maturity-engine/tests/test_layer_conformance.py

from __future__ import annotations

import re
import subprocess
import sys
from pathlib import Path

import pytest

yaml = pytest.importorskip("yaml")

ROOT = Path(__file__).resolve().parents[1]
SCRIPT = ROOT / "scripts" / "check_layer_conformance.py"
DECL = ROOT / "layer.yaml"
INTENT = ROOT / "INTENT.md"


def _fold(value: object) -> str:
    return str(value).strip().encode("ascii", "ignore").decode().lower()


def _intent_frontmatter() -> dict:
    match = re.match(r"^---\n(.*?)\n---\n", INTENT.read_text(), re.DOTALL)
    assert match
    return yaml.safe_load(match.group(1))


def _run(*args: str) -> subprocess.CompletedProcess[str]:
    return subprocess.run(
        [sys.executable, str(SCRIPT), *args],
        capture_output=True,
        text=True,
    )


def test_declaration_exists_and_declares_engine_pip():
    assert DECL.exists()
    data = yaml.safe_load(DECL.read_text())
    assert data["repository"] == "maturity-engine"
    assert _fold(data["layer"]) == "engine"
    assert _fold(data["role"]) == "pip"
    assert data["framework"] == "netkingdom-security-layer-model"
    assert "pep_stance" not in data or not data.get("pep_stance")


def test_intent_md_carries_the_governing_layer_key():
    """GH-DEC-2026-017 §1: the INTENT.md frontmatter key is the declaration."""
    assert _fold(_intent_frontmatter()["layer"]) == "engine"


def test_sidecar_is_marked_derived_and_names_its_source():
    data = yaml.safe_load(DECL.read_text())
    assert data["derived"] is True
    assert data["derived_from"] == "INTENT.md"


def test_frontmatter_agrees_with_layer_yaml_once_case_is_folded():
    """A11 agreement, A9 fold. Deliberately a fold, not an equality: an
    equality would silently demand the re-spelling the ruling declined."""
    meta = _intent_frontmatter()
    data = yaml.safe_load(DECL.read_text())
    assert _fold(meta["layer"]) == _fold(data["layer"])
    assert _fold(meta["role"]) == _fold(data["role"])


def test_both_layer_values_are_in_the_closed_vocabulary():
    vocabulary = {"taxonomy", "tooling", "engine", "staff"}
    assert _fold(_intent_frontmatter()["layer"]) in vocabulary
    assert _fold(yaml.safe_load(DECL.read_text())["layer"]) in vocabulary


def test_no_declaration_carries_a_standard_version():
    """GH-DEC-2026-017 §5 / A12."""
    assert "standard_version" not in yaml.safe_load(DECL.read_text())
    assert "standard_version" not in _intent_frontmatter()


def test_no_tooling_contacts_or_pep():
    data = yaml.safe_load(DECL.read_text())
    assert data["tooling_contacts"] == []
    for entries in data["declared_shapes"].values():
        assert entries == []
    clients = {item["id"] for item in data["non_tooling_clients"]}
    assert "state-hub-work-records" in clients
    assert "sqlite-own-store" in clients


def test_catalog_entry_matches_section_4():
    data = yaml.safe_load(DECL.read_text())
    owns = " ".join(data["catalog_entry"]["owns"])
    assert "graded progression" in owns
    assert "gap register" in owns
    assert "capability readiness" in owns


def test_checker_passes_on_the_real_tree():
    result = _run()
    assert result.returncode == 0, result.stderr


def test_checker_catches_an_openbao_client(tmp_path, monkeypatch):
    import importlib.util

    spec = importlib.util.spec_from_file_location("check_layer_conformance", SCRIPT)
    module = importlib.util.module_from_spec(spec)
    spec.loader.exec_module(module)

    fake_src = tmp_path / "src" / "maturity_engine"
    fake_src.mkdir(parents=True)
    (fake_src / "oops.py").write_text("import hvac\n")
    monkeypatch.setattr(module, "SRC", fake_src)
    hits = module.scan()
    assert hits
    assert hits[0][1] == "hvac"


def _checker():
    import importlib.util

    spec = importlib.util.spec_from_file_location("check_layer_conformance_v", SCRIPT)
    module = importlib.util.module_from_spec(spec)
    spec.loader.exec_module(module)
    return module


def test_every_run_prints_the_version_and_scope():
    """GH-DEC-2026-020 §4: the version belongs to the run, OK line included."""
    module = _checker()
    for args in ((), ("--report",)):
        out = _run(*args).stdout
        assert module.VALIDATED_AGAINST in out
        assert module.SCOPE in out
    ok = [line for line in _run().stdout.splitlines() if line.startswith("OK:")]
    assert ok and module.VALIDATED_AGAINST in ok[0] and module.SCOPE in ok[0]


def test_no_version_anywhere_in_either_declaration():
    """A12 r2: no standard or companion version in any key or value."""
    module = _checker()
    assert module.version_findings(_intent_frontmatter(), "INTENT.md") == []
    assert module.version_findings(yaml.safe_load(DECL.read_text()), "layer.yaml") == []


@pytest.mark.parametrize(
    "declaration",
    [
        {"standard": "net-kingdom/canon/standards/security-layer-model_v0.7.md"},
        {"companion": "net-kingdom/v0.2/SECURITY-COMPANION.md"},
        {"companion_version": "0.2"},
        {"standard_version": "0.7"},
        {"framework": "netkingdom-security-layer-model 0.8"},
    ],
)
def test_checker_catches_a_version_beyond_the_key_name(declaration):
    """Fails if a versioned `standard:` path or a companion_version comes back."""
    assert _checker().version_findings(declaration, "x")


def test_schema_version_and_prose_are_not_reached():
    module = _checker()
    assert module.version_findings({"schema_version": "0.1"}, "x") == []
    assert module.version_findings({"note": "Outside §5 by the v0.5 scope rule"}, "x") == []