Complete CASAN backlog tier 1 controls

AINative_OKR_CASAN5/.specify/scripts/bash/evidence-pack-build.py

@@ -18,6 +18,7 @@ skipped (missing evidence => not certified, with the reason recorded).
 import hashlib
 import json
 import os
+import subprocess
 import sys
 
 
@@ -75,6 +76,25 @@ def main():
         "judge_gate_tests": os.path.exists(os.path.join(root, ".specify/tests/phase3-judge-gate-tests.sh")),
         "note": "judge-gate fail-before/fix cycle proven by phase3-judge-gate-tests.sh",
     }
+    traceability_out = os.path.join(pack_dir, "traceability-matrix.json")
+    traceability_script = os.path.join(root, ".specify/scripts/bash/traceability-matrix.py")
+    traceability_rc = 1
+    if os.path.isfile(traceability_script):
+        traceability_rc = subprocess.run(
+            [
+                sys.executable,
+                traceability_script,
+                "--requirements",
+                os.path.join(root, "docs/input/okr-requirement.md"),
+                "--map",
+                os.path.join(root, ".specify/traceability-map.json"),
+                "--out",
+                traceability_out,
+                "--gate",
+            ],
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        ).returncode
 
     # H4 security
     sec_rows = read_jsonl(os.path.join(logs, "audit", "security.jsonl"))
@@ -151,6 +171,8 @@ def main():
         reasons.append("unresolved_cost_spike")
     if len(sec_rows) == 0:
         reasons.append("h4_security_not_exercised")
+    if traceability_rc != 0:
+        reasons.append("traceability_gate_failed")
     fp_ok = bool(fp) and fp.get("within_budget") is True
     if fp is None:
         reasons.append("benign_fp_report_missing(gate_skipped)")
@@ -162,7 +184,7 @@ def main():
     run_summary = {
         "run_id": run_id, "pack_version": "1.0-mvp",
         "certified": certified, "certification_reasons": reasons or ["all_required_gates_passed"],
-        "required_gates": ["H4-security", "H5-audit-chain", "H5-telemetry", "H6-cost", "benign-fp-budget"],
+        "required_gates": ["H3-traceability", "H4-security", "H5-audit-chain", "H5-telemetry", "H6-cost", "benign-fp-budget"],
         "harness_reports": sorted(reports.keys()),
     }
     with open(os.path.join(pack_dir, "run-summary.json"), "w", encoding="utf-8") as f:
@@ -182,6 +204,7 @@ def main():
         f"{total_tokens} provider tokens",
         f"- H2 tool audit: {reports['h2-tool-audit.json']['records']} records, "
         f"chain_ok={reports['h2-tool-audit.json']['chain_ok']}",
+        f"- H3 traceability: ok={traceability_rc == 0}",
         f"- Red-team: {reports['redteam-result.json']['vectors_defined']} vectors "
         f"(block_rate={reports['redteam-result.json']['adversarial_block_rate_pct']}%)",
         "",