thanhnvandClaude Opus 4.8
8450f8ca1a
Adopt CASAN like a normal tool (codegraph-style): install the harness ONCE
per machine, then `casan init` per project writes CONFIG ONLY — the harness
is no longer copied into every repo.
- install.sh / install.ps1: global bootstrap (curl|sh / irm|iex or local
source). Installs harness to $CASAN_HOME/versions/<ver>, writes a `casan`
launcher that resolves the shared harness + the current project's .specify,
and records a gate-code integrity hash. CASAN_NO_PATH_LINK for tests.
- harness_hash.py: deterministic content hash over gate code (scripts/bash,
scripts/python, security, level5) — the pin+verify anchor.
- casan-init.py: `casan init` writes .casan/{config,version.lock,agentic.env},
.specify/ marker, and the Plan-20 client hooks — no harness copy. `verify`
recomputes the harness hash LIVE and compares to the project pin (drift/
tamper -> rc 3), preserving the Plan-16 trusted-gates guarantee off-repo.
- bin/casan: new `init` and `verify-harness` commands.
- hybrid-install-tests.sh: 21/21 (install, config-only init, no-copy, pin,
verify ok, tamper drift, bridge runs against project state via global harness).
- docs: CASAN_INSTALL_HYBRID.md + Plan-21.
The path model (casan-paths.sh) already separated harness/state/domain roots,
so this is installer + init, not a core rewrite. Remote dist tarball, real
Windows run, and signed .harness-hash are the documented next steps.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
CASAN DevKit (Level 2 — Adoption Kit)
Everything a new project needs to adopt the CASAN governance harness in a repeatable way. Level 2 = Level 1 core harness + adoption tooling.
Contents
| Path | Purpose |
|---|---|
install.sh |
Install core harness + bin/casan into a target repo, scaffold a domain, register it |
project-scaffold.py |
Create an idempotent production NestJS/React monorepo shell with manifest, CI, Docker and harness |
Dockerfile.harness |
Minimal image to run the gate on any mounted repo (casan gate) |
templates/domain-pack/ |
Per-project domain scaffold (input / golden-runs / corpus / domain-pack.yaml) |
templates/gitea-workflow/ci.yml |
Reusable Gitea Actions gate workflow |
templates/project-shell/nestjs-react/ |
Buildable/tested production project shell |
schemas/project-manifest.schema.json |
Versioned multi-project execution contract |
quality-profiles/enterprise-web-v1.json |
Shared quality floor and command allowlist |
Create a new production shell
packages/casan-devkit/install.sh \
--target ../my-project \
--project ticketing \
--domain "Ticketing" \
--template nestjs-react
cd ../my-project
npm install
bin/casan project validate --manifest apps/ticketing/domain/project.manifest.json
bin/casan pipeline --manifest apps/ticketing/domain/project.manifest.json --dry-run
npm test && npm run build
The operation is fail-closed and idempotent: identical files are retained; a different existing file aborts the run and is never overwritten. No generated command is passed through a shell.
Quick adopt
# from a CASAN source hub or an extracted casan-devkit bundle
packages/casan-devkit/install.sh --target ../my-project --project ticketing --domain "Ticketing"
cd ../my-project
# add requirement + golden baseline under apps/ticketing/domain/, then:
CASAN_DOMAIN_ROOT=apps/ticketing/domain bin/casan gate
bin/casan reuse # HARNESS_REUSE_VALID
Guides
docs/packaging/ADOPTION_GUIDE.md— end-to-end adoptiondocs/packaging/DOMAIN_PACK_GUIDE.md— how to fill a domain packdocs/packaging/CI_GUIDE.md— wire the gate into Gitea CIdocs/packaging/DOCKER_GUIDE.md— run/build the harness image
Adoption of an existing repository is config + domain only. New repositories can additionally use the production project-shell template. In both modes, adopters never edit gate logic (H1→H7).