thanhnvandClaude Opus 4.8
f2ea5590b1
Separate per-project domain data from the reusable harness so packages/casan-harness
holds no domain artifacts. Domain data physically relocated to apps/okr/domain, with
compat symlinks at the old paths (Python + app + evidence-log refs keep resolving).
Moved -> apps/okr/domain (+ compat symlink at old path):
golden-runs/ (was .specify/level5/golden-runs)
corpus/{redteam-corpus.jsonl,redteam-vectors.jsonl,benign-corpus/}
(was packages/casan-harness/security/*)
traceability-map.json (was .specify/traceability-map.json)
input/ (was docs/input — OKR requirement/architecture)
casan-paths.sh: add CASAN_DOMAIN_ROOT (apps/okr/domain; env-overridable so Plan-06 can
point a second app at its own domain; falls back to .specify pre-split).
Harness bash refs repointed to $CASAN_DOMAIN_ROOT: run-casan4 (golden), phase3-redteam
(corpus), phase-h4-multilingual/split-inject (benign-corpus), phase10-traceability (map),
benign-fp-report (corpus+vectors). Python + app refs still resolve via the compat
symlinks (repointed in Phase 4 when the symlinks are removed).
Full gate: PASS=64 FAIL=0 SKIP=3 (CASAN_CI_STEP_TIMEOUT_SEC=1200). A first gate run
crawled under host load avg ~30 (Ollama + system); re-run at lower load passed clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
96 lines
3.9 KiB
Bash
Executable File
96 lines
3.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -uo pipefail
|
|
|
|
# CASAN Plan-10 — Traceability REQ→code→test MVP tests.
|
|
#
|
|
# Proves the matrix is generated from the real requirement document and the gate
|
|
# fails when any FR loses test coverage.
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
|
|
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
|
|
S="$CASAN_HARNESS_ROOT/scripts/bash"
|
|
WORK="$(mktemp -d)"
|
|
trap 'rm -rf "$WORK"' EXIT
|
|
|
|
PASS=0; FAIL=0
|
|
pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
|
|
fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
|
|
|
|
REQ="$PROJECT_ROOT/docs/input/okr-requirement.md"
|
|
MAP="$CASAN_DOMAIN_ROOT/traceability-map.json"
|
|
OUT="$WORK/traceability-matrix.json"
|
|
|
|
echo "===== Plan-10 traceability matrix ====="
|
|
if python3 "$S/traceability-matrix.py" --requirements "$REQ" --map "$MAP" --out "$OUT" --gate >/dev/null 2>"$WORK/pass.err"; then
|
|
pass "complete FR→code→test matrix passes gate"
|
|
else
|
|
cat "$WORK/pass.err"
|
|
fail "complete traceability matrix rejected"
|
|
fi
|
|
|
|
COUNT="$(python3 -c "import json;d=json.load(open('$OUT'));print(d['summary']['requirements'])" 2>/dev/null)"
|
|
FAILED="$(python3 -c "import json;d=json.load(open('$OUT'));print(d['summary']['failed'])" 2>/dev/null)"
|
|
[[ "$COUNT" == "5" && "$FAILED" == "0" ]] \
|
|
&& pass "matrix captures all 5 FRs with zero failures" \
|
|
|| fail "matrix summary unexpected (requirements=$COUNT failed=$FAILED)"
|
|
|
|
BROKEN="$WORK/traceability-map-broken.json"
|
|
python3 - "$MAP" "$BROKEN" <<'PY'
|
|
import json, sys
|
|
d = json.load(open(sys.argv[1]))
|
|
d["FR-04"]["tests"] = []
|
|
json.dump(d, open(sys.argv[2], "w"), indent=2)
|
|
PY
|
|
set +e
|
|
python3 "$S/traceability-matrix.py" --requirements "$REQ" --map "$BROKEN" --out "$WORK/broken.json" --gate >/dev/null 2>"$WORK/broken.err"
|
|
RC=$?
|
|
set -e 2>/dev/null || true
|
|
[[ "$RC" -eq 1 ]] && grep -q "TRACEABILITY_FAIL FR-04" "$WORK/broken.err" \
|
|
&& pass "missing FR test coverage fails the gate" \
|
|
|| fail "missing test coverage did not fail as expected (rc=$RC)"
|
|
|
|
echo ""
|
|
echo "===== Plan-10 symbol/line-level traceability ====="
|
|
# The real map carries symbol refs for FR-01 (AuthService, login); the passing
|
|
# run above wrote $OUT from the real map, so those symbols must resolve.
|
|
SYM_FOUND="$(python3 -c "import json;print(json.load(open('$OUT'))['summary']['symbols_found'])" 2>/dev/null)"
|
|
SYM_MISS="$(python3 -c "import json;print(json.load(open('$OUT'))['summary']['symbols_missing'])" 2>/dev/null)"
|
|
[[ "${SYM_FOUND:-0}" -ge 2 && "${SYM_MISS:-1}" -eq 0 ]] \
|
|
&& pass "real map symbol refs resolved (found=$SYM_FOUND missing=$SYM_MISS)" \
|
|
|| fail "real map symbol refs unexpected (found=$SYM_FOUND missing=$SYM_MISS)"
|
|
|
|
SYMBROKEN="$WORK/map-badsym.json"
|
|
python3 - "$MAP" "$SYMBROKEN" <<'PY'
|
|
import json, sys
|
|
d = json.load(open(sys.argv[1]))
|
|
d["FR-01"]["code"] = [{"file": "backend/src/auth/auth.service.ts", "symbols": ["NoSuchSymbolXYZ"]}]
|
|
json.dump(d, open(sys.argv[2], "w"), indent=2)
|
|
PY
|
|
set +e
|
|
python3 "$S/traceability-matrix.py" --requirements "$REQ" --map "$SYMBROKEN" --out "$WORK/badsym.json" --gate >/dev/null 2>"$WORK/badsym.err"
|
|
RC=$?
|
|
set -e 2>/dev/null || true
|
|
[[ "$RC" -eq 1 ]] && grep -q "missing_symbols=1" "$WORK/badsym.err" \
|
|
&& pass "missing symbol fails the gate (symbol-level)" \
|
|
|| fail "missing symbol did not fail as expected (rc=$RC)"
|
|
|
|
LINEBROKEN="$WORK/map-badline.json"
|
|
python3 - "$MAP" "$LINEBROKEN" <<'PY'
|
|
import json, sys
|
|
d = json.load(open(sys.argv[1]))
|
|
d["FR-01"]["code"] = [{"file": "backend/src/auth/auth.service.ts", "lines": [999999]}]
|
|
json.dump(d, open(sys.argv[2], "w"), indent=2)
|
|
PY
|
|
set +e
|
|
python3 "$S/traceability-matrix.py" --requirements "$REQ" --map "$LINEBROKEN" --out "$WORK/badline.json" --gate >/dev/null 2>"$WORK/badline.err"
|
|
RC=$?
|
|
set -e 2>/dev/null || true
|
|
[[ "$RC" -eq 1 ]] && grep -q "missing_lines=1" "$WORK/badline.err" \
|
|
&& pass "out-of-range line ref fails the gate (line-level)" \
|
|
|| fail "line ref did not fail as expected (rc=$RC)"
|
|
|
|
echo ""
|
|
echo "===== TRACEABILITY SUMMARY: PASS=$PASS FAIL=$FAIL ====="
|
|
[[ "$FAIL" -eq 0 ]] || exit 1
|