coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish companion catalog work and reconcile completed approval tasks
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e324-abce-7e51-bb2b-496f097afdb0
This commit is contained in:
tegwick 2026-09-27 16:15:01 +02:00
parent 41e4c4a3d8
commit e33f9c3ca5
18 changed files with 472 additions and 87 deletions
Download patch file Download diff file Expand all files Collapse all files

23
tests/test_layer_conformance.py
View file

@ -190,6 +190,27 @@ def test_schema_version_is_not_reached(tmp_path, monkeypatch):
assert _run_with(tmp_path, monkeypatch, {}, {"schema_version": "0.2"}) == 0
@pytest.mark.parametrize("patch", [
{"intent_version": "0.1.0"},
{"rationale": "The v0.5 scope rule is historical provenance."},
{"framework": "Historical v0.7 reference; standard identity is separate."},
])
def test_reference_detector_allows_own_versions_and_prose(tmp_path, monkeypatch, patch):
assert _run_with(tmp_path, monkeypatch, patch, {}) == 0
@pytest.mark.parametrize("patch", [
{"standard_version_reviewed": "0.7"},
{"version_of_companion": "0.2"},
{"standard": "security-layer-model v0.7"},
{"companion": ["security companion 0.2"]},
{"references": [{"path": "unrelated-document-v1.2.md"}]},
{"references": ["security-layer-model@0.7"]},
])
def test_reference_detector_rejects_nested_and_identity_pins(tmp_path, monkeypatch, patch):
assert _run_with(tmp_path, monkeypatch, {}, patch) == 2
def test_stance_and_classification_versions_are_not_reached():
"""GH-DEC-2026-020 §3: stance maps and classifications keep their version,
and the checker never applies A12 to them."""
@ -198,7 +219,7 @@ def test_stance_and_classification_versions_are_not_reached():
for path in (STANCE, CLASSIFICATION):
data = yaml.safe_load(path.read_text(encoding="utf-8"))
# Each carries a version A12 would reject if it were applied there...
assert checker._version_hits(data), f"{path.name} keeps its standard_version"
assert checker.find_version_pins(data), f"{path.name} keeps its standard_version"
# ...and the real-tree run still passes: A12 is not applied to them.
result = subprocess.run(
[sys.executable, str(SCRIPT)], cwd=ROOT, capture_output=True, text=True, check=False