Stand up the Engine/PIP surface for MAT-WP-0001

Declare layer.yaml, add a Python engine over a local SQLite store,
and cover deterministic assessment, the §13 gap register, stance-map
inventory, claim guardrails, and the gate-house review path with tests.

Assistant: grok
Assistant-Session: 01a04ceb-150e-7e80-a542-ec8b1372e164

tests/test_layer_conformance.py

@@ -0,0 +1,83 @@
+from __future__ import annotations
+
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+yaml = pytest.importorskip("yaml")
+
+ROOT = Path(__file__).resolve().parents[1]
+SCRIPT = ROOT / "scripts" / "check_layer_conformance.py"
+DECL = ROOT / "layer.yaml"
+INTENT = ROOT / "INTENT.md"
+
+
+def _run(*args: str) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        [sys.executable, str(SCRIPT), *args],
+        capture_output=True,
+        text=True,
+    )
+
+
+def test_declaration_exists_and_declares_engine_pip():
+    assert DECL.exists()
+    data = yaml.safe_load(DECL.read_text())
+    assert data["repository"] == "maturity-engine"
+    assert data["layer"] == "engine"
+    assert data["role"] == "pip"
+    assert data["framework"] == "netkingdom-security-layer-model"
+    assert data["standard_version"] == "0.7"
+    assert "pep_stance" not in data or not data.get("pep_stance")
+
+
+def test_frontmatter_agrees_with_layer_yaml():
+    text = INTENT.read_text()
+    match = re.match(r"^---\n(.*?)\n---\n", text, re.DOTALL)
+    assert match
+    meta = yaml.safe_load(match.group(1))
+    data = yaml.safe_load(DECL.read_text())
+    assert str(meta["layer"]).lower() == str(data["layer"]).lower()
+    assert str(meta["role"]).lower() == str(data["role"]).lower()
+
+
+def test_no_tooling_contacts_or_pep():
+    data = yaml.safe_load(DECL.read_text())
+    assert data["tooling_contacts"] == []
+    for entries in data["declared_shapes"].values():
+        assert entries == []
+    clients = {item["id"] for item in data["non_tooling_clients"]}
+    assert "state-hub-work-records" in clients
+    assert "sqlite-own-store" in clients
+
+
+def test_catalog_entry_matches_section_4():
+    data = yaml.safe_load(DECL.read_text())
+    owns = " ".join(data["catalog_entry"]["owns"])
+    assert "graded progression" in owns
+    assert "gap register" in owns
+    assert "capability readiness" in owns
+
+
+def test_checker_passes_on_the_real_tree():
+    result = _run()
+    assert result.returncode == 0, result.stderr
+
+
+def test_checker_catches_an_openbao_client(tmp_path, monkeypatch):
+    import importlib.util
+
+    spec = importlib.util.spec_from_file_location("check_layer_conformance", SCRIPT)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+
+    fake_src = tmp_path / "src" / "maturity_engine"
+    fake_src.mkdir(parents=True)
+    (fake_src / "oops.py").write_text("import hvac\n")
+    monkeypatch.setattr(module, "SRC", fake_src)
+    hits = module.scan()
+    assert hits
+    assert hits[0][1] == "hvac"