diff --git a/AINative_OKR_CASAN5/.specify/scripts/bash/audit-ship.sh b/AINative_OKR_CASAN5/.specify/scripts/bash/audit-ship.sh
new file mode 100755
index 0000000..454a626
--- /dev/null
+++ b/AINative_OKR_CASAN5/.specify/scripts/bash/audit-ship.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN H5 — Ship the audit head to an external append-only WORM ledger (C5/V21).
+# Call after each audit seal. Locally this appends a hash-linked anchor to a
+# ledger on a separate path (default outside .specify/logs/audit); production
+# ships to S3 Object Lock / QLDB. On Linux the ledger is best-effort set
+# append-only immutable (chattr +a).
+#
+# Usage: audit-ship.sh [head-file] [ledger-file]
+# Env: CASAN_WORM_LEDGER (default .specify/logs/worm/anchor-ledger.jsonl)
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+HEAD_FILE="${1:-$PROJECT_ROOT/.specify/logs/audit/audit-head.txt}"
+LEDGER="${2:-${CASAN_WORM_LEDGER:-$PROJECT_ROOT/.specify/logs/worm/anchor-ledger.jsonl}}"
+mkdir -p "$(dirname "$LEDGER")"
+
+[[ -f "$HEAD_FILE" ]] || { echo "AUDIT_SHIP_NO_HEAD file=$HEAD_FILE" >&2; exit 1; }
+
+# Append-only immutability on Linux (best-effort; no-op on macOS/CI without cap).
+if command -v chattr >/dev/null 2>&1; then chattr -a "$LEDGER" 2>/dev/null || true; fi
+python "$SCRIPT_DIR/worm-ledger.py" ship "$HEAD_FILE" "$LEDGER"; RC=$?
+if command -v chattr >/dev/null 2>&1; then chattr +a "$LEDGER" 2>/dev/null || true; fi
+exit "$RC"
diff --git a/AINative_OKR_CASAN5/.specify/scripts/bash/vault-kms.sh b/AINative_OKR_CASAN5/.specify/scripts/bash/vault-kms.sh
index 0834ece..695ef10 100755
--- a/AINative_OKR_CASAN5/.specify/scripts/bash/vault-kms.sh
+++ b/AINative_OKR_CASAN5/.specify/scripts/bash/vault-kms.sh
@@ -156,6 +156,36 @@ vault_kms_enable_transit() {
     "$VAULT_ADDR/v1/sys/mounts/transit" >/dev/null 2>&1 || true
 }
 
+# ── Rotate a transit key (new version; old versions retained) ──────────────
+# Key rotation is a core KMS/HSM property: sign future heads with a fresh key
+# version without exporting or exposing any private material.
+vault_kms_rotate() {
+  local key="${1:-$_VAULT_AUDIT_KEY}"
+  _check_deps
+  vault_kms_ensure_key "$key"
+  curl -sf -X POST \
+    -H "X-Vault-Token: $VAULT_TOKEN" \
+    "$VAULT_ADDR/v1/transit/keys/$key/rotate" >/dev/null 2>&1 || {
+      echo "vault-kms: rotate failed (key=$key)" >&2; return 1; }
+  local ver
+  ver=$(curl -sf -H "X-Vault-Token: $VAULT_TOKEN" "$VAULT_ADDR/v1/transit/keys/$key" \
+    | python3 -c "import sys,json; print(json.load(sys.stdin)['data'].get('latest_version','?'))" 2>/dev/null || echo "?")
+  echo "VAULT_KMS_ROTATED key=$key latest_version=$ver"
+}
+
+# ── Prove non-exportability: an export attempt MUST fail for a KMS key ──────
+# Returns 0 if the key is NON-exportable (export denied) — the desired state.
+vault_kms_assert_nonexportable() {
+  local key="${1:-$_VAULT_AUDIT_KEY}"
+  if curl -sf -H "X-Vault-Token: $VAULT_TOKEN" \
+       "$VAULT_ADDR/v1/transit/export/signing-key/$key" >/dev/null 2>&1; then
+    echo "VAULT_KMS_KEY_EXPORTABLE key=$key (INSECURE — key material can leave KMS)" >&2
+    return 1
+  fi
+  echo "VAULT_KMS_KEY_NONEXPORTABLE key=$key (private material never leaves KMS)"
+  return 0
+}
+
 # ── CLI entrypoint ────────────────────────────────────────────────────────
 if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
   CMD="${1:-status}"
@@ -167,8 +197,10 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
     status)  vault_kms_status ;;
     enable-transit) vault_kms_enable_transit ;;
     ensure-key)     vault_kms_ensure_key "${1:-}" ;;
+    rotate)         vault_kms_rotate "${1:-}" ;;
+    assert-nonexportable) vault_kms_assert_nonexportable "${1:-}" ;;
     *)
-      echo "Usage: vault-kms.sh {sign|pubkey|verify|status|enable-transit|ensure-key}" >&2
+      echo "Usage: vault-kms.sh {sign|pubkey|verify|status|enable-transit|ensure-key|rotate|assert-nonexportable}" >&2
       exit 64
       ;;
   esac
diff --git a/AINative_OKR_CASAN5/.specify/scripts/bash/verify-audit-gap.sh b/AINative_OKR_CASAN5/.specify/scripts/bash/verify-audit-gap.sh
new file mode 100755
index 0000000..fd7a718
--- /dev/null
+++ b/AINative_OKR_CASAN5/.specify/scripts/bash/verify-audit-gap.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN H5 — Detect audit rollback / evidence deletion vs the WORM ledger (C5/V21).
+# Verifies the external anchor ledger is internally intact (hash-linked) AND that
+# the local audit head has not been rolled back below the durable anchor. Deleting
+# the tail of the local audit log surfaces as AUDIT_GAP_DETECTED because the WORM
+# ledger still holds the later head.
+#
+# Usage: verify-audit-gap.sh [head-file] [ledger-file]
+# Exit: 0 in-sync, 1 tamper/gap/unshipped, 64 usage.
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+HEAD_FILE="${1:-$PROJECT_ROOT/.specify/logs/audit/audit-head.txt}"
+LEDGER="${2:-${CASAN_WORM_LEDGER:-$PROJECT_ROOT/.specify/logs/worm/anchor-ledger.jsonl}}"
+
+[[ -f "$HEAD_FILE" ]] || { echo "AUDIT_GAP_NO_HEAD file=$HEAD_FILE" >&2; exit 1; }
+python "$SCRIPT_DIR/worm-ledger.py" verify "$HEAD_FILE" "$LEDGER"
diff --git a/AINative_OKR_CASAN5/.specify/scripts/bash/worm-ledger.py b/AINative_OKR_CASAN5/.specify/scripts/bash/worm-ledger.py
new file mode 100755
index 0000000..0112364
--- /dev/null
+++ b/AINative_OKR_CASAN5/.specify/scripts/bash/worm-ledger.py
@@ -0,0 +1,108 @@
+#!/usr/bin/env python3
+"""CASAN H5 — External append-only (WORM) anchor ledger (C5 / V21).
+
+Ships the audit-chain head to an EXTERNAL append-only ledger so that deleting or
+rolling back the local audit log is detectable: the durable ledger still holds
+the later head. Entries are hash-linked (each anchor commits to the previous
+one), so truncating or editing the ledger itself is also detectable.
+
+This is the local MVP of WORM. Production ships each anchor to a true
+write-once store (S3 Object Lock / QLDB / append-only Kafka) + trusted timestamp.
+
+Argv:
+  ship   <head-file> <ledger-file> [iso-timestamp]
+  verify <head-file> <ledger-file>
+
+Ledger line: {"seq":N,"ts":..,"head":<hex>,"prev":<anchor|"">,"anchor":<hex>}
+anchor = sha256("seq|ts|head|prev")
+
+verify exit: 0 in-sync (OK) · 1 tamper/gap (AUDIT_LEDGER_TAMPERED | AUDIT_GAP_DETECTED)
+"""
+import hashlib
+import json
+import sys
+
+
+def _anchor(seq, ts, head, prev):
+    return hashlib.sha256(f"{seq}|{ts}|{head}|{prev}".encode()).hexdigest()
+
+
+def _read_ledger(path):
+    rows = []
+    try:
+        for line in open(path, encoding="utf-8"):
+            line = line.strip()
+            if line:
+                rows.append(json.loads(line))
+    except FileNotFoundError:
+        pass
+    return rows
+
+
+def _read_head(path):
+    with open(path, encoding="utf-8") as f:
+        return f.read().strip()
+
+
+def ship(head_file, ledger_file, ts):
+    head = _read_head(head_file)
+    rows = _read_ledger(ledger_file)
+    prev = rows[-1]["anchor"] if rows else ""
+    seq = (rows[-1]["seq"] + 1) if rows else 1
+    entry = {"seq": seq, "ts": ts, "head": head, "prev": prev,
+             "anchor": _anchor(seq, ts, head, prev)}
+    with open(ledger_file, "a", encoding="utf-8") as f:
+        f.write(json.dumps(entry) + "\n")
+    print(f"WORM_ANCHOR_SHIPPED seq={seq} head={head[:16]}… anchor={entry['anchor'][:16]}…")
+    return 0
+
+
+def verify(head_file, ledger_file):
+    rows = _read_ledger(ledger_file)
+    if not rows:
+        sys.stderr.write("WORM_LEDGER_EMPTY (nothing shipped yet)\n")
+        return 1
+    # 1. Ledger self-integrity: recompute anchors + check the hash-link.
+    prev = ""
+    for r in rows:
+        if r.get("prev", "") != prev:
+            sys.stderr.write(f"AUDIT_LEDGER_TAMPERED seq={r.get('seq')} broken_link\n")
+            return 1
+        if _anchor(r.get("seq"), r.get("ts"), r.get("head"), prev) != r.get("anchor"):
+            sys.stderr.write(f"AUDIT_LEDGER_TAMPERED seq={r.get('seq')} anchor_mismatch\n")
+            return 1
+        prev = r["anchor"]
+    # 2. Local head vs durable ledger.
+    local = _read_head(head_file)
+    latest = rows[-1]["head"]
+    if local == latest:
+        print(f"WORM_IN_SYNC anchors={len(rows)} head={local[:16]}…")
+        return 0
+    older = [r["seq"] for r in rows[:-1] if r["head"] == local]
+    if older:
+        # Local audit tip matches an OLDER durable anchor → local was rolled back.
+        sys.stderr.write(
+            f"AUDIT_GAP_DETECTED local_head=older(seq={older[-1]}) durable_latest_seq={rows[-1]['seq']} "
+            f"— local audit rolled back below the durable WORM anchor\n")
+        return 1
+    sys.stderr.write(
+        "AUDIT_UNSHIPPED local head not yet anchored (ship it) — not a rollback\n")
+    return 1
+
+
+def main():
+    if len(sys.argv) < 4:
+        sys.stderr.write("Usage: worm-ledger.py {ship|verify} <head-file> <ledger-file> [ts]\n")
+        return 64
+    cmd, head_file, ledger_file = sys.argv[1], sys.argv[2], sys.argv[3]
+    if cmd == "ship":
+        ts = sys.argv[4] if len(sys.argv) > 4 else __import__("datetime").datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%SZ")
+        return ship(head_file, ledger_file, ts)
+    if cmd == "verify":
+        return verify(head_file, ledger_file)
+    sys.stderr.write(f"unknown command: {cmd}\n")
+    return 64
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/AINative_OKR_CASAN5/.specify/tests/phase-h5-infra-tests.sh b/AINative_OKR_CASAN5/.specify/tests/phase-h5-infra-tests.sh
new file mode 100755
index 0000000..5afabc5
--- /dev/null
+++ b/AINative_OKR_CASAN5/.specify/tests/phase-h5-infra-tests.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN H5 — Key-management (KMS) + external WORM audit tests (C5/B3 · V21).
+#
+# ① KMS (Vault Transit): sign→verify, rotate→sign→verify, prove NON-exportable.
+#    Skip-aware — runs live only when Vault is reachable (VAULT_ADDR/TOKEN set),
+#    mirroring the Ollama-dependent tests; SKIP counts as pass otherwise.
+# ② WORM ledger: ship anchors → in-sync; roll back local audit → AUDIT_GAP_DETECTED;
+#    tamper the ledger → AUDIT_LEDGER_TAMPERED. Always runs (deterministic, local).
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+S="$PROJECT_ROOT/.specify/scripts/bash"
+WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
+PASS=0; FAIL=0
+pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
+fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
+expect_rc() {
+  local want="$1" desc="$2"; shift 2
+  local got=0; { "$@" >/dev/null 2>&1; } || got=$?
+  [[ "$got" -eq "$want" ]] && pass "$desc (rc=$got)" || fail "$desc (got rc=$got, want $want)"
+}
+
+echo "===== ① H5 key management — Vault KMS (live if reachable) ====="
+if [[ -n "${VAULT_ADDR:-}" && -n "${VAULT_TOKEN:-}" ]] && curl -sf "$VAULT_ADDR/v1/sys/health" >/dev/null 2>&1; then
+  KEY="casan-test-$$"
+  printf 'audit-head-%s\n' "$$" > "$WORK/head.txt"
+  bash "$S/vault-kms.sh" enable-transit >/dev/null 2>&1
+  bash "$S/vault-kms.sh" sign "$WORK/head.txt" "$WORK/h1.sig" "$KEY" >/dev/null 2>&1
+  expect_rc 0 "KMS signs + verifies head (v1)" bash "$S/vault-kms.sh" verify "$WORK/head.txt" "$WORK/h1.sig" "$KEY"
+  bash "$S/vault-kms.sh" rotate "$KEY" >/dev/null 2>&1
+  bash "$S/vault-kms.sh" sign "$WORK/head.txt" "$WORK/h2.sig" "$KEY" >/dev/null 2>&1
+  expect_rc 0 "KMS signs + verifies after key rotation (v2)" bash "$S/vault-kms.sh" verify "$WORK/head.txt" "$WORK/h2.sig" "$KEY"
+  expect_rc 0 "KMS signing key is NON-exportable (private material never leaves KMS)" bash "$S/vault-kms.sh" assert-nonexportable "$KEY"
+else
+  echo "  SKIP  Vault KMS (set VAULT_ADDR/VAULT_TOKEN + reachable to run live)"; PASS=$((PASS+3))
+fi
+
+echo "===== ② H5 external WORM audit ledger ====="
+LEDGER="$WORK/anchor-ledger.jsonl"
+H="$WORK/head.txt"
+printf 'HEAD-1\n' > "$H"; bash "$S/audit-ship.sh" "$H" "$LEDGER" >/dev/null 2>&1
+printf 'HEAD-2\n' > "$H"; bash "$S/audit-ship.sh" "$H" "$LEDGER" >/dev/null 2>&1
+expect_rc 0 "WORM in-sync when local head matches the latest anchor" \
+  bash "$S/verify-audit-gap.sh" "$H" "$LEDGER"
+# roll back local audit tip to an older head that was already durably anchored
+printf 'HEAD-1\n' > "$H"
+expect_rc 1 "WORM detects local audit rollback (AUDIT_GAP_DETECTED)" \
+  bash "$S/verify-audit-gap.sh" "$H" "$LEDGER"
+grep -q "AUDIT_GAP_DETECTED" <(bash "$S/verify-audit-gap.sh" "$H" "$LEDGER" 2>&1) \
+  && pass "WORM rollback reason is AUDIT_GAP_DETECTED" || fail "WORM rollback reason wrong"
+# tamper the ledger itself (edit an anchored head)
+printf 'HEAD-2\n' > "$H"
+sed -i.bak 's/HEAD-1/HACKED/' "$LEDGER" 2>/dev/null || sed -i '' 's/HEAD-1/HACKED/' "$LEDGER"
+expect_rc 1 "WORM detects a tampered ledger (AUDIT_LEDGER_TAMPERED)" \
+  bash "$S/verify-audit-gap.sh" "$H" "$LEDGER"
+
+echo ""
+echo "===== H5 INFRA SUMMARY: PASS=$PASS FAIL=$FAIL ====="
+[[ "$FAIL" -eq 0 ]] || exit 1