Isolate tenant readback cache and prepare verified runtime release
Some checks failed
CI Smoke / host-smoke (push) Successful in 1s
CI Smoke / container-smoke (push) Successful in 2s
Build and Publish Container Image / build-and-push (push) Successful in 1m33s
Account journey acceptance / journeys (push) Failing after 7s

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 01:58:45 +02:00
parent c460e2b0df
commit 1bb7cacc98
10 changed files with 188 additions and 13 deletions

View file

@ -31,12 +31,11 @@ sys.path.insert(0, str(ROOT / "src"))
from user_engine.layer_yaml import load_mapping, load_mapping_text # noqa: E402
# What every run checks against, printed on every run (GH-DEC-2026-020 §4,
# GH-DEC-2026-021 §2). The accepted text is v0.7 at net-kingdom@66dc491; the
# decision records whose rulings this checker enforces beyond v0.7 are named with it.
# GH-DEC-2026-021 §2). The accepted v0.8 cut incorporates A9-A13 and GH024;
# its immutable publication artifact digest is named in each run.
VALIDATED_AGAINST = (
"net-kingdom/canon/standards/security-layer-model_v0.7.md (net-kingdom@66dc491) "
"as amended by GH-DEC-2026-017, GH-DEC-2026-020 and GH-DEC-2026-021 "
"(A9-A13, A12 r3; gate-house@39d9287)"
"net-kingdom/canon/standards/security-layer-model_v0.8.md "
"(accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)"
)
# What every run ranges over. Stance, claims and classification maps
@ -148,6 +147,9 @@ def load_intent_layer() -> str:
if "layer" not in front:
print(f"FAIL: {INTENT.name} frontmatter has no 'layer:' key (§11)", file=sys.stderr)
raise SystemExit(2)
if fold(front.get("role", "")) != "pip":
print("FAIL: INTENT.md governing role disagrees with derived Engine/PIP declaration", file=sys.stderr)
raise SystemExit(2)
return str(front["layer"])