feat: harden chat state by tenant

packages/casan-harness/scripts/bash/approval-inbox.py

@@ -13,6 +13,7 @@ import argparse
 import hashlib
 import json
 import os
+import subprocess
 import sys
 from datetime import datetime, timezone
 
@@ -31,6 +32,7 @@ def project_root() -> str:
 
 ROOT = project_root()
 HARNESS_ROOT = os.path.join(ROOT, "packages", "casan-harness")
+TENANT_STORE = os.path.join(HARNESS_ROOT, "scripts", "bash", "tenant-store.sh")
 
 
 def now_iso() -> str:
@@ -38,9 +40,26 @@ def now_iso() -> str:
 
 
 def inbox_path() -> str:
-    return os.environ.get("CASAN_APPROVAL_INBOX_FILE") or os.path.join(
-        ROOT, ".specify", "level5", "approval-inbox.json"
-    )
+    if os.environ.get("CASAN_APPROVAL_INBOX_FILE"):
+        return guarded_override(os.environ["CASAN_APPROVAL_INBOX_FILE"])
+    if os.environ.get("CASAN_TENANT_ID"):
+        return tenant_path("approvals/approval-inbox.json")
+    return os.path.join(ROOT, ".specify", "level5", "approval-inbox.json")
+
+
+def tenant_path(logical: str) -> str:
+    r = subprocess.run(["bash", TENANT_STORE, "resolve", logical], cwd=ROOT, capture_output=True, text=True)
+    if r.returncode != 0:
+        raise SystemExit((r.stderr or r.stdout or "TENANT_DENIED").strip())
+    return r.stdout.strip()
+
+
+def guarded_override(path: str) -> str:
+    if path and os.environ.get("CASAN_TENANT_ID"):
+        r = subprocess.run(["bash", TENANT_STORE, "guard", path], cwd=ROOT, capture_output=True, text=True)
+        if r.returncode != 0:
+            raise SystemExit((r.stderr or r.stdout or "TENANT_DENIED").strip())
+    return path
 
 
 def policy_path() -> str: