thanhnvandClaude Opus 4.8
8450f8ca1a
Adopt CASAN like a normal tool (codegraph-style): install the harness ONCE
per machine, then `casan init` per project writes CONFIG ONLY — the harness
is no longer copied into every repo.
- install.sh / install.ps1: global bootstrap (curl|sh / irm|iex or local
source). Installs harness to $CASAN_HOME/versions/<ver>, writes a `casan`
launcher that resolves the shared harness + the current project's .specify,
and records a gate-code integrity hash. CASAN_NO_PATH_LINK for tests.
- harness_hash.py: deterministic content hash over gate code (scripts/bash,
scripts/python, security, level5) — the pin+verify anchor.
- casan-init.py: `casan init` writes .casan/{config,version.lock,agentic.env},
.specify/ marker, and the Plan-20 client hooks — no harness copy. `verify`
recomputes the harness hash LIVE and compares to the project pin (drift/
tamper -> rc 3), preserving the Plan-16 trusted-gates guarantee off-repo.
- bin/casan: new `init` and `verify-harness` commands.
- hybrid-install-tests.sh: 21/21 (install, config-only init, no-copy, pin,
verify ok, tamper drift, bridge runs against project state via global harness).
- docs: CASAN_INSTALL_HYBRID.md + Plan-21.
The path model (casan-paths.sh) already separated harness/state/domain roots,
so this is installer + init, not a core rewrite. Remote dist tarball, real
Windows run, and signed .harness-hash are the documented next steps.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
casan-harness (package skeleton)
Core CASAN harness (gate H1→H7) as a reusable package, independent of domain data.
Populated incrementally by Plan-01 (Phase 0→6). During migration, files move here from
.specify/ wave-by-wave; the full harness gate must stay green (PASS=64 FAIL=0) after each phase.
Layout:
scripts/— bash + powershell gate logic (H1→H7), path resolvercasan-paths.shsecurity/— filter/policy rules (prompt-filter, pii-rules, output-policy, ...)governance/,agentops/— H5/H6 codelevel5/— L5 config (drift/kpi/model-fallback/tool-registry YAMLs)templates/,config/— spec/plan templates, loop-policytests/— reproducible harness test suites + integrity manifest
Runtime state (logs, audit chain, tenant state) is NOT part of this package — it stays with
the app under CASAN_STATE_ROOT. Domain data (golden-runs, corpus, input) lives in
apps/okr/domain/ under CASAN_DOMAIN_ROOT.