feat(casan): establish assurance kernel and harden control plane

packages/casan-harness/kernel/supervision.py

@@ -0,0 +1,42 @@
+"""Runtime supervision capability negotiation without pretending support."""
+
+from __future__ import annotations
+
+from dataclasses import asdict, dataclass
+from datetime import datetime, timezone
+from typing import Any
+
+
+@dataclass(frozen=True)
+class RuntimeCapabilities:
+    canCancel: bool = False
+    canPause: bool = False
+    canResume: bool = False
+    canRollback: bool = False
+    canReduceAuthority: bool = False
+    canQuarantine: bool = False
+
+
+CAPABILITY_FOR_INTERVENTION = {
+    "cancel": "canCancel",
+    "pause": "canPause",
+    "resume": "canResume",
+    "roll_back": "canRollback",
+    "reduce_authority": "canReduceAuthority",
+    "quarantine": "canQuarantine",
+}
+
+
+def negotiate_intervention(intervention_id: str, intervention: str, requested_by: str, capabilities: RuntimeCapabilities) -> dict[str, Any]:
+    capability = CAPABILITY_FOR_INTERVENTION.get(intervention)
+    supported = bool(capability and getattr(capabilities, capability))
+    return {
+        "intervention_id": intervention_id,
+        "type": intervention,
+        "requested_by": requested_by,
+        "status": "pending" if supported else "unsupported",
+        "reason_code": "runtime_intervention_supported_pending_adapter" if supported else "runtime_intervention_unsupported",
+        "required_capability": capability,
+        "runtime_capabilities": asdict(capabilities),
+        "timestamp": datetime.now(timezone.utc).isoformat().replace("+00:00", "Z"),
+    }