# CASAN — Incident severity map (C7 / V23). Line format: <event-type> <severity>
# severity ∈ LOW | MED | HIGH | CRIT. HIGH/CRIT auto-engage the kill-switch.
# Mirrors the Plan-07 C0 severity table.
secret-to-cloud         CRIT
tool-write-sensitive    CRIT
private-key-exposure     CRIT
dependency-postinstall  HIGH
dependency-malicious    HIGH
audit-chain-broken      HIGH
telemetry-tamper        HIGH
sandbox-escape          HIGH
evidence-pack-tampered  HIGH
cost-budget-exceeded    MED
benign-fp-exceeded      MED
drift-detected          MED
approval-forged         HIGH
default                 MED