flex-auth/tools/check_layer_conformance.go

// Command check_layer_conformance asserts the INTENT.md layer declaration
// and that no Tooling client exists in production Go sources.
//
// Every run — pass or fail — prints the standard version it checks against and
// the scope it ranged over, as A12 r2 requires (GH-DEC-2026-020 §4).
package main

import (
	"fmt"
	"os"
	"path/filepath"

	"github.com/netkingdom/flex-auth/internal/layer"
)

func main() {
	root, err := os.Getwd()
	if err != nil {
		fmt.Fprintln(os.Stderr, err)
		os.Exit(2)
	}
	fmt.Printf("Validated against: %s\n", layer.ValidatedAgainst)
	fmt.Printf("Scope: this repository only — %s/INTENT.md frontmatter (the §11 declaration), the files it names, and production Go sources under cmd/, internal/, pkg/. Stance, claims and classification maps are not read.\n", filepath.Base(root))
	if _, err := os.Stat(filepath.Join(root, "INTENT.md")); err != nil {
		fmt.Fprintf(os.Stderr, "INTENT.md not found in %s\n", root)
		os.Exit(2)
	}
	if err := layer.Check(root); err != nil {
		fmt.Fprintln(os.Stderr, err)
		os.Exit(1)
	}
	fmt.Println("PASS — Engine/PDP declaration parses; no standard or companion version anywhere in it; no Tooling client in the tree.")
}