whitehat-security/tests/test_layer_declaration.py

import re
from pathlib import Path

# A version of the standard or its companion, anywhere in a key or value:
# `_v0.7`, `v0.8`, `"0.7"` and the like (GH-DEC-2026-017 §5, GH-DEC-2026-020 §1-§2).
VERSION_PATTERN = re.compile(r"(?:^|[^0-9A-Za-z])v?\d+\.\d+(?:\.\d+)?(?![0-9])", re.IGNORECASE)


def _frontmatter():
    text = Path("INTENT.md").read_text(encoding="utf-8")
    assert text.startswith("---\n")
    return text, text.split("---\n", 2)[1]


def _entries(frontmatter):
    for line in frontmatter.splitlines():
        line = line.split(" #", 1)[0].rstrip()  # comments are not reached
        if not line or line.lstrip().startswith("#") or ":" not in line:
            continue
        key, value = line.split(":", 1)
        yield key.strip(), value.strip().strip('"').strip("'")


def test_intent_declares_staff_in_own_voice():
    text, frontmatter = _frontmatter()
    layers = [v for k, v in _entries(frontmatter) if k == "layer"]
    # ASCII case-fold before comparing; nobody re-spells (GH-DEC-2026-017 §2).
    assert [v.casefold() for v in layers] == ["staff"]
    assert "conformance_state: blocked-clean" in frontmatter
    assert "gate-house insert that used to sit here is" in text
    assert "does not author our probes" in text


def test_declaration_carries_no_standard_or_companion_version():
    _, frontmatter = _frontmatter()
    for key, value in _entries(frontmatter):
        if key == "declared_at":
            continue  # a date, not a version of the standard
        assert key not in {"standard_version", "companion_version"}, key
        assert "version" not in key.casefold(), key
        assert not VERSION_PATTERN.search(value), f"{key}: {value}"


def test_version_detector_catches_known_bad_forms():
    bad = [
        'standard: net-kingdom/canon/standards/security-layer-model_v0.7.md',
        'standard_version: "0.7"',
        'companion_version: "0.2"',
        'companion: net-kingdom/SECURITY-COMPANION_v0.2.md',
    ]
    for line in bad:
        key, value = next(_entries(line))
        assert "version" in key or VERSION_PATTERN.search(value), line