Stand up the Engine/PIP surface for MAT-WP-0001

Declare layer.yaml, add a Python engine over a local SQLite store,
and cover deterministic assessment, the §13 gap register, stance-map
inventory, claim guardrails, and the gate-house review path with tests.

Assistant: grok
Assistant-Session: 01a04ceb-150e-7e80-a542-ec8b1372e164

tests/test_register.py

@@ -0,0 +1,83 @@
+from __future__ import annotations
+
+from maturity_engine.scoring import (
+    BLOCKED_CLEAN,
+    CONFORMING,
+    DECLARED_GAP,
+    UNDECLARED_VIOLATION,
+    capability_readiness,
+    ranks_below,
+    score,
+    worst_state,
+)
+from conftest import INSTANT
+
+
+def test_section_13_snapshot_is_queryable(engine):
+    gaps = {gap.id: gap for gap in engine.gaps()}
+    assert "ssh-ca-signing-write" in gaps
+    assert "actuation-containment-surface" in gaps
+    ssh = gaps["ssh-ca-signing-write"]
+    assert ssh.state == "declared-contact"
+    assert ssh.owner_status == "proposed"
+    assert ssh.mark == "declared-gap"
+    assert ssh.intended_owner == "secrets-engine"
+    assert ssh.blocked_on
+    assert ssh.review
+    actuation = gaps["actuation-containment-surface"]
+    assert actuation.state == "unowned-capability"
+    assert actuation.mark == "pending"
+    assert actuation.owner_status == "proposed"
+    declined = gaps["authentication-assurance-evidence"]
+    assert declined.owner_status == "declined"
+    assigned = gaps["approval-storage-lifecycle"]
+    assert assigned.owner_status == "assigned"
+    assert assigned.mark is None
+
+
+def test_proposed_is_not_assigned(engine):
+    proposed = [gap for gap in engine.gaps() if gap.owner_status == "proposed"]
+    assigned = [gap for gap in engine.gaps() if gap.owner_status == "assigned"]
+    assert proposed
+    assert assigned
+    assert {gap.id for gap in proposed}.isdisjoint({gap.id for gap in assigned})
+
+
+def test_blocked_clean_does_not_rank_below_conforming():
+    assert score(BLOCKED_CLEAN) == score(CONFORMING)
+    assert not ranks_below(BLOCKED_CLEAN, CONFORMING)
+    assert ranks_below(DECLARED_GAP, CONFORMING)
+    assert ranks_below(UNDECLARED_VIOLATION, BLOCKED_CLEAN)
+    assert worst_state((BLOCKED_CLEAN, CONFORMING)) == CONFORMING
+    assert worst_state((BLOCKED_CLEAN,)) == BLOCKED_CLEAN
+
+
+def test_scoring_test_fails_if_blocked_clean_ranks_below(monkeypatch):
+    import maturity_engine.scoring as scoring
+
+    monkeypatch.setitem(scoring.SCORE, BLOCKED_CLEAN, scoring.SCORE[CONFORMING] - 1)
+    assert scoring.ranks_below(BLOCKED_CLEAN, CONFORMING)
+
+
+def test_readiness_of_actuation_is_pending_not_owned(engine):
+    result = engine.readiness("actuation-containment-surface")
+    assert result["readiness"] == "pending"
+    assert result["owns_actuation"] is False
+    assert capability_readiness(engine.store.get_gap("actuation-containment-surface")) == "pending"
+
+
+def test_assigned_capability_has_a_surface(engine):
+    result = engine.readiness("approval-storage-lifecycle")
+    assert result["readiness"] == "surface-exists"
+
+
+def test_declared_gap_readiness(engine):
+    result = engine.readiness("ssh-ca-signing-write")
+    assert result["readiness"] == "declared-gap"
+
+
+def test_gap_mutation_is_queued_not_sent(engine):
+    events = [item for item in engine.pending_events() if item["event_type"] == "gap.mutated"]
+    assert events
+    assert events[0]["payload"]["class"] == "attributive"
+    assert all("audit-core" not in str(item) for item in events)