coulomb/zone-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Check accepted layer v0.8 and nested declaration pins

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 02:21:25 +02:00
parent 407fa86b97
commit b5a6f88a82
3 changed files with 85 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

38
tools/check_layer_conformance.py
View file

@ -21,8 +21,9 @@ re-spelled; neither form carries a standard version.
Per GH-DEC-2026-020 (A12 r2), "carries a standard version" is a property of
the content, not of a key name. The declaration is every key and value of the
INTENT.md frontmatter and of layer.yaml; a version-bearing `standard:` or
`companion:` path, a `companion_version`, or any `*_version` key other than
`schema_version` is a pin and fails. Comments and `schema_version` are not
`companion:` path or a key naming a standard/companion version is a pin
and fails. A12 r3 excludes unrelated keys such as intent_version and bare prose
provenance. Comments and `schema_version` are not
reached. Stance, claims, and evidence-classification maps are not
declarations and are never read here. The version belongs to the run: every
run prints VALIDATED_AGAINST and the scope it ranged over.
@ -57,7 +58,10 @@ INTENT = ROOT / "INTENT.md"
# The standard text this checker was built and validated against. A
# declaration carries no version (A12 r2); the run states it instead
# (GH-DEC-2026-020 §4). Bump when re-validated against a newer accepted text.
VALIDATED_AGAINST = "net-kingdom/canon/standards/security-layer-model_v0.7.md"
VALIDATED_AGAINST = (
"net-kingdom/canon/standards/security-layer-model_v0.8.md "
"(accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)"
)
# What a run ranges over. Nothing else in the tree is read; in particular no
# stance, claims, or evidence-classification map (GH-DEC-2026-020 §3).
@ -65,12 +69,12 @@ SCOPE = "INTENT.md frontmatter, layer.yaml (A12 across all keys and values), too
# A12 r2: keys that are version pins. schema_version is the file format's own
# version and is not reached.
VERSION_KEY = re.compile(r"(^|_)version$", re.IGNORECASE)
VERSION_KEY = re.compile(r"(standard|companion).*version|version.*(standard|companion)", re.I)
NOT_REACHED_KEYS = {"schema_version"}
# A version in a path (`..._v0.7.md`, `...-v1.md`) anywhere in a value.
VERSIONED_PATH = re.compile(r"[_-]v\d+(\.\d+)*(\.[A-Za-z]+)?\b", re.IGNORECASE)
VERSIONED_PATH = re.compile(r"[_\-.]v\d+(\.\d+)*(\.md)?\b|@v?\d+\.\d+", re.I)
# A bare version token (`v0.2`, `0.7`) in the value of a standard/companion pin.
PIN_KEYS = {"standard", "companion", "framework"}
PIN_KEYS = {"standard", "companion"}
VERSION_TOKEN = re.compile(r"\bv?\d+\.\d+(\.\d+)*\b", re.IGNORECASE)
TOOLING_IMPORTS = {
@ -160,32 +164,24 @@ def load_intent(path: Path = INTENT) -> dict[str, Any]:
return front
def declaration_versions(data: Any, where: str = "") -> list[str]:
"""Every standard/companion version pin in a declaration (A12 r2).
Walks all keys and values. Comments never reach here (YAML drops them);
schema_version is skipped by name.
"""
def declaration_versions(data: Any, where: str = "", identity: bool = False) -> list[str]:
"""A12 r3 pins; prose provenance and unrelated schema versions are excluded."""
found: list[str] = []
if isinstance(data, Mapping):
for key, value in data.items():
name = str(key)
here = f"{where}.{name}" if where else name
if name.lower() in NOT_REACHED_KEYS:
if name in NOT_REACHED_KEYS:
continue
if VERSION_KEY.search(name):
found.append(f"key '{here}' is a version pin")
continue
if name.lower() in PIN_KEYS and isinstance(value, (str, int, float)):
if VERSION_TOKEN.search(str(value)) or VERSIONED_PATH.search(str(value)):
found.append(f"'{here}: {value}' carries a version")
continue
found.extend(declaration_versions(value, here))
found.extend(declaration_versions(value, here, name.lower() in PIN_KEYS))
elif isinstance(data, list):
for index, item in enumerate(data):
found.extend(declaration_versions(item, f"{where}[{index}]"))
elif isinstance(data, str) and VERSIONED_PATH.search(data):
found.append(f"'{where}: {data}' is a version-bearing path")
found.extend(declaration_versions(item, f"{where}[{index}]", identity))
elif isinstance(data, str) and (VERSIONED_PATH.search(data) or identity and VERSION_TOKEN.search(data)):
found.append(f"'{where}: {data}' carries a standard/companion version")
return found