diff --git a/docs/conformance/2026-10-11-layer-v08-migration.md b/docs/conformance/2026-10-11-layer-v08-migration.md new file mode 100644 index 0000000..90c3372 --- /dev/null +++ b/docs/conformance/2026-10-11-layer-v08-migration.md @@ -0,0 +1,31 @@ +--- +type: conformance-record +derived: true +derived_from: net-kingdom/canon/standards/security-layer-model_v0.8.md +derived_source_sha256: "3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b" +updated: "2026-10-11" +--- + +# kings-guard accepted v0.8 checker migration + +This owner applies GH-WP-0004-T11's post-flip migration to the confirmed +accepted NetKingdom v0.8 cut, immutable accepted-1 artifact SHA256 +3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b. +The checker names that artifact and its local scope in every run. INTENT +frontmatter remains authoritative and the sidecar remains derived; a +contradiction is a finding, never hidden by choosing one form. No declaration +acquires a standard version. + +The pin detector follows OpsWarden's A12 r3 reference semantics: standard and +companion identity values (including nested lists), version-bearing paths and +standard/companion version keys are pins; unrelated intent/schema/spec versions +and bare prose provenance are not. Existing local Tooling/contact and capability +detectors remain in place. Historical version strings in negative fixtures are +retained. This source migration grants no native capability or runtime authority. + +Validation includes the existing local declaration/contact suite and the same +12-case pin/provenance corpus across all four assigned owners, with exact +accepted-artifact and scope assertions. The local test counts and staged source +digests are retained in the coordinating Custodian evidence receipt. Standalone +checker runs continue to inspect only this repository; no estate-wide compliance +claim or novel declaration is produced. diff --git a/docs/reviews/2026-10-10-a11-r2-a12-r3.md b/docs/reviews/2026-10-10-a11-r2-a12-r3.md new file mode 100644 index 0000000..af9f24a --- /dev/null +++ b/docs/reviews/2026-10-10-a11-r2-a12-r3.md @@ -0,0 +1,75 @@ +# Kings Guard technical owner review — A11 r2 and A12 r3 + +```yaml +reviewer: kings-guard-owner (agent kings-guard, codex) +decision: approved +reviewed_at: "2026-10-10" +work_item: KG-WP-ADHOC-2026-10-10-T01 +amendments: + - A11 r2 + - A12 r3 +source_repo: gate-house +source_revision: 4bd50bfcac850f34e5563ade61fc92103b062f4d +source_path: docs/amendments/v0.8-section-11-declaration-amendments.md +source_sha256: 9b454b83c9aeed08ba13dba4d812f5ae6b4293ced9e43088d64cc3cc00b1459d +section_sha256: + A11 r2: 5eac52f955d1dacd1930ff290e4b4d782db9580a431ba350ba278eeb14ab1745 + A12 r3: 955292aa69f607e7053182fbfee2eb7f29696d38d659251ccccb0de45d77a8e8 +comment: >- + INTENT.md's Staff declaration, Responsibility Boundary and Declared engine + gaps require one authoritative repository declaration, an agreeing derived + sidecar and explicit blocked-clean engine gaps. A11 r2 explicitly permits + Kings Guard's single-repository scope and reports outside-catalog runs as + voluntary. A12 r3 separates a validity pin from provenance, resolving the + precise KG-DEC-2026-005 finding under independent GH-DEC-2026-021 section 1. + Approved owner technical review of the exact source revision and section + digests above, under KG-WP-ADHOC-2026-10-10-T01; no founder approval or v0.8 + publication acceptance is recorded here. +``` + +The dedicated Kings Guard worker independently read this repository's +`AGENTS.md` and `INTENT.md`, the exact amendment source and its prior +`KG-DEC-2026-005` finding. The fleet accepted +`the-custodian/canon/standards/delegated-owner-review_v0.1.md` permits this +INTENT-grounded owner review and keeps founder approval as a separate act. +No human-only reservation for this technical amendment review was found. + +A11 r2 preserves Kings Guard's own Staff declaration in `INTENT.md` as the +source of authority, requires its `layer.yaml` derived form to agree, and +reports disagreement as a finding. Its new single-repository sentence +expressly permits this repository's existing checker scope and requires the +catalog membership statement already printed by that checker. This resolves +our A11 wording finding in `KG-DEC-2026-005` without changing the Staff boundary. + +A12 r3 adopts the distinction requested in `KG-DEC-2026-005`: a version pin +identifies a standard/companion version to use; a historical citation records +where a rule came from. Kings Guard benefits from the exemption for three +sidecar provenance values, so the independent ruling matters. +`GH-DEC-2026-021` section 1 (resolved by Bernd Worsch; State Hub decision +`f2e34b44-060c-4367-84bf-0d6d29bc4025`) supplies that ruling. The exact r3 text +resolves our finding; there is no remaining changes-requested condition for +these two amendments. Prior r2 dispositions remain immutable history. + +Kings Guard continues to judge and propose posture through Engine surfaces. +This review changes no direct Tooling contact, credential, containment +actuation, authorization decision/cache, evidence-source classification or +runtime authority. It covers A11 r2 and A12 r3 alone; it provides no assent to +other new clause revisions or any unreturned section 9.5 review. + +Verification in the Kings Guard checkout on 2026-10-10: + +- Exact whole amendment file and both complete section hashes match the + retained review unit; Gate House HEAD equals the source revision above. +- `PYTHONDONTWRITEBYTECODE=1 .venv/bin/python scripts/check_layer_conformance.py` + passed, naming accepted v0.7 and Kings Guard's single-repository section 4 + scope. Declaration forms agree; no direct Tooling client or standing + credential was found by this checker. +- `PYTHONDONTWRITEBYTECODE=1 .venv/bin/python -m pytest tests/test_layer_conformance.py -q -p no:cacheprovider --basetemp=/tmp/security-kings-owner-layer-tests` + passed: 25 tests in 1.04 seconds. + +The unchanged checker still prints its historical "A12 r2 reach unruled" +notice for three citations; that wording predates the independent r3 ruling +and is not a current unresolved finding. This technical review leaves the +checker and `VALIDATED_AGAINST` at v0.7. Actual v0.8 acceptance/publication and +post-flip detector convergence are tracked separately by +`GH-WP-0004-T10`/`GH-WP-0004-T11`. diff --git a/scripts/check_layer_conformance.py b/scripts/check_layer_conformance.py index 6e9d5b6..80174fb 100644 --- a/scripts/check_layer_conformance.py +++ b/scripts/check_layer_conformance.py @@ -23,8 +23,8 @@ case against §3's closed four-token vocabulary, so `Staff` and `staff` agree an neither file is re-spelled. A disagreement that survives the fold is reported as a finding, not resolved by precedence. Neither form may carry a version of the standard or its companion in any key or value (A12 r2, GH-DEC-2026-020 §1–§2): -not only a key named `standard_version`, but `companion_version`, any other -version key, and a version-bearing path or file name such as a `standard:` of +not only a key named `standard_version`, but `companion_version`, another +key naming a standard/companion version, and a version-bearing path or file name such as a `standard:` of `…security-layer-model_v0.7.md`. Comments are not read (YAML drops them) and `schema_version` is the sidecar's own schema, so neither is reached. Only INTENT.md frontmatter and layer.yaml are read for A12: stance, claims and @@ -32,9 +32,8 @@ classification maps are not declarations and this run never applies A12 to them (GH-DEC-2026-020 §3). A bare revision citation in a prose value — `layer.yaml` cites "v0.6 §13" as -provenance in a gap record — is reported on every run, not failed: whether A12 r2's -"any value" reaches a citation rather than a pin is raised with gate-house by -kings-guard (see decisions/decisions.md KG-DEC-2026-005), not settled here. +provenance in a gap record — is reported on every run, not failed. A12 r3 +excludes prose provenance from declaration pins. Every run prints, first, the standard version this check was built and validated against (VALIDATED_AGAINST) and the scope it ranges over (SCOPE), including runs @@ -67,7 +66,10 @@ INTENT = ROOT / "INTENT.md" # from layer.yaml's former `standard_version: "0.7"`, which recorded the same # fact in a place the ruling says a declaration must not carry it. Bump it when # the checker is re-validated against a newer accepted text. -VALIDATED_AGAINST = "net-kingdom/canon/standards/security-layer-model_v0.7.md" +VALIDATED_AGAINST = ( + "net-kingdom/canon/standards/security-layer-model_v0.8.md " + "(accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)" +) # The scope every run ranges over, printed on every run (GH-DEC-2026-020 §4, A11). # This is a single-repository run, not an estate run: it grades kings-guard, a §4 @@ -77,18 +79,14 @@ SCOPE = ( "src/kings_guard, repository tree for credential files" ) -# A12 r2 detection. A key naming a version is a pin, except the sidecar's own +# A12 r3 detection. A key naming a standard/companion version is a pin; the sidecar's own # schema_version. A value naming the standard or companion with a version, or any # versioned file name, is a pin. In identity-bearing keys any version token is a # pin. A bare "vN.N" elsewhere in a value is a citation: reported, not failed. A12_EXEMPT_KEYS = {"schema_version"} -A12_IDENTITY_KEYS = {"standard", "companion", "framework"} -A12_PIN_VALUE = re.compile( - r"""(?ix) - (?:security[-_ ]?layer[-_ ]?model|security[-_ ]?companion)[^\s'"]*?[-_.]v?\d+(?:\.\d+)+ - | [-_]v\d+(?:\.\d+)*\.(?:md|ya?ml|json)\b - """ -) +A12_IDENTITY_KEYS = {"standard", "companion"} +A12_VERSION_KEY = re.compile(r"(standard|companion).*version|version.*(standard|companion)", re.I) +A12_PIN_VALUE = re.compile(r"[_\-.]v\d+(\.\d+)*(\.md)?\b|@v?\d+\.\d+", re.I) A12_VERSION_TOKEN = re.compile(r"\bv?\d+\.\d+(?:\.\d+)*\b") A12_CITATION = re.compile(r"\bv\d+\.\d+\b") @@ -155,7 +153,7 @@ def a12_findings(node: object, where: str) -> tuple[list[str], list[str]]: for k, v in value.items(): k_str = str(k) sub = f"{path}.{k_str}" if path else k_str - if "version" in k_str.lower() and k_str not in A12_EXEMPT_KEYS: + if A12_VERSION_KEY.search(k_str) and k_str not in A12_EXEMPT_KEYS: pins.append(f"{where}: key '{sub}' carries a version") if k_str in A12_EXEMPT_KEYS: continue @@ -165,11 +163,11 @@ def a12_findings(node: object, where: str) -> tuple[list[str], list[str]]: for i, v in enumerate(value): walk(v, f"{path}[{i}]", key) return - if value is None or isinstance(value, bool): + if not isinstance(value, str): return text = str(value) if A12_PIN_VALUE.search(text) or ( - key in A12_IDENTITY_KEYS and A12_VERSION_TOKEN.search(text) + key and key.lower() in A12_IDENTITY_KEYS and A12_VERSION_TOKEN.search(text) ): pins.append(f"{where}: '{path}' = {text!r} names a versioned standard") elif A12_CITATION.search(text): @@ -354,7 +352,7 @@ def main() -> int: + a12_findings(decl, DECL.name)[1] ) for citation in citations: - print(f"NOTE (A12 r2 reach unruled, reported not failed): {citation}") + print(f"NOTE (A12 r3 provenance, reported not failed): {citation}") if forms_disagree(governing, decl["layer"]): print("", file=sys.stderr) diff --git a/tests/test_layer_conformance.py b/tests/test_layer_conformance.py index 004be5a..275d6a3 100644 --- a/tests/test_layer_conformance.py +++ b/tests/test_layer_conformance.py @@ -98,7 +98,6 @@ def test_no_version_anywhere_in_either_form(): "companion: net-kingdom/SECURITY-COMPANION_v0.2.md", 'companion_version: "0.2"', 'standard_version: "0.7"', - 'spec_version: "0.7"', ], ) def test_checker_rejects_a_version_pin_in_intent_frontmatter(tmp_path, monkeypatch, front_extra): diff --git a/tests/test_layer_v08_convergence.py b/tests/test_layer_v08_convergence.py new file mode 100644 index 0000000..6885d45 --- /dev/null +++ b/tests/test_layer_v08_convergence.py @@ -0,0 +1,37 @@ +"""Accepted A12 r3 semantics, retaining local contact scanners and scope.""" +import importlib.util +from pathlib import Path +import pytest + +ROOT = Path(__file__).resolve().parents[1] +SCRIPT = ROOT / "scripts/check_layer_conformance.py" + +def checker(): + spec = importlib.util.spec_from_file_location("v08_checker", SCRIPT) + module = importlib.util.module_from_spec(spec) + spec.loader.exec_module(module) + return module + +@pytest.mark.parametrize("value,pinned", [ + ({"intent_version": "0.3"}, False), + ({"spec_version": "0.7"}, False), + ({"note": "per v0.6 section 13"}, False), + ({"note": "revised 0.7 wording"}, False), + ({"schema_version": "0.1"}, False), + ({"standard": "security-layer-model 0.8"}, True), + ({"STANDARD": ["security-layer-model v0.8"]}, True), + ({"companion": [["SECURITY-COMPANION v0.3"]]}, True), + ({"nested": {"standard_version": "0.8"}}, True), + ({"nested": {"companion_version": "0.3"}}, True), + ({"references": ["security-layer-model@0.8"]}, True), + ({"references": ["security-layer-model_v0.7.md"]}, True), +]) +def test_reference_pin_provenance_semantics(value, pinned): + module = checker() + assert bool(module.a12_findings(value, "test")[0]) is pinned + +def test_run_names_exact_accepted_standard_and_scope(): + module = checker() + assert "security-layer-model_v0.8.md" in module.VALIDATED_AGAINST + assert "3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b" in module.VALIDATED_AGAINST + assert "INTENT.md" in module.SCOPE diff --git a/workplans/ADHOC-2026-10-10.md b/workplans/ADHOC-2026-10-10.md new file mode 100644 index 0000000..cb23f70 --- /dev/null +++ b/workplans/ADHOC-2026-10-10.md @@ -0,0 +1,37 @@ +--- +id: KG-WP-ADHOC-2026-10-10 +type: workplan +title: "Review exact A11 r2 and A12 r3 declaration amendments" +domain: infotech +repo: kings-guard +status: finished +owner: codex +topic_slug: net-kingdom-security-layer +created: "2026-10-10" +updated: "2026-10-10" +flavor: implementation +depends_on: [] +state_hub_workstream_id: "c6d3c747-8792-5e80-9297-28c7df0932cc" +--- + +## Return Kings Guard technical owner review + +```task +id: KG-WP-ADHOC-2026-10-10-T01 +status: done +priority: medium +state_hub_task_id: "68c9a878-12a2-5e35-bc4b-316dd1964feb" +``` + +Reviewed Kings Guard's Staff responsibility and blocked-clean boundary in +`INTENT.md`, its governing declaration and derived sidecar, prior +`KG-DEC-2026-005`, and the exact Gate House A11 r2/A12 r3 amendment text. +Owner review: **approved** for both exact revisions, retained in +`docs/reviews/2026-10-10-a11-r2-a12-r3.md` with source and section digests. +This completes the repository's technical return for `GH-WP-0004-T09`. + +The checker passed against accepted v0.7 and its 25 declaration tests passed. +No governing declaration, checker version or acceptance field changed. +Publication/acceptance and post-flip checker convergence remain owned by +existing `GH-WP-0004-T10` and `GH-WP-0004-T11`; they are separate from this +review, rather than leftover implementation silently folded into its closure.