Complete CASAN backlog tier 1 controls

AINative_OKR_CASAN5/.specify/scripts/bash/model-call.py

@@ -23,6 +23,7 @@ Usage:
 import argparse
 import json
 import os
+import subprocess
 import sys
 import time
 import urllib.request
@@ -89,6 +90,17 @@ def call_ollama(model_name, prompt, role):
     host = os.environ.get("CASAN_OLLAMA_HOST", OLLAMA_HOST)
     if host != OLLAMA_HOST:
         fail(f"endpoint_not_allowed ollama host={host} (only {OLLAMA_HOST})")
+    digest_gate = os.path.join(os.path.dirname(__file__), "model-digest-check.sh")
+    if os.path.isfile(digest_gate):
+        check = subprocess.run(
+            ["bash", digest_gate, "verify", model_name],
+            text=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+        )
+        if check.returncode != 0:
+            msg = (check.stderr or check.stdout or "model_digest_check_failed").strip()
+            fail(msg)
     url = f"http://{host}/api/generate"
     body = {
         "model": model_name,