Alright, some steps forward. Wanted to be the different kid, so put a PiCAN2 Duo and a RPi3 on order, hopefully start sniffing bus data next weekend.
My target would be to try to build a safety-compliant system as a retrofit, so that you could easily build a road legal system with as little effort as possible. To achieve that with CLS controller, you need to have redundant wheel angle sensor (hence the SASA, it’s a dual CAN output angle sensor) and a doubled vehicle speed signal on the CAN (the CLS is doing cross checking between the two values as it’s one of the key parameters for the safety functions). And also an external road switch, like so:
For the controller config you need PSAC (Parameter Sector Access Code), now checking with my dealer that they’ll supply me with the OEM level code. If I understood the documentation correctly, you need that even when configuring through canbus, you need to calculate a sort of checksum. Found also some schematics for the T4, for the low-spec hitec model but I guess the basic structure applies to Versu/Direct with the armrest electrohydraulics etc. with the CAN IDs. I guess the steering valve etc. goes to CAN1, but based on that all three buses are accessible from the cab service connectors (at least).