diff --git a/INTENT.md b/INTENT.md index 62aa122..1e68d02 100644 --- a/INTENT.md +++ b/INTENT.md @@ -2,7 +2,6 @@ layer: Engine role: PIP standard: netkingdom-security-layer-model -standard_version: "0.7" companion: net-kingdom/SECURITY-COMPANION.md --- diff --git a/layer.yaml b/layer.yaml index 4be174b..6e3812f 100644 --- a/layer.yaml +++ b/layer.yaml @@ -2,7 +2,8 @@ # # Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md # Companion: net-kingdom/SECURITY-COMPANION.md v0.2 -# Declaration: INTENT.md (this repository's own voice, §11) +# Declaration: INTENT.md (this repository's own voice, §11). This file is a +# derived artifact and does not govern (GH-DEC-2026-017 §1). # Validate: python3 tools/check_layer_conformance.py # # §11 requires a machine-readable form because prose cannot distinguish a @@ -15,7 +16,9 @@ schema_version: "0.1" framework: netkingdom-security-layer-model -standard_version: "0.7" +# No standard_version: a layer declaration carries none (GH-DEC-2026-017 §5, A12). +derived: true +derived_from: INTENT.md repository: zone-engine layer: engine role: pip diff --git a/tests/test_layer_conformance.py b/tests/test_layer_conformance.py index e1cbfbe..c9d7968 100644 --- a/tests/test_layer_conformance.py +++ b/tests/test_layer_conformance.py @@ -11,7 +11,6 @@ INTENT = """--- layer: Engine role: PIP standard: netkingdom-security-layer-model -standard_version: "0.7" --- # INTENT @@ -21,7 +20,8 @@ DECL = { "layer": "engine", "role": "pip", "repository": "zone-engine", - "standard_version": "0.7", + "derived": True, + "derived_from": "INTENT.md", "tooling_contacts": [], "unowned_capabilities": [], } @@ -45,13 +45,30 @@ class LayerDeclarationTest(unittest.TestCase): self.assertEqual(decl["repository"], "zone-engine") self.assertEqual(decl["layer"], "engine") self.assertEqual(decl["role"], "pip") - self.assertEqual(decl["standard_version"], "0.7") + self.assertIs(decl["derived"], True) + self.assertEqual(decl["derived_from"], "INTENT.md") self.assertEqual(decl["tooling_contacts"], []) self.assertIsNone(decl.get("pep_stance")) self.assertEqual(intent["layer"].lower(), "engine") self.assertEqual(intent["role"].lower(), "pip") self.assertEqual(layer.check_declaration_agrees(decl, intent), []) + def test_the_two_forms_agree_once_case_is_folded(self): + """A9/A11: assert the fold, not equality; nothing is re-spelled.""" + decl = yaml.safe_load(layer.DECL.read_text()) + intent = layer.load_intent() + self.assertEqual(layer._norm(decl["layer"]), layer._norm(intent["layer"])) + self.assertIn(layer._norm(intent["layer"]), layer.LAYER_VOCABULARY) + + def test_no_declaration_carries_a_standard_version(self): + """GH-DEC-2026-017 §5 / A12, in both forms.""" + decl = yaml.safe_load(layer.DECL.read_text()) + self.assertNotIn("standard_version", decl) + self.assertNotIn("standard_version", layer.load_intent()) + + def test_vocabulary_is_the_closed_four_tokens(self): + self.assertEqual(layer.LAYER_VOCABULARY, {"taxonomy", "tooling", "engine", "staff"}) + def test_checker_passes_on_the_real_tree(self): code, errors, _reports = layer.evaluate() self.assertEqual(code, 0, errors) @@ -76,6 +93,43 @@ class LayerCheckerFailureTest(unittest.TestCase): self.assertEqual(code, 2) self.assertTrue(any("disagrees" in item for item in errors)) + def test_case_only_difference_is_conforming(self): + with TemporaryDirectory() as directory: + root = Path(directory) + _write_tree(root, intent=INTENT.replace("layer: Engine", "layer: ENGINE")) + code, errors, _ = layer.evaluate(root=root) + self.assertEqual(code, 0, errors) + + def test_standard_version_in_either_form_is_exit_2(self): + with TemporaryDirectory() as directory: + root = Path(directory) + _write_tree(root, decl={**DECL, "standard_version": "0.7"}) + code, errors, _ = layer.evaluate(root=root) + self.assertEqual(code, 2) + self.assertTrue(any("standard_version" in item for item in errors)) + with TemporaryDirectory() as directory: + root = Path(directory) + _write_tree(root, intent=INTENT.replace("role: PIP\n", 'role: PIP\nstandard_version: "0.7"\n')) + code, errors, _ = layer.evaluate(root=root) + self.assertEqual(code, 2) + self.assertTrue(any("standard_version" in item for item in errors)) + + def test_sidecar_not_marked_derived_is_exit_2(self): + for bad in ({**DECL, "derived": False}, {**DECL, "derived_from": "layer.yaml"}): + with TemporaryDirectory() as directory: + root = Path(directory) + _write_tree(root, decl=bad) + code, _errors, _ = layer.evaluate(root=root) + self.assertEqual(code, 2) + + def test_token_outside_vocabulary_is_exit_2(self): + with TemporaryDirectory() as directory: + root = Path(directory) + _write_tree(root, intent=INTENT.replace("layer: Engine", "layer: surface")) + code, errors, _ = layer.evaluate(root=root) + self.assertEqual(code, 2) + self.assertTrue(any("closed vocabulary" in item for item in errors)) + def test_undeclared_tooling_client_is_exit_1(self): with TemporaryDirectory() as directory: root = Path(directory) diff --git a/tools/check_layer_conformance.py b/tools/check_layer_conformance.py index b136d63..3a70383 100644 --- a/tools/check_layer_conformance.py +++ b/tools/check_layer_conformance.py @@ -12,6 +12,12 @@ frontmatter. This script is what makes that claim checkable: it fails if layer.yaml is missing, disagrees with INTENT.md, or if a Tooling client or decision surface appears under tools/. +Per GH-DEC-2026-017 (amendments A9, A11, A12): INTENT.md governs and +layer.yaml is a derived artifact that must be marked derived and name +INTENT.md as its source; layer values are compared against §3's closed +four-token vocabulary after an ASCII case-fold, and neither form is +re-spelled; neither form carries a standard_version. + The failure it exists to catch is a *convenience* — a live lookup, an OpenBao client, or an /authorize helper "just for this consumer". That is this repository's original §7 falsifier, now statute §6. @@ -72,6 +78,9 @@ HTTP_SURFACE_IMPORTS = { DECISION_PATHS = ("/authorize", "/v1/check", "/v1/authorize") +# §3 as amended by A9: closed, four tokens, case-insensitive. Stored folded. +LAYER_VOCABULARY = {"taxonomy", "tooling", "engine", "staff"} + class ConformanceError(ValueError): """Declaration is missing, unparseable, or disagrees with INTENT.md.""" @@ -97,26 +106,55 @@ def load_declaration(path: Path = DECL) -> dict[str, Any]: raise ConformanceError(f"{path.name} is not parseable: {exc}") from exc if not isinstance(data, Mapping): raise ConformanceError(f"{path.name} must be a mapping") - for key in ("layer", "role", "repository", "tooling_contacts", "standard_version"): + for key in ("layer", "role", "repository", "derived", "derived_from", "tooling_contacts"): if key not in data: raise ConformanceError(f"{path.name} missing required key '{key}' (§11)") + if data["derived"] is not True: + raise ConformanceError( + f"{path.name} must be marked 'derived: true' (§11, GH-DEC-2026-017 §1)" + ) + if data["derived_from"] != "INTENT.md": + raise ConformanceError( + f"{path.name} derives from {data['derived_from']!r}; §11 names INTENT.md" + ) + if "standard_version" in data: + raise ConformanceError( + f"{path.name} carries 'standard_version'; a layer declaration MUST NOT " + "(GH-DEC-2026-017 §5, A12)" + ) return dict(data) def load_intent(path: Path = INTENT) -> dict[str, Any]: if not path.exists(): raise ConformanceError(f"no INTENT.md at {path}") - return _frontmatter(path) + front = _frontmatter(path) + if "layer" not in front: + raise ConformanceError("INTENT.md frontmatter has no 'layer:' key (§11)") + if "standard_version" in front: + raise ConformanceError( + "INTENT.md frontmatter carries 'standard_version'; a layer declaration " + "MUST NOT (GH-DEC-2026-017 §5, A12)" + ) + return front def _norm(value: Any) -> str: - return str(value or "").strip().lower() + """ASCII case-fold (§3 as amended by A9). Only A-Z are folded.""" + text = str(value or "").strip() + return text.translate(str.maketrans("ABCDEFGHIJKLMNOPQRSTUVWXYZ", "abcdefghijklmnopqrstuvwxyz")) def check_declaration_agrees( decl: Mapping[str, Any], intent: Mapping[str, Any] ) -> list[str]: errors: list[str] = [] + for source, value in (("INTENT.md", intent.get("layer")), ("layer.yaml", decl.get("layer"))): + if _norm(value) not in LAYER_VOCABULARY: + errors.append( + f"{source} layer '{value}' is not in §3's closed vocabulary " + f"{sorted(LAYER_VOCABULARY)} (case-insensitive)" + ) if _norm(decl.get("layer")) != "engine": errors.append(f"declared layer is '{decl.get('layer')}', expected 'engine'") if _norm(decl.get("role")) != "pip": @@ -264,7 +302,7 @@ def main(argv: Iterable[str] | None = None) -> int: return 2 print( f"zone-engine — layer {decl['layer']}, role {decl['role']}, " - f"standard v{decl['standard_version']}" + f"derived from {decl['derived_from']}" ) print(f" tooling contacts declared: {len(decl.get('tooling_contacts') or [])}") print(f" pep_stance: {decl.get('pep_stance')!r}")