coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Widen A12 enforcement from the key name to the declaration's content (GH-DEC-2026-020).
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m11s
Details

Browse source 
internal/layer/conformance.go enforced A12 as "no key named standard_version",
and so could not see the same pin as a versioned standard: path or as
companion_version. It now detects a version of the standard or its companion
in any key or value of the declaration (INTENT.md frontmatter, layer.yaml),
including a version in a path, and excludes comments and schema_version. It
refuses to be applied to pep-stance.yaml, pip-claims.yaml or
evidence-classification.yaml, which A12 r2 does not reach (§3).

Every run of check_layer_conformance and of the estate survey now prints the
standard version it checks against (layer.ValidatedAgainst, kings-guard's
pattern) and its scope (§4). The survey applies the same detection to peers'
declarations; the receipt is refreshed because the survey's output changed
(no peer declaration currently carries a version).

Tests fail if a versioned standard: path or a companion_version comes back.
flex-auth's own INTENT.md needed no change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
This commit is contained in:
tegwick 2026-09-21 09:39:46 +02:00
parent 2be655703d
commit e0c6c4389d
7 changed files with 334 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

7
tools/check_layer_conformance.go
View file

@ -1,5 +1,8 @@
// Command check_layer_conformance asserts the INTENT.md layer declaration
// and that no Tooling client exists in production Go sources.
//
// Every run — pass or fail — prints the standard version it checks against and
// the scope it ranged over, as A12 r2 requires (GH-DEC-2026-020 §4).
package main
import (
@ -16,6 +19,8 @@ func main() {
fmt.Fprintln(os.Stderr, err)
os.Exit(2)
}
fmt.Printf("Validated against: %s\n", layer.ValidatedAgainst)
fmt.Printf("Scope: this repository only — %s/INTENT.md frontmatter (the §11 declaration), the files it names, and production Go sources under cmd/, internal/, pkg/. Stance, claims and classification maps are not read.\n", filepath.Base(root))
if _, err := os.Stat(filepath.Join(root, "INTENT.md")); err != nil {
fmt.Fprintf(os.Stderr, "INTENT.md not found in %s\n", root)
os.Exit(2)
@ -24,5 +29,5 @@ func main() {
fmt.Fprintln(os.Stderr, err)
os.Exit(1)
}
fmt.Println("PASS — Engine/PDP declaration parses; no Tooling client in the tree.")
fmt.Println("PASS — Engine/PDP declaration parses; no standard or companion version anywhere in it; no Tooling client in the tree.")
}