tegwick
c0d0d92e9f
INTENT.md pinned standard_version: "0.7" in the frontmatter §11 requires. That conflated two things the standard separates itself: assent "records assent to a BOUNDARY, given at the version named. It is not assent to the current text." flex-auth is Engine/PDP at v0.6, v0.7, v0.8 and after; the role does not change when the text is amended. The field was also decorative — parsed into Declaration.StandardVersion and never validated — so the version was load-bearing only via a test asserting it equalled 0.7. That test is inverted rather than deleted: internal/layer now rejects a version pin in the declaration and requires conformance_record to name a file that exists. Version-scoped state moves to docs/conformance/security-layer-conformance.md, a derived artifact carrying what it derives from and the version derived at, as §11 requires of derived artifacts. SCOPE.md: gap assessment replaces "conforming with one declared gap" with three gaps, each with an owner and a route. G2 is new — flex-auth declares no emission guarantee where §11 requires one of every §4 source of evidence. It is recorded as a gap rather than as conformance because the flattering reading, that audit-core is the source and flex-auth merely produces, has been asserted by nobody but flex-auth. Also corrects the stance register from two rows to five. Fixing one line meant reading what the declaration asserts, and a boundary is only half held here. docs/conformance/boundaries-review.md checks the other halves across twelve counterparts and finds four security-relevant repositories with no layer declaration at all — including key-cape, the identity source whose claims flex-auth consumes as normative input. That boundary is asserted from one side only. Recorded as unstated, never as agreed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 28468@bnt-lap001 Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d
77 lines
2.2 KiB
Go
77 lines
2.2 KiB
Go
package layer_test
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"runtime"
|
|
"testing"
|
|
|
|
"github.com/netkingdom/flex-auth/internal/layer"
|
|
)
|
|
|
|
func TestLayerDeclarationConforms(t *testing.T) {
|
|
root := repoRoot(t)
|
|
if err := layer.Check(root); err != nil {
|
|
t.Fatalf("layer conformance: %v", err)
|
|
}
|
|
|
|
decl, err := layer.LoadDeclaration(filepath.Join(root, "INTENT.md"))
|
|
if err != nil {
|
|
t.Fatalf("LoadDeclaration: %v", err)
|
|
}
|
|
if decl.Layer != "Engine" {
|
|
t.Fatalf("layer = %q; want Engine", decl.Layer)
|
|
}
|
|
if decl.Role != "PDP" {
|
|
t.Fatalf("role = %q; want PDP", decl.Role)
|
|
}
|
|
if decl.Framework != "netkingdom-security-layer-model" {
|
|
t.Fatalf("framework = %q", decl.Framework)
|
|
}
|
|
// The declaration is a boundary and must NOT pin a standard version: the
|
|
// role does not change when the standard text is amended. Version-scoped
|
|
// conformance state lives in the derived record named below.
|
|
if decl.StandardVersion != "" {
|
|
t.Fatalf("standard_version = %q; want empty (boundary, not version-scoped)", decl.StandardVersion)
|
|
}
|
|
if decl.ConformanceRecord == "" {
|
|
t.Fatal("conformance_record is empty; version-stamped state must have a home")
|
|
}
|
|
if _, err := os.Stat(filepath.Join(repoRoot(t), decl.ConformanceRecord)); err != nil {
|
|
t.Fatalf("conformance_record %q does not exist: %v", decl.ConformanceRecord, err)
|
|
}
|
|
}
|
|
|
|
func TestVersionPinInDeclarationIsRejected(t *testing.T) {
|
|
err := layer.ValidateDeclaration(layer.Declaration{
|
|
Layer: "Engine", Role: "PDP",
|
|
ConformanceRecord: "docs/conformance/security-layer-conformance.md",
|
|
StandardVersion: "0.8",
|
|
})
|
|
if err == nil {
|
|
t.Fatal("a standard_version pin in the boundary declaration was accepted")
|
|
}
|
|
}
|
|
|
|
func TestEngineWithoutRoleIsRejected(t *testing.T) {
|
|
err := layer.ValidateDeclaration(layer.Declaration{Layer: "Engine"})
|
|
if err == nil {
|
|
t.Fatal("Engine without role was accepted")
|
|
}
|
|
}
|
|
|
|
func TestUnknownLayerIsRejected(t *testing.T) {
|
|
err := layer.ValidateDeclaration(layer.Declaration{Layer: "ControlPlane", Role: "PDP"})
|
|
if err == nil {
|
|
t.Fatal("unknown layer was accepted")
|
|
}
|
|
}
|
|
|
|
func repoRoot(t *testing.T) string {
|
|
t.Helper()
|
|
_, file, _, ok := runtime.Caller(0)
|
|
if !ok {
|
|
t.Fatal("runtime.Caller failed")
|
|
}
|
|
return filepath.Clean(filepath.Join(filepath.Dir(file), "..", ".."))
|
|
}
|