOT. - Remove the domain compat symlinks from packages/casan-harness/security (redteam-corpus, redteam-vectors, benign-corpus) — packages now holds NO domain data. Both invocation paths pass (compat facade still present): .specify/... and packages/... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
96 lines
3.9 KiB
Bash
Executable File
96 lines
3.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -uo pipefail
|
|
|
|
# CASAN Plan-10 — Traceability REQ→code→test MVP tests.
|
|
#
|
|
# Proves the matrix is generated from the real requirement document and the gate
|
|
# fails when any FR loses test coverage.
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
|
|
PROJECT_ROOT="$CASAN_APP_ROOT"
|
|
S="$CASAN_HARNESS_ROOT/scripts/bash"
|
|
WORK="$(mktemp -d)"
|
|
trap 'rm -rf "$WORK"' EXIT
|
|
|
|
PASS=0; FAIL=0
|
|
pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
|
|
fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
|
|
|
|
REQ="$PROJECT_ROOT/docs/input/okr-requirement.md"
|
|
MAP="$CASAN_DOMAIN_ROOT/traceability-map.json"
|
|
OUT="$WORK/traceability-matrix.json"
|
|
|
|
echo "===== Plan-10 traceability matrix ====="
|
|
if python3 "$S/traceability-matrix.py" --requirements "$REQ" --map "$MAP" --out "$OUT" --gate >/dev/null 2>"$WORK/pass.err"; then
|
|
pass "complete FR→code→test matrix passes gate"
|
|
else
|
|
cat "$WORK/pass.err"
|
|
fail "complete traceability matrix rejected"
|
|
fi
|
|
|
|
COUNT="$(python3 -c "import json;d=json.load(open('$OUT'));print(d['summary']['requirements'])" 2>/dev/null)"
|
|
FAILED="$(python3 -c "import json;d=json.load(open('$OUT'));print(d['summary']['failed'])" 2>/dev/null)"
|
|
[[ "$COUNT" == "5" && "$FAILED" == "0" ]] \
|
|
&& pass "matrix captures all 5 FRs with zero failures" \
|
|
|| fail "matrix summary unexpected (requirements=$COUNT failed=$FAILED)"
|
|
|
|
BROKEN="$WORK/traceability-map-broken.json"
|
|
python3 - "$MAP" "$BROKEN" <<'PY'
|
|
import json, sys
|
|
d = json.load(open(sys.argv[1]))
|
|
d["FR-04"]["tests"] = []
|
|
json.dump(d, open(sys.argv[2], "w"), indent=2)
|
|
PY
|
|
set +e
|
|
python3 "$S/traceability-matrix.py" --requirements "$REQ" --map "$BROKEN" --out "$WORK/broken.json" --gate >/dev/null 2>"$WORK/broken.err"
|
|
RC=$?
|
|
set -e 2>/dev/null || true
|
|
[[ "$RC" -eq 1 ]] && grep -q "TRACEABILITY_FAIL FR-04" "$WORK/broken.err" \
|
|
&& pass "missing FR test coverage fails the gate" \
|
|
|| fail "missing test coverage did not fail as expected (rc=$RC)"
|
|
|
|
echo ""
|
|
echo "===== Plan-10 symbol/line-level traceability ====="
|
|
# The real map carries symbol refs for FR-01 (AuthService, login); the passing
|
|
# run above wrote $OUT from the real map, so those symbols must resolve.
|
|
SYM_FOUND="$(python3 -c "import json;print(json.load(open('$OUT'))['summary']['symbols_found'])" 2>/dev/null)"
|
|
SYM_MISS="$(python3 -c "import json;print(json.load(open('$OUT'))['summary']['symbols_missing'])" 2>/dev/null)"
|
|
[[ "${SYM_FOUND:-0}" -ge 2 && "${SYM_MISS:-1}" -eq 0 ]] \
|
|
&& pass "real map symbol refs resolved (found=$SYM_FOUND missing=$SYM_MISS)" \
|
|
|| fail "real map symbol refs unexpected (found=$SYM_FOUND missing=$SYM_MISS)"
|
|
|
|
SYMBROKEN="$WORK/map-badsym.json"
|
|
python3 - "$MAP" "$SYMBROKEN" <<'PY'
|
|
import json, sys
|
|
d = json.load(open(sys.argv[1]))
|
|
d["FR-01"]["code"] = [{"file": "backend/src/auth/auth.service.ts", "symbols": ["NoSuchSymbolXYZ"]}]
|
|
json.dump(d, open(sys.argv[2], "w"), indent=2)
|
|
PY
|
|
set +e
|
|
python3 "$S/traceability-matrix.py" --requirements "$REQ" --map "$SYMBROKEN" --out "$WORK/badsym.json" --gate >/dev/null 2>"$WORK/badsym.err"
|
|
RC=$?
|
|
set -e 2>/dev/null || true
|
|
[[ "$RC" -eq 1 ]] && grep -q "missing_symbols=1" "$WORK/badsym.err" \
|
|
&& pass "missing symbol fails the gate (symbol-level)" \
|
|
|| fail "missing symbol did not fail as expected (rc=$RC)"
|
|
|
|
LINEBROKEN="$WORK/map-badline.json"
|
|
python3 - "$MAP" "$LINEBROKEN" <<'PY'
|
|
import json, sys
|
|
d = json.load(open(sys.argv[1]))
|
|
d["FR-01"]["code"] = [{"file": "backend/src/auth/auth.service.ts", "lines": [999999]}]
|
|
json.dump(d, open(sys.argv[2], "w"), indent=2)
|
|
PY
|
|
set +e
|
|
python3 "$S/traceability-matrix.py" --requirements "$REQ" --map "$LINEBROKEN" --out "$WORK/badline.json" --gate >/dev/null 2>"$WORK/badline.err"
|
|
RC=$?
|
|
set -e 2>/dev/null || true
|
|
[[ "$RC" -eq 1 ]] && grep -q "missing_lines=1" "$WORK/badline.err" \
|
|
&& pass "out-of-range line ref fails the gate (line-level)" \
|
|
|| fail "line ref did not fail as expected (rc=$RC)"
|
|
|
|
echo ""
|
|
echo "===== TRACEABILITY SUMMARY: PASS=$PASS FAIL=$FAIL ====="
|
|
[[ "$FAIL" -eq 0 ]] || exit 1
|