feat: update plan 16 sec14-26

AINative_OKR_CASAN5/.specify/scripts/bash/casan-harness.sh

@@ -23,6 +23,11 @@ fi
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+# SEC-23 (MT-01): make state (control-plane settings, telemetry, audit) tenant-scoped
+# when CASAN_TENANT_ID is set, so a run for tenant A never touches tenant B's state.
+# No-op when no tenant is set (baseline unchanged); invalid tenant fails closed.
+# shellcheck source=tenant-paths.sh
+source "$SCRIPT_DIR/tenant-paths.sh"
 TMP_DIR="$PROJECT_ROOT/.specify/logs/tmp"
 CACHE_DIR="$PROJECT_ROOT/.specify/logs/idempotency"
 mkdir -p "$TMP_DIR" "$CACHE_DIR" "$(dirname "$FINAL_OUTPUT")"
@@ -95,6 +100,15 @@ if [[ "${CASAN_KILLSWITCH_ENFORCE:-0}" == "1" || ( -z "${CASAN_KILLSWITCH_ENFORC
     echo "KILL_SWITCH_ACTIVE scope=$KS_SCOPE id=$KS_ID action=$ACTION_NAME" >&2
     exit 2
   fi
+  # SEC-23 (MT-03): a tenant-scoped switch halts ONLY its own tenant (noisy-neighbor
+  # isolation) — tenant A's emergency stop must not stop tenant B.
+  if [[ -n "${CASAN_TENANT_ID:-}" ]] \
+     && ! bash "$SCRIPT_DIR/kill-switch.sh" check tenant "$CASAN_TENANT_ID" >/dev/null 2>&1; then
+    casan_log error harness "KILL_SWITCH_ACTIVE scope=tenant id=$CASAN_TENANT_ID — refusing to run $ACTION_NAME"
+    : > "$FINAL_OUTPUT"
+    echo "KILL_SWITCH_ACTIVE scope=tenant id=$CASAN_TENANT_ID action=$ACTION_NAME" >&2
+    exit 2
+  fi
 fi
 
 # SEC-16 (ARCH-01): in enforced mode, verify the harness+policy bundle against its