feat: finish ZONE-WP-0003 Engine/PIP freeze and claim mapping

Declare the layer in layer.yaml, check it against INTENT.md, and fail
make check on a new Tooling client or HTTP decision surface. Record the
six statute §10 artifacts for the 2026-08-23 cut, name access-engine on
the README, and offer a non-schema PIP field mapping to Taxonomy.

Assistant: grok
Assistant-Session: 01a04ceb-0745-7ae1-9e26-0d10e5d52b8b

tests/test_layer_conformance.py

@@ -0,0 +1,106 @@
+from pathlib import Path
+from tempfile import TemporaryDirectory
+import unittest
+
+import yaml
+
+from tools import check_layer_conformance as layer
+
+
+INTENT = """---
+layer: Engine
+role: PIP
+standard: netkingdom-security-layer-model
+standard_version: "0.7"
+---
+
+# INTENT
+"""
+
+DECL = {
+    "layer": "engine",
+    "role": "pip",
+    "repository": "zone-engine",
+    "standard_version": "0.7",
+    "tooling_contacts": [],
+    "unowned_capabilities": [],
+}
+
+
+def _write_tree(root: Path, *, decl=None, intent=None, tools=None) -> None:
+    (root / "layer.yaml").write_text(yaml.safe_dump(decl if decl is not None else DECL))
+    (root / "INTENT.md").write_text(intent if intent is not None else INTENT)
+    tools_dir = root / "tools"
+    tools_dir.mkdir()
+    (tools_dir / "noop.py").write_text("import json\n")
+    if tools:
+        for name, body in tools.items():
+            (tools_dir / name).write_text(body)
+
+
+class LayerDeclarationTest(unittest.TestCase):
+    def test_declaration_exists_and_matches_intent(self):
+        decl = yaml.safe_load(layer.DECL.read_text())
+        intent = layer.load_intent()
+        self.assertEqual(decl["repository"], "zone-engine")
+        self.assertEqual(decl["layer"], "engine")
+        self.assertEqual(decl["role"], "pip")
+        self.assertEqual(decl["standard_version"], "0.7")
+        self.assertEqual(decl["tooling_contacts"], [])
+        self.assertIsNone(decl.get("pep_stance"))
+        self.assertEqual(intent["layer"].lower(), "engine")
+        self.assertEqual(intent["role"].lower(), "pip")
+        self.assertEqual(layer.check_declaration_agrees(decl, intent), [])
+
+    def test_checker_passes_on_the_real_tree(self):
+        code, errors, _reports = layer.evaluate()
+        self.assertEqual(code, 0, errors)
+        self.assertEqual(errors, [])
+
+
+class LayerCheckerFailureTest(unittest.TestCase):
+    def test_missing_declaration_is_exit_2(self):
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            (root / "INTENT.md").write_text(INTENT)
+            (root / "tools").mkdir()
+            code, errors, _ = layer.evaluate(root=root)
+            self.assertEqual(code, 2)
+            self.assertTrue(any("no declaration" in item for item in errors))
+
+    def test_intent_disagreement_is_exit_2(self):
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            _write_tree(root, intent=INTENT.replace("Engine", "Staff").replace("PIP", "null"))
+            code, errors, _ = layer.evaluate(root=root)
+            self.assertEqual(code, 2)
+            self.assertTrue(any("disagrees" in item for item in errors))
+
+    def test_undeclared_tooling_client_is_exit_1(self):
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            _write_tree(root, tools={"vault.py": "import hvac\n\nclient = hvac.Client()\n"})
+            code, errors, _ = layer.evaluate(root=root)
+            self.assertEqual(code, 1)
+            self.assertTrue(any("hvac" in item for item in errors))
+
+    def test_http_decision_surface_is_exit_1(self):
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            _write_tree(
+                root,
+                tools={
+                    "api.py": (
+                        "import fastapi\n\n"
+                        "app = fastapi.FastAPI()\n\n"
+                        "@app.post('/v1/check')\n"
+                        "def check():\n"
+                        "    return {'allow': True}\n"
+                    )
+                },
+            )
+            code, errors, _ = layer.evaluate(root=root)
+            self.assertEqual(code, 1)
+            joined = "\n".join(errors)
+            self.assertIn("fastapi", joined)
+            self.assertIn("/v1/check", joined)