Validate accepted security layer v0.8 owner declaration

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

tests/test_layer_conformance.py

@@ -1,4 +1,4 @@
-"""Layer-model conformance (security-layer-model_v0.7 §3.3, §6, §11).
+"""Layer-model conformance (security-layer-model_v0.8 §3.3, §6, §11).
 
 The declaration must be this repository's own, machine-readable, and equal to
 the shipped production fail-closed gate. A published stance map that may drift
@@ -237,7 +237,7 @@ def test_every_run_states_version_and_scope():
         )
         assert result.returncode == 0, result.stdout + result.stderr
         assert f"validated against: {checker.VALIDATED_AGAINST}" in result.stdout
-        assert "scope: declaration = INTENT.md frontmatter + layer.yaml" in result.stdout
+        assert "scope: single repository secrets-engine (catalogued in §4); declaration = INTENT.md frontmatter + layer.yaml" in result.stdout
         pass_line = [l for l in result.stdout.splitlines() if l.startswith("PASS")]
         assert pass_line and checker.VALIDATED_AGAINST in pass_line[0]
 
@@ -380,3 +380,35 @@ def test_proposed_contracts_exist_and_forbid_secret_material():
     assert "secret values" in secret_use.lower() or "secret value" in secret_use.lower()
     assert "audit-core" in secret_use
     assert "completeness is not claimed" in secret_use.lower()
+
+
+def test_accepted_v08_run_provenance_and_catalog_scope():
+    checker = _checker()
+    assert "security-layer-model_v0.8.md" in checker.VALIDATED_AGAINST
+    assert "sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b" in checker.VALIDATED_AGAINST
+    assert "single repository secrets-engine (catalogued in §4)" in checker.SCOPE
+
+
+def test_reference_semantics_propagate_identity_through_nested_sequences():
+    checker = _checker()
+    for data in (
+        {"nested": {"standard": ["Security Layer Model v0.8"]}},
+        {"companion": [["Security Companion 0.3"]]},
+        {"standard": {"alternate": ["Security Layer Model v0.7"]}},
+    ):
+        # A dictionary begins a fresh identity key; only sequence descendants
+        # inherit the immediate standard:/companion: identity in the reference.
+        if isinstance(data.get("standard"), dict):
+            assert checker.find_version_pins(data) == []
+        else:
+            assert checker.find_version_pins(data), data
+    assert checker.find_version_pins({"rationale": "Assented at v0.7; migrated at v0.8."}) == []
+    assert checker.find_version_pins({"intent_version": "0.2.0", "schema_version": "0.1"}) == []
+
+
+def test_ascii_folding_never_discards_non_ascii_letters():
+    checker = _checker()
+    assert checker._fold("Staff") == "staff"
+    assert checker._fold("Engine") == "engine"
+    # Deleting non-ASCII bytes would turn this fifth token into Staff.
+    assert checker._fold("Stαaff") not in checker.LAYER_VOCABULARY