coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Widen A12 enforcement from the key name to the declaration's content (GH-DEC-2026-020).
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m11s
Details

Browse source 
internal/layer/conformance.go enforced A12 as "no key named standard_version",
and so could not see the same pin as a versioned standard: path or as
companion_version. It now detects a version of the standard or its companion
in any key or value of the declaration (INTENT.md frontmatter, layer.yaml),
including a version in a path, and excludes comments and schema_version. It
refuses to be applied to pep-stance.yaml, pip-claims.yaml or
evidence-classification.yaml, which A12 r2 does not reach (§3).

Every run of check_layer_conformance and of the estate survey now prints the
standard version it checks against (layer.ValidatedAgainst, kings-guard's
pattern) and its scope (§4). The survey applies the same detection to peers'
declarations; the receipt is refreshed because the survey's output changed
(no peer declaration currently carries a version).

Tests fail if a versioned standard: path or a companion_version comes back.
flex-auth's own INTENT.md needed no change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
This commit is contained in:
tegwick 2026-09-21 09:39:46 +02:00
parent 2be655703d
commit e0c6c4389d
7 changed files with 334 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

35
internal/layer/survey_test.go
View file

@ -3,6 +3,7 @@ package layer_test
import (
"os"
"path/filepath"
"strings"
"testing"
"github.com/netkingdom/flex-auth/internal/layer"
@ -172,3 +173,37 @@ func TestPeerWithForeignFieldShapesIsStillSurveyed(t *testing.T) {
t.Fatalf("audit-core's layer.yaml was dropped: %+v", rows[0].File)
}
}
// The survey applies A12 r2 to peers' declarations — both forms — and states
// the version it checks against on every run.
func TestSurveyFindsVersionInPeerDeclaration(t *testing.T) {
root := t.TempDir()
writeRepo(t, root, "audit-core", "Engine", "")
writeRepo(t, root, "approval-engine", "Engine", "")
writeRepo(t, root, "user-engine", "Engine", "")
must := func(err error) {
if err != nil {
t.Fatal(err)
}
}
must(os.WriteFile(filepath.Join(root, "audit-core", "INTENT.md"),
[]byte("---\nlayer: Engine\nstandard: canon/standards/security-layer-model_v0.7.md\n---\n"), 0o644))
must(os.WriteFile(filepath.Join(root, "approval-engine", "layer.yaml"),
[]byte("schema_version: \"0.1\"\nlayer: engine\ncompanion_version: \"0.2\"\n"), 0o644))
// A stance map is not a declaration and must not be graded.
must(os.WriteFile(filepath.Join(root, "user-engine", "pep-stance.yaml"),
[]byte("standard_version: \"0.8\"\n"), 0o644))
rows, err := layer.SurveyDeclarations(root, []string{"approval-engine", "audit-core", "user-engine"})
if err != nil {
t.Fatal(err)
}
got := layer.VersionPinned(rows)
if len(got) != 2 {
t.Fatalf("VersionPinned = %v; want the audit-core standard: path and approval-engine companion_version only", got)
}
out := layer.FormatSurvey(layer.EstateScope([]string{"approval-engine", "audit-core", "user-engine"}), rows)
if !strings.Contains(out, layer.ValidatedAgainst) || !strings.Contains(out, "Scope:") {
t.Fatal("every survey run must print the version it checks against and its scope")
}
}