thanhnvandClaude Opus 4.8
f6d28a3163
Wide-deployment Windows path without WSL2. The agentic bridge already runs on native Python + PowerShell; the only bash dependency is the H4/H2 gate scripts, which run under Git Bash (Git for Windows) — much lighter than WSL2. - h4_scan now returns a status (ok|blocked|timeout|unavailable). Timeout stays FAIL-CLOSED (block/deny). "unavailable" (no bash / gate missing) DEGRADES the turn to observed_only and does NOT block the developer — never silently certifies without a working gate. - bash interpreter is configurable via CASAN_AGENTIC_BASH; gates use it. - doctor reports bash_available / gates_runnable + a remediation warning, and stays green (degraded, not failed) when bash is absent. - tests: +4 no-bash cases (degrade to observed_only, tool still allowed, non-certified finalize, injection still blocked when bash present). 34/34. - docs: Windows guide + security guide now point to Git Bash, not WSL2, and document the timeout-vs-unavailable distinction. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
casan-harness (package skeleton)
Core CASAN harness (gate H1→H7) as a reusable package, independent of domain data.
Populated incrementally by Plan-01 (Phase 0→6). During migration, files move here from
.specify/ wave-by-wave; the full harness gate must stay green (PASS=64 FAIL=0) after each phase.
Layout:
scripts/— bash + powershell gate logic (H1→H7), path resolvercasan-paths.shsecurity/— filter/policy rules (prompt-filter, pii-rules, output-policy, ...)governance/,agentops/— H5/H6 codelevel5/— L5 config (drift/kpi/model-fallback/tool-registry YAMLs)templates/,config/— spec/plan templates, loop-policytests/— reproducible harness test suites + integrity manifest
Runtime state (logs, audit chain, tenant state) is NOT part of this package — it stays with
the app under CASAN_STATE_ROOT. Domain data (golden-runs, corpus, input) lives in
apps/okr/domain/ under CASAN_DOMAIN_ROOT.