Validate accepted security layer v0.8 owner declaration

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

tests/test_layer_conformance.py

@@ -142,7 +142,7 @@ def test_a_failing_run_still_states_version_and_scope(tmp_path, monkeypatch, cap
         raise AssertionError("a versioned standard: path must fail")
     out = capsys.readouterr()
     assert checker.VALIDATED_AGAINST in out.out and "scope:" in out.out
-    assert "carries a version" in out.err
+    assert "value carries a version" in out.err
 
 
 def test_checker_rejects_a_divergence_that_survives_the_fold(tmp_path, monkeypatch):
@@ -185,3 +185,35 @@ def test_published_stance_equals_shipped_behaviour():
     assert published_stance() == shipped_stance()
     assert set(shipped_stance()) == {"unset", "unreachable", "non_allow", "unknown"}
     assert set(shipped_stance().values()) == {"fail_closed"}
+
+
+def test_accepted_v08_run_provenance_and_catalog_scope():
+    checker = _checker()
+    assert "security-layer-model_v0.8.md" in checker.VALIDATED_AGAINST
+    assert "sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b" in checker.VALIDATED_AGAINST
+    assert "single repository tenant-engine (catalogued in §4)" in checker.SCOPE
+
+
+def test_reference_semantics_propagate_identity_through_nested_sequences():
+    checker = _checker()
+    for data in (
+        {"nested": {"standard": ["Security Layer Model v0.8"]}},
+        {"companion": [["Security Companion 0.3"]]},
+        {"standard": {"alternate": ["Security Layer Model v0.7"]}},
+    ):
+        # A dictionary begins a fresh identity key; only sequence descendants
+        # inherit the immediate standard:/companion: identity in the reference.
+        if isinstance(data.get("standard"), dict):
+            assert checker.find_version_pins(data) == []
+        else:
+            assert checker.find_version_pins(data), data
+    assert checker.find_version_pins({"rationale": "Assented at v0.7; migrated at v0.8."}) == []
+    assert checker.find_version_pins({"intent_version": "0.2.0", "schema_version": "0.1"}) == []
+
+
+def test_ascii_folding_never_discards_non_ascii_letters():
+    checker = _checker()
+    assert checker._fold("Staff") == "staff"
+    assert checker._fold("Engine") == "engine"
+    # Deleting non-ASCII bytes would turn this fifth token into Staff.
+    assert checker._fold("Stαaff") not in checker.LAYER_VOCABULARY