tegwick
9fd05d09fe
The checker now prints VALIDATED_AGAINST and its scope on every run, including the OK line (kings-guard pattern). A12 detection widens from the key name standard_version to every key and value of INTENT.md frontmatter and layer.yaml: versioned standard:/companion: paths, companion_version, and any *_version key except schema_version. Comments and non-declaration files are not reached. Declaration unchanged; gate-house confirmed it conforms. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 63291@bnt-lap001 Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
230 lines
9.9 KiB
Python
230 lines
9.9 KiB
Python
import contextlib
|
|
import io
|
|
from pathlib import Path
|
|
from tempfile import TemporaryDirectory
|
|
import unittest
|
|
|
|
import yaml
|
|
|
|
from tools import check_layer_conformance as layer
|
|
|
|
|
|
INTENT = """---
|
|
layer: Engine
|
|
role: PIP
|
|
standard: netkingdom-security-layer-model
|
|
---
|
|
|
|
# INTENT
|
|
"""
|
|
|
|
DECL = {
|
|
"layer": "engine",
|
|
"role": "pip",
|
|
"repository": "zone-engine",
|
|
"derived": True,
|
|
"derived_from": "INTENT.md",
|
|
"tooling_contacts": [],
|
|
"unowned_capabilities": [],
|
|
}
|
|
|
|
|
|
def _write_tree(root: Path, *, decl=None, intent=None, tools=None) -> None:
|
|
(root / "layer.yaml").write_text(yaml.safe_dump(decl if decl is not None else DECL))
|
|
(root / "INTENT.md").write_text(intent if intent is not None else INTENT)
|
|
tools_dir = root / "tools"
|
|
tools_dir.mkdir()
|
|
(tools_dir / "noop.py").write_text("import json\n")
|
|
if tools:
|
|
for name, body in tools.items():
|
|
(tools_dir / name).write_text(body)
|
|
|
|
|
|
class LayerDeclarationTest(unittest.TestCase):
|
|
def test_declaration_exists_and_matches_intent(self):
|
|
decl = yaml.safe_load(layer.DECL.read_text())
|
|
intent = layer.load_intent()
|
|
self.assertEqual(decl["repository"], "zone-engine")
|
|
self.assertEqual(decl["layer"], "engine")
|
|
self.assertEqual(decl["role"], "pip")
|
|
self.assertIs(decl["derived"], True)
|
|
self.assertEqual(decl["derived_from"], "INTENT.md")
|
|
self.assertEqual(decl["tooling_contacts"], [])
|
|
self.assertIsNone(decl.get("pep_stance"))
|
|
self.assertEqual(intent["layer"].lower(), "engine")
|
|
self.assertEqual(intent["role"].lower(), "pip")
|
|
self.assertEqual(layer.check_declaration_agrees(decl, intent), [])
|
|
|
|
def test_the_two_forms_agree_once_case_is_folded(self):
|
|
"""A9/A11: assert the fold, not equality; nothing is re-spelled."""
|
|
decl = yaml.safe_load(layer.DECL.read_text())
|
|
intent = layer.load_intent()
|
|
self.assertEqual(layer._norm(decl["layer"]), layer._norm(intent["layer"]))
|
|
self.assertIn(layer._norm(intent["layer"]), layer.LAYER_VOCABULARY)
|
|
|
|
def test_no_declaration_carries_a_standard_version(self):
|
|
"""GH-DEC-2026-017 §5 / A12, in both forms."""
|
|
decl = yaml.safe_load(layer.DECL.read_text())
|
|
self.assertNotIn("standard_version", decl)
|
|
self.assertNotIn("standard_version", layer.load_intent())
|
|
|
|
def test_no_version_anywhere_in_either_form(self):
|
|
"""GH-DEC-2026-020 / A12 r2: no version in any key or value, not only the key name."""
|
|
decl = yaml.safe_load(layer.DECL.read_text())
|
|
self.assertEqual(layer.declaration_versions(decl), [])
|
|
self.assertEqual(layer.declaration_versions(layer.load_intent()), [])
|
|
self.assertNotIn("companion_version", decl)
|
|
self.assertNotIn("companion_version", layer.load_intent())
|
|
|
|
def test_every_run_prints_version_and_scope(self):
|
|
"""GH-DEC-2026-020 §4: the version lives in the run, including the OK line."""
|
|
out = io.StringIO()
|
|
with contextlib.redirect_stdout(out):
|
|
self.assertEqual(layer.main([]), 0)
|
|
text = out.getvalue()
|
|
self.assertIn(f"validated against: {layer.VALIDATED_AGAINST}", text)
|
|
self.assertIn(f"scope: {layer.SCOPE}", text)
|
|
ok = [line for line in text.splitlines() if line.startswith("OK:")]
|
|
self.assertTrue(ok and layer.VALIDATED_AGAINST in ok[0])
|
|
|
|
def test_vocabulary_is_the_closed_four_tokens(self):
|
|
self.assertEqual(layer.LAYER_VOCABULARY, {"taxonomy", "tooling", "engine", "staff"})
|
|
|
|
def test_checker_passes_on_the_real_tree(self):
|
|
code, errors, _reports = layer.evaluate()
|
|
self.assertEqual(code, 0, errors)
|
|
self.assertEqual(errors, [])
|
|
|
|
|
|
class LayerCheckerFailureTest(unittest.TestCase):
|
|
def test_missing_declaration_is_exit_2(self):
|
|
with TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
(root / "INTENT.md").write_text(INTENT)
|
|
(root / "tools").mkdir()
|
|
code, errors, _ = layer.evaluate(root=root)
|
|
self.assertEqual(code, 2)
|
|
self.assertTrue(any("no declaration" in item for item in errors))
|
|
|
|
def test_intent_disagreement_is_exit_2(self):
|
|
with TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
_write_tree(root, intent=INTENT.replace("Engine", "Staff").replace("PIP", "null"))
|
|
code, errors, _ = layer.evaluate(root=root)
|
|
self.assertEqual(code, 2)
|
|
self.assertTrue(any("disagrees" in item for item in errors))
|
|
|
|
def test_case_only_difference_is_conforming(self):
|
|
with TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
_write_tree(root, intent=INTENT.replace("layer: Engine", "layer: ENGINE"))
|
|
code, errors, _ = layer.evaluate(root=root)
|
|
self.assertEqual(code, 0, errors)
|
|
|
|
def test_standard_version_in_either_form_is_exit_2(self):
|
|
with TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
_write_tree(root, decl={**DECL, "standard_version": "0.7"})
|
|
code, errors, _ = layer.evaluate(root=root)
|
|
self.assertEqual(code, 2)
|
|
self.assertTrue(any("standard_version" in item for item in errors))
|
|
with TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
_write_tree(root, intent=INTENT.replace("role: PIP\n", 'role: PIP\nstandard_version: "0.7"\n'))
|
|
code, errors, _ = layer.evaluate(root=root)
|
|
self.assertEqual(code, 2)
|
|
self.assertTrue(any("standard_version" in item for item in errors))
|
|
|
|
def test_sidecar_not_marked_derived_is_exit_2(self):
|
|
for bad in ({**DECL, "derived": False}, {**DECL, "derived_from": "layer.yaml"}):
|
|
with TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
_write_tree(root, decl=bad)
|
|
code, _errors, _ = layer.evaluate(root=root)
|
|
self.assertEqual(code, 2)
|
|
|
|
def test_token_outside_vocabulary_is_exit_2(self):
|
|
with TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
_write_tree(root, intent=INTENT.replace("layer: Engine", "layer: surface"))
|
|
code, errors, _ = layer.evaluate(root=root)
|
|
self.assertEqual(code, 2)
|
|
self.assertTrue(any("closed vocabulary" in item for item in errors))
|
|
|
|
def test_undeclared_tooling_client_is_exit_1(self):
|
|
with TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
_write_tree(root, tools={"vault.py": "import hvac\n\nclient = hvac.Client()\n"})
|
|
code, errors, _ = layer.evaluate(root=root)
|
|
self.assertEqual(code, 1)
|
|
self.assertTrue(any("hvac" in item for item in errors))
|
|
|
|
def test_http_decision_surface_is_exit_1(self):
|
|
with TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
_write_tree(
|
|
root,
|
|
tools={
|
|
"api.py": (
|
|
"import fastapi\n\n"
|
|
"app = fastapi.FastAPI()\n\n"
|
|
"@app.post('/v1/check')\n"
|
|
"def check():\n"
|
|
" return {'allow': True}\n"
|
|
)
|
|
},
|
|
)
|
|
code, errors, _ = layer.evaluate(root=root)
|
|
self.assertEqual(code, 1)
|
|
joined = "\n".join(errors)
|
|
self.assertIn("fastapi", joined)
|
|
self.assertIn("/v1/check", joined)
|
|
|
|
def test_versioned_standard_path_is_exit_2(self):
|
|
with TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
_write_tree(root, intent=INTENT.replace(
|
|
"standard: netkingdom-security-layer-model",
|
|
"standard: net-kingdom/canon/standards/security-layer-model_v0.7.md",
|
|
))
|
|
code, errors, _ = layer.evaluate(root=root)
|
|
self.assertEqual(code, 2)
|
|
self.assertTrue(any("standard" in item and "v0.7" in item for item in errors))
|
|
|
|
def test_companion_version_is_exit_2(self):
|
|
for decl, intent in (
|
|
({**DECL, "companion_version": "0.2"}, INTENT),
|
|
(DECL, INTENT.replace("role: PIP\n", 'role: PIP\ncompanion_version: "0.2"\n')),
|
|
(DECL, INTENT.replace("role: PIP\n", "role: PIP\ncompanion: net-kingdom/SECURITY-COMPANION.md v0.2\n")),
|
|
):
|
|
with TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
_write_tree(root, decl=decl, intent=intent)
|
|
code, errors, _ = layer.evaluate(root=root)
|
|
self.assertEqual(code, 2, errors)
|
|
|
|
def test_versioned_path_nested_in_layer_yaml_is_exit_2(self):
|
|
with TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
_write_tree(root, decl={**DECL, "catalog_entry": {"source": "canon/standards/security-layer-model_v0.8.md"}})
|
|
code, errors, _ = layer.evaluate(root=root)
|
|
self.assertEqual(code, 2)
|
|
|
|
def test_schema_version_and_comments_are_not_reached(self):
|
|
with TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
_write_tree(root, decl={**DECL, "schema_version": "0.1"})
|
|
path = root / "layer.yaml"
|
|
path.write_text("# Framework: security-layer-model_v0.7.md\n" + path.read_text())
|
|
code, errors, _ = layer.evaluate(root=root)
|
|
self.assertEqual(code, 0, errors)
|
|
|
|
def test_non_declaration_files_are_not_read(self):
|
|
"""GH-DEC-2026-020 §3: stance/claims/classification maps keep their versions."""
|
|
with TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
_write_tree(root)
|
|
(root / "pep-stance.yaml").write_text('standard_version: "0.7"\n')
|
|
(root / "pip-claims.yaml").write_text('standard_version: "0.7"\n')
|
|
code, errors, _ = layer.evaluate(root=root)
|
|
self.assertEqual(code, 0, errors)
|