From 3b7bedc8e05ce7584398d6ab3754b86a074d0e4c Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 21 Sep 2026 09:36:37 +0200 Subject: [PATCH] Apply GH-DEC-2026-020: de-version the INTENT.md standard: path. A12 r2 reaches every key and value of the declaration, so the _v0.7 inside the standard: path is a standard version. The path is now canon/standards/security-layer-model. Comments and schema_version are not reached and are left as they were. The conformance test now fails on a version anywhere in either form of the declaration, including a versioned standard: path and companion_version, and carries a self-test that it catches those forms. Co-Authored-By: Claude Opus 5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 63291@bnt-lap001 Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703 --- INTENT.md | 2 +- tests/test_layer_conformance.py | 53 +++++++++++++++++++++++++++++++++ 2 files changed, 54 insertions(+), 1 deletion(-) diff --git a/INTENT.md b/INTENT.md index 5cbd922..84fb837 100644 --- a/INTENT.md +++ b/INTENT.md @@ -4,7 +4,7 @@ # and the full conformance map: layer.yaml layer: Engine role: Evidence -standard: canon/standards/security-layer-model_v0.7.md +standard: canon/standards/security-layer-model declared_by: intakes/intakes.md AUDIT-IN-0001 declared_at: "2026-08-29" --- diff --git a/tests/test_layer_conformance.py b/tests/test_layer_conformance.py index 931a5ab..d4a6c73 100644 --- a/tests/test_layer_conformance.py +++ b/tests/test_layer_conformance.py @@ -7,6 +7,7 @@ nobody checks decays into a list nobody updates. These tests make the claim of totality mechanical. """ +import re from pathlib import Path import pytest @@ -181,3 +182,55 @@ def test_the_two_forms_agree_after_folding_and_nobody_re_spells(): def test_no_standard_version_in_either_form(): assert "standard_version" not in LAYER assert "standard_version" not in _intent_frontmatter() + + +# GH-DEC-2026-020 (A12 r2): A12 reaches every key and value of the declaration, +# so a version inside the `standard:` path counts, and so does +# `companion_version`. Comments and `schema_version` are not reached. Stance, +# claims and classification maps are not declaration files and are not checked. +_VERSION = re.compile(r"(?i)(?:_v|\bv)\d+(?:\.\d+)+|\b\d+\.\d+(?:\.\d+)?\b") +_NOT_REACHED = {"schema_version"} + + +def _walk(node, path=""): + if isinstance(node, dict): + for key, value in node.items(): + if key in _NOT_REACHED: + continue + yield f"{path}.{key}", str(key) + yield from _walk(value, f"{path}.{key}") + elif isinstance(node, list): + for i, value in enumerate(node): + yield from _walk(value, f"{path}[{i}]") + elif isinstance(node, str): + yield path, node + + +def _standard_versions(declaration: dict) -> list[str]: + found = [p for p, text in _walk(declaration) if _VERSION.search(text)] + if "companion_version" in declaration: + found.append(".companion_version") + return found + + +@pytest.mark.parametrize("form", ["INTENT.md", "layer.yaml"]) +def test_no_version_anywhere_in_the_declaration(form): + declaration = _intent_frontmatter() if form == "INTENT.md" else LAYER + assert "companion_version" not in declaration + standard = declaration.get("standard") + if standard is not None: + assert not _VERSION.search(str(standard)), standard + assert _standard_versions(declaration) == [] + + +def test_the_version_check_catches_what_a12_r2_rules(): + """The check must fail on the forms GH-DEC-2026-020 names, not only on a + key literally named `standard_version`.""" + assert _standard_versions( + {"standard": "canon/standards/security-layer-model_v0.7.md"} + ) + assert _standard_versions({"companion_version": "0.3"}) + assert _standard_versions({"standard_version": "0.8"}) + assert not _standard_versions( + {"standard": "canon/standards/security-layer-model", "schema_version": "0.1"} + )