coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Name the accepted v0.7 text in force and converge the A12 detector (GH-DEC-2026-021).
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m9s
Details

Browse source 
ValidatedAgainst named the proposed v0.8, which is held under GH-DEC-2026-019,
so every run claimed a check against text that does not govern. It now names
security-layer-model_v0.7.md (net-kingdom@66dc491) as amended by
GH-DEC-2026-017, -020 and -021 (gate-house@39d9287), per 021 §2.

The pin detector converges on ops-warden's reference (021 §3): keys naming a
standard or companion version, versions in path or file-name tokens, and the
021 addition of any version token in a standard:/companion: value. A revision
cited in prose is provenance and is no longer reached (021 §1), including
under standard_*-prefixed keys that name no version. One kept difference: an
empty version key carries no version and is not flagged.

Survey receipt refreshed; no declaration in the estate carries a pin.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
This commit is contained in:
tegwick 2026-09-21 13:05:32 +02:00
parent e0c6c4389d
commit 067d93a1e0
3 changed files with 72 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

10
internal/layer/conformance_test.go
View file

@ -217,6 +217,10 @@ func TestVersionAnywhereInDeclarationIsFound(t *testing.T) {
"bare version under standard": "layer: Engine\nstandard: \"v0.8\"\n",
"nested versioned path": "layer: Engine\nassented_by:\n - ref: security-layer-model_v0.8.md\n",
"version in a list of sources": "layer: Engine\nsources: [net-kingdom/canon/standards/security-layer-model_v0.6.md]\n",
"prose version under standard": "layer: Engine\nstandard: security-layer-model v0.7\n",
"version under companion": "layer: Engine\ncompanion: SECURITY-COMPANION 0.2\n",
"reviewed-version key": "layer: Engine\nstandard_version_reviewed: \"0.7\"\n",
"at-version reference": "layer: Engine\nsource: net-kingdom@0.7\n",
} {
pins, err := layer.VersionPins(doc)
if err != nil {
@ -240,7 +244,11 @@ func TestVersionPinsLeavesWhatA12DoesNotReach(t *testing.T) {
"companion: net-kingdom/SECURITY-COMPANION.md\n" +
"declared_at: \"2026-08-29\"\n" +
"declared_by: decisions/decisions.md FLEX-DEC-2026-001\n" +
"companion_version:\n"
"companion_version:\n" +
// GH-DEC-2026-021 §1: a revision cited in prose is provenance, not a
// pin, even under a standard_*-prefixed key that names no version.
"standard_note: the standard's v0.5 scope rule\n" +
"rationale: adopted under security-layer-model v0.7 and GH-DEC-2026-020\n"
pins, err := layer.VersionPins(doc)
if err != nil {
t.Fatal(err)