feat: update plan 16 sec14-26

AINative_OKR_CASAN5/.specify/scripts/bash/cost-spike-detect.sh

@@ -20,7 +20,17 @@ set -uo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
-LOG="${1:-$PROJECT_ROOT/.specify/logs/level5/provider-usage.jsonl}"
+# SEC-23 (MT-03): per-tenant cost/quota. With no explicit log arg, a tenant run
+# evaluates its OWN usage log so one tenant's spend never counts against another's
+# budget (noisy-neighbor isolation). No tenant set -> the shared default log.
+if [[ -n "${1:-}" ]]; then
+  LOG="$1"
+elif [[ -n "${CASAN_TENANT_ID:-}" ]]; then
+  LOG="$(bash "$SCRIPT_DIR/tenant-store.sh" resolve telemetry/provider-usage.jsonl 2>/dev/null)" \
+    || { echo "COST_SPIKE_TENANT_DENIED" >&2; exit 3; }
+else
+  LOG="$PROJECT_ROOT/.specify/logs/level5/provider-usage.jsonl"
+fi
 MULT="${2:-3.0}"
 
 [[ -f "$LOG" ]] || { echo "COST_SPIKE_NO_DATA file=$LOG" >&2; exit 3; }