Files

T

thanhnvandClaude Opus 4.8 8c20cfde9f feat(packaging): level-based source hub — Core + DevKit packaging, Platform/Enterprise scaffold

Organize CASAN as a reusable source hub with SPLIT releases so downstream adopts only the
level it needs (packaging/levels.json is the single source of truth).

Implemented now:
- Level 1 Core: bin/casan CLI (run/gate/test/verify/reuse/dashboard) + VERSION.
- Level 2 DevKit: packages/casan-devkit (install.sh, Dockerfile.harness, templates:
  project scaffold, domain-pack, gitea-workflow).
- scripts/package-release.sh core|devkit|platform|all-in-one-demo — builds split bundles
  into dist/ (BUNDLE-MANIFEST + SHA256SUMS); platform is stamped PREVIEW/INCOMPLETE;
  enterprise (future) is REFUSED (exit 3, no fake-complete package). Bundles verified:
  extract → bin/casan works, deterministic + domain suites pass, casan reuse VALID.
- docs/packaging: CASAN_PACKAGING_PLAN + ADOPTION + CI + DOMAIN_PACK + GITEA_PACKAGE + DOCKER.

Structure + docs only:
- Level 3 packages/casan-platform (dashboard exists; control-panel/viewers pending).
- Level 4 packages/casan-enterprise (RBAC/tenant/KMS/WORM/approval exist in core; governed
  console pending). No Chat Console/RBAC-console/tenant-console/model-mgmt built in this task.

Harness change (enables extracted bundles to self-resolve): casan-paths.sh + the Python
project_root() walk-ups now accept a second root marker `packages/casan-harness` in addition
to `.specify`, so a freshly-unpacked core/devkit/demo bundle (no `.specify` yet) roots
correctly and creates state on first run. In an adopted repo `.specify` still matches first.
policy-bundle.yaml paths corrected to packages/casan-harness (re-signed). Full gate 64/0/3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-08 15:55:37 +09:00

2.1 KiB

Raw Blame History

CASAN Docker Guide

Run the CASAN governance harness as a container against any mounted repo — no install into the target project.

Image: `casan-harness` (Level 1/2)

Dockerfile: packages/casan-devkit/Dockerfile.harness. Minimal Debian + bash + python3 + openssl + git. Ships the core harness + bin/casan.

Build

V=$(cat VERSION)
docker build -f packages/casan-devkit/Dockerfile.harness -t casan-harness:$V .

Run the gate on a project

docker run --rm -v "$PWD":/workspace -w /workspace casan-harness:1.0.0 gate
# (ENTRYPOINT is `casan`, so the CMD is a casan subcommand)
docker run --rm -v "$PWD":/workspace casan-harness:1.0.0 reuse
docker run --rm -v "$PWD":/workspace casan-harness:1.0.0 \
  run in.txt out.txt my_step -- echo hello

The harness inside the image lives at /opt/casan (CASAN_HARNESS_ROOT preset); your project is mounted at /workspace. Domain data is read from the mounted repo (apps/<project>/domain via CASAN_DOMAIN_ROOT).

With a domain root

docker run --rm -v "$PWD":/workspace -w /workspace \
  -e CASAN_DOMAIN_ROOT=apps/ticketing/domain casan-harness:1.0.0 gate

Notes

State (.specify/logs, audit) is written under /workspace (your mounted repo), so it persists on the host and is inspectable after the run.
Enforced mode: add -e CASAN_PROFILE=prod (or -e CASAN_VERIFY_STRICT=1) to make missing signatures fail-closed.
No app runtime: this image runs the harness, not the OKR app. For the app, use the project's own Dockerfile.backend / Dockerfile.frontend + docker-compose.prod.yml.

Other images

Image	Status	Notes
`casan-harness:X.Y.Z`	✅	this guide
`casan-platform:X.Y.Z`	🟡 preview	dashboard only today; build from platform preview when needed
`casan-enterprise:X.Y.Z`	📋 future	not built — governed console does not exist yet

Publish to Gitea container registry

See GITEA_PACKAGE_GUIDE.md §3 (docker login + docker push to the Gitea registry).

2.1 KiB Raw Blame History