coulomb/tenant-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Validate accepted security layer v0.8 owner declaration

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 02:21:25 +02:00
parent b8ee47806d
commit 1dabbcf47d
4 changed files with 144 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

90
scripts/check_layer_conformance.py
View file

@ -51,26 +51,52 @@ SRC = ROOT / "src" / "tenant_engine"
DECL = ROOT / "layer.yaml"
INTENT = ROOT / "INTENT.md"
# The text in force this checker enforces (GH-DEC-2026-020 §4, GH-DEC-2026-021
# §2): the ACCEPTED v0.7 plus the gate-house decisions enforced beyond it. v0.8
# is held under GH-DEC-2026-019 and does not govern, so it is not named here.
# Re-point after the flip (GH-WP-0004-T11).
VALIDATED_AGAINST = ("net-kingdom/canon/standards/security-layer-model_v0.7.md "
"(net-kingdom@66dc491) as amended by GH-DEC-2026-017, "
"GH-DEC-2026-020, GH-DEC-2026-021 (gate-house@39d9287)")
SCOPE = ("declaration = INTENT.md frontmatter + layer.yaml (every key and value); "
# Accepted v0.8 publication; version provenance belongs to this run, never
# the standing layer declaration (§11). Exact publisher artifact is retained
# in net-kingdom/docs/security-layer-v0.8-acceptance.md.
VALIDATED_AGAINST = (
"net-kingdom/canon/standards/security-layer-model_v0.8.md "
"(accepted; sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)"
)
SCOPE = ("single repository tenant-engine (catalogued in §4); "
"declaration = INTENT.md frontmatter + layer.yaml (every key and value); "
"tooling scan = src/tenant_engine/**/*.py; "
"not reached: pep-stance.yaml, pip-claims.yaml, comments, schema_version")
# A12 pin detector, converged on ops-warden's estate reference (GH-DEC-2026-021
# §3). The path pattern deliberately flags a versioned path of any document.
_VERSION_KEY = re.compile(r"(standard|companion).*version|version.*(standard|companion)",
re.IGNORECASE)
_VERSION_IN_VALUE = re.compile(r"[_\-.]v\d+(\.\d+)*(\.md)?\b|@v?\d+\.\d+", re.IGNORECASE)
_EXEMPT_KEYS = {"schema_version"} # the declaration file's own schema, not reached
# 021 §3 addition: an identity-bearing standard:/companion: value carries no version.
_IDENTITY_KEYS = {"standard", "companion"}
_ANY_VERSION = re.compile(r"v?\d+\.\d+", re.IGNORECASE)
# Declaration pin/provenance semantics are the ops-warden estate reference.
VERSION_KEY = re.compile(r"(standard|companion).*version|version.*(standard|companion)", re.I)
VERSION_IN_VALUE = re.compile(r"[_\-.]v\d+(\.\d+)*(\.md)?\b|@v?\d+\.\d+", re.I)
NOT_REACHED_KEYS = {"schema_version"}
IDENTITY_KEYS = {"standard", "companion"}
IDENTITY_VERSION = re.compile(r"\bv?\d+\.\d+", re.I)
def find_version_pins(node, where: str = "", identity: bool = False) -> list[str]:
"""Every place in a parsed declaration that carries a standard/companion version.
Walks every key and value (comments are gone after parsing, which is the
A12 r2 exclusion). Returns human-readable locations; empty means clean.
"""
pins: list[str] = []
if isinstance(node, dict):
for k, v in node.items():
here = f"{where}.{k}" if where else str(k)
if str(k) in NOT_REACHED_KEYS:
continue
if VERSION_KEY.search(str(k)):
pins.append(f"{here} (key names a standard/companion version)")
continue
pins.extend(find_version_pins(v, here, str(k).lower() in IDENTITY_KEYS))
elif isinstance(node, list):
for i, v in enumerate(node):
pins.extend(find_version_pins(v, f"{where}[{i}]", identity))
elif isinstance(node, str) and VERSION_IN_VALUE.search(node):
pins.append(f"{where} = {node!r} (value carries a version)")
elif isinstance(node, str) and identity and IDENTITY_VERSION.search(node):
pins.append(f"{where} = {node!r} (identity-bearing value carries a version)")
return pins
# Catalogued Tooling in statute §4 today: key-cape and OpenBao.
# Import roots that would constitute a direct client of those.
@ -91,37 +117,13 @@ LAYER_VOCABULARY = {"taxonomy", "tooling", "engine", "staff"}
def _fold(value: object) -> str:
"""ASCII case-fold only; two spellings of a token are one token."""
return str(value).translate(str.maketrans("ABCDEFGHIJKLMNOPQRSTUVWXYZ",
return str(value).strip().translate(str.maketrans("ABCDEFGHIJKLMNOPQRSTUVWXYZ",
"abcdefghijklmnopqrstuvwxyz"))
def version_findings(data: object, where: str) -> list[str]:
"""Every pin in a parsed declaration (A12, GH-DEC-2026-021 §1, §3)."""
found: list[str] = []
def walk(node: object, path: str) -> None:
if isinstance(node, dict):
for key, value in node.items():
sub = f"{path}.{key}" if path else str(key)
if str(key) in _EXEMPT_KEYS:
continue
if _VERSION_KEY.search(str(key)):
found.append(f"{where}: key '{sub}' is a version key")
continue
if (_fold(key) in _IDENTITY_KEYS and isinstance(value, str)
and _ANY_VERSION.search(value)):
found.append(f"{where}: '{sub}' carries a version: {value.strip()[:80]!r}")
continue
walk(value, sub)
elif isinstance(node, list):
for i, item in enumerate(node):
walk(item, f"{path}[{i}]")
elif isinstance(node, str):
if _VERSION_IN_VALUE.search(node):
found.append(f"{where}: '{path}' carries a version: {node.strip()[:80]!r}")
walk(data, "")
return found
"""Owner-compatible diagnostics over the estate reference declaration walk."""
return [f"{where}: {finding}" for finding in find_version_pins(data)]
def _reject_versions(data: object, where: str) -> None: