feat(casan): establish assurance kernel and harden control plane

packages/casan-harness/scripts/bash/sign-audit-head.sh

@@ -45,14 +45,24 @@ with open(path, encoding="utf-8") as f:
         if not line.strip():
             continue
         record = json.loads(line)
-        core = "|".join([
-            record.get("timestamp",""), record.get("trace_id",""),
-            record.get("action",""), record.get("actor",""),
-            record.get("risk_level",""), record.get("decision",""),
-            record.get("approval_status",""), record.get("approver",""),
-            record.get("input_hash",""), record.get("output_hash",""),
-            previous,
-        ])
+        if int(record.get("schema_version", 1)) >= 2:
+            core = "|".join([
+                record.get("timestamp",""), record.get("trace_id",""),
+                record.get("action",""), record.get("action_class",""),
+                record.get("actor",""), record.get("risk_level",""),
+                json.dumps(record.get("risk_factors", {}), sort_keys=True, separators=(",", ":")),
+                record.get("evidence_requirement",""), record.get("decision",""),
+                record.get("approval_status",""), record.get("approver",""),
+                record.get("input_hash",""), record.get("output_hash",""), previous,
+            ])
+        else:
+            core = "|".join([
+                record.get("timestamp",""), record.get("trace_id",""),
+                record.get("action",""), record.get("actor",""),
+                record.get("risk_level",""), record.get("decision",""),
+                record.get("approval_status",""), record.get("approver",""),
+                record.get("input_hash",""), record.get("output_hash",""), previous,
+            ])
         previous = hashlib.sha256(core.encode()).hexdigest()
 print(previous)
 PY
@@ -68,6 +78,10 @@ printf '%s' "$HEAD_HASH" > "$HEAD_FILE"
 # ── Sign the head file ────────────────────────────────────────────────────
 VAULT_KMS="$SCRIPT_DIR/vault-kms.sh"
 
+if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_PROFILE:-}" == "production" || "${CASAN_PROFILE:-}" == "strict" ]]; then
+  [[ "${VAULT_ADDR:-}" == https://* ]] || { echo "SIGN_AUDIT_HEAD_FAIL reason=vault_https_required_in_prod" >&2; exit 1; }
+fi
+
 if [[ -n "${VAULT_ADDR:-}" && -n "${VAULT_TOKEN:-}" ]] && \
    curl -sf "$VAULT_ADDR/v1/sys/health" >/dev/null 2>&1; then
   # KMS path — sign via Vault Transit, export public key
@@ -103,7 +117,7 @@ PY
   fi
 else
   # Fallback — local key (dev environment without Vault)
-  if [[ "${CASAN_PROFILE:-}" == "prod" ]]; then
+  if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_PROFILE:-}" == "production" || "${CASAN_PROFILE:-}" == "strict" ]]; then
     echo "SIGN_AUDIT_HEAD_FAIL reason=vault_kms_required_in_prod" >&2
     exit 1
   fi