Add REAL=1 to the video-steps demo so attack vectors flow through the real
production entry-point instead of calling sub-scripts directly.
- run-all.sh: REAL=1 feeds each H4 vector (A1/A2/A4/A6/A7 + cross-layer step
1) as the INPUT of an agent step run through casan-harness.sh, so the
BLOCK/PASS verdict is produced by the wrapper itself (H4-in -> H5 -> H6 ->
exec -> H4-out) exactly as when the real pipeline meets malicious input.
After the battery it runs a real pipeline slice (STEP1 okr.srs via
casan-harness.sh -- node casan-step.mjs) and shows audit.jsonl growing by a
real record. An inline inventory documents which vectors intentionally keep
calling a single control directly (artifact-scan, audit tamper/re-forge,
detectors on synthetic telemetry) and why. Default mode (no REAL) unchanged.
- map-live.sh: show the PIPELINE (STEP1) row only under REAL=1, driven by a
mode sidecar file written by run-all.sh.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
