feat: update plan 16 sec14-26

AINative_OKR_CASAN5/.specify/scripts/bash/control-plane-settings.py

@@ -44,11 +44,31 @@ def project_root() -> str:
     return os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", ".."))
 
 
+def _tenant_id():
+    # SEC-23 (MT-01): when a tenant id is set, the settings store (and its embedded
+    # audit hash-chain) is partitioned per tenant so tenant A cannot read/modify
+    # tenant B's governance state. An invalid id fails closed.
+    import re
+    t = os.environ.get("CASAN_TENANT_ID", "").strip()
+    if not t:
+        return None
+    if not re.fullmatch(r"[A-Za-z0-9_-]+", t):
+        raise SystemExit("CP_DENY tenant_id_invalid")
+    return t
+
+
 def store_path() -> str:
-    return os.environ.get(
-        "CASAN_CP_STORE_FILE",
-        os.path.join(project_root(), ".specify/level5/control-plane-settings.json"),
-    )
+    explicit = os.environ.get("CASAN_CP_STORE_FILE")
+    if explicit:
+        return explicit
+    tenant = _tenant_id()
+    if tenant:
+        base = os.environ.get(
+            "CASAN_TENANT_STATE_ROOT",
+            os.path.join(project_root(), ".specify/state/tenants"),
+        )
+        return os.path.join(base, tenant, "control-plane", "settings.json")
+    return os.path.join(project_root(), ".specify/level5/control-plane-settings.json")
 
 
 def now_iso() -> str: