thanhnvandClaude Opus 4.8
4bb184b935
Wave 0 + Wave 1 core of the transparent agentic-client integration: a
developer types prompts normally in Claude Code / Codex while every
certified turn still carries a full H1->H7 trace and an H6 record.
- agentic_bridge.py: stdlib-only lifecycle state machine (begin/pre-tool/
post-tool/telemetry/finalize/abort + report/doctor). Single-model
invariant (never calls a model), fail-closed at the side-effect point,
admission TTL + canonical-project/session binding, atomic state under
.specify/state/agentic-sessions/, secret redaction, null-not-zero H6.
- agentic-lifecycle.schema.json: client-agnostic JSON contract.
- adapters/claude-code + adapters/codex: thin hook renderers + config
templates that call the core bridge.
- phase-agentic-bridge-tests.sh: C1-C12 acceptance + threat suite (30/30).
- devkit templates/{claude,codex} + windows/install-agentic.ps1
(install/doctor/uninstall with manifest, path-safe).
- docs/casan Windows + security/bypass guides; plan status -> IMPLEMENTED.
- harden generate-agentops-dashboard.py aggregation against null H6 costs.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
CASAN DevKit (Level 2 — Adoption Kit)
Everything a new project needs to adopt the CASAN governance harness in a repeatable way. Level 2 = Level 1 core harness + adoption tooling.
Contents
| Path | Purpose |
|---|---|
install.sh |
Install core harness + bin/casan into a target repo, scaffold a domain, register it |
project-scaffold.py |
Create an idempotent production NestJS/React monorepo shell with manifest, CI, Docker and harness |
Dockerfile.harness |
Minimal image to run the gate on any mounted repo (casan gate) |
templates/domain-pack/ |
Per-project domain scaffold (input / golden-runs / corpus / domain-pack.yaml) |
templates/gitea-workflow/ci.yml |
Reusable Gitea Actions gate workflow |
templates/project-shell/nestjs-react/ |
Buildable/tested production project shell |
schemas/project-manifest.schema.json |
Versioned multi-project execution contract |
quality-profiles/enterprise-web-v1.json |
Shared quality floor and command allowlist |
Create a new production shell
packages/casan-devkit/install.sh \
--target ../my-project \
--project ticketing \
--domain "Ticketing" \
--template nestjs-react
cd ../my-project
npm install
bin/casan project validate --manifest apps/ticketing/domain/project.manifest.json
bin/casan pipeline --manifest apps/ticketing/domain/project.manifest.json --dry-run
npm test && npm run build
The operation is fail-closed and idempotent: identical files are retained; a different existing file aborts the run and is never overwritten. No generated command is passed through a shell.
Quick adopt
# from a CASAN source hub or an extracted casan-devkit bundle
packages/casan-devkit/install.sh --target ../my-project --project ticketing --domain "Ticketing"
cd ../my-project
# add requirement + golden baseline under apps/ticketing/domain/, then:
CASAN_DOMAIN_ROOT=apps/ticketing/domain bin/casan gate
bin/casan reuse # HARNESS_REUSE_VALID
Guides
docs/packaging/ADOPTION_GUIDE.md— end-to-end adoptiondocs/packaging/DOMAIN_PACK_GUIDE.md— how to fill a domain packdocs/packaging/CI_GUIDE.md— wire the gate into Gitea CIdocs/packaging/DOCKER_GUIDE.md— run/build the harness image
Adoption of an existing repository is config + domain only. New repositories can additionally use the production project-shell template. In both modes, adopters never edit gate logic (H1→H7).