Harden conformance expiry and vocabulary checks

Author: bigboateng

.github/tests/test_repository_contract.py

@@ -16,10 +16,10 @@
 REPO = Path(__file__).resolve().parents[2]
 RUNTIME = REPO / "boatstack"
 CONFIG = REPO / "project.example.json"
-DOMAIN_NEUTRAL_PATTERN = re.compile(
-    r"\b(?:git|repository|worktree|branch|pull request|coding agent|publication)\b",
-    re.IGNORECASE,
-)
+DOMAIN_NEUTRAL_WORDS = {"git", "repository", "worktree", "branch", "publication"}
+DOMAIN_NEUTRAL_PHRASE = re.compile(r"\b(?:pull\s+request|coding\s+agent)\b", re.IGNORECASE)
+GO_IDENTIFIER = re.compile(r"[A-Za-z_][A-Za-z0-9_]*")
+GO_IDENTIFIER_PART = re.compile(r"[A-Z]?[a-z]+|[A-Z]+(?![a-z])|[0-9]+")
 
 
 def go_source_metadata(paths: list[Path]) -> list[dict[str, object]]:
@@ -43,8 +43,18 @@ def go_source_metadata(paths: list[Path]) -> list[dict[str, object]]:
 def domain_vocabulary_hits(paths: list[Path]) -> list[tuple[Path, str]]:
     hits: list[tuple[Path, str]] = []
     for path in paths:
-        for match in DOMAIN_NEUTRAL_PATTERN.finditer(path.read_text()):
+        source = path.read_text()
+        for match in DOMAIN_NEUTRAL_PHRASE.finditer(source):
             hits.append((path, match.group(0).lower()))
+        for identifier in GO_IDENTIFIER.findall(source):
+            if identifier.lower() == "github":
+                continue
+            parts = [
+                part.lower()
+                for component in identifier.split("_")
+                for part in GO_IDENTIFIER_PART.findall(component)
+            ]
+            hits.extend((path, part) for part in parts if part in DOMAIN_NEUTRAL_WORDS)
     return hits
 
 
@@ -430,8 +440,15 @@ def test_general_kernel_is_domain_neutral_and_owns_shared_control_laws(self) ->
         self.assertEqual([], domain_vocabulary_hits(kernel_files))
         with tempfile.TemporaryDirectory() as temporary:
             fixture = Path(temporary) / "domain_leak_test.go"
-            fixture.write_text('package kernel\nconst fixtureDomain = "pull request"\n')
-            self.assertEqual([(fixture, "pull request")], domain_vocabulary_hits([fixture]))
+            for source, token in (
+                ('package kernel\nconst fixtureDomain = "pull request"\n', "pull request"),
+                ("package kernel\ntype gitClient struct{}\n", "git"),
+                ("package kernel\nvar testRepository string\n", "repository"),
+                ("package kernel\ntype worktreeManager struct{}\n", "worktree"),
+            ):
+                with self.subTest(token=token):
+                    fixture.write_text(source)
+                    self.assertEqual([(fixture, token)], domain_vocabulary_hits([fixture]))
 
         boatstack_packages = "github.com/operatorstack/boatstack/boatstack/"
         kernel_package = boatstack_packages + "kernel"

boatstack/kernel/conformance/conformance.go

@@ -256,7 +256,10 @@ func (suite KernelConformance) expiredAuthorityFailsClosed(t *testing.T) {
 func (suite KernelConformance) authorityExpiryInvalidatesPrescription(t *testing.T) {
 	fixture, runtime := suite.fresh(t, SetupBound)
 	transition := fixture.Scenario.AdvanceTransitions[0]
-	request, prescription := resolve(t, runtime, fixture.Scenario, transition, &fixture.Scenario.Objective, fixture.Scenario.Authority)
+	authority := fixture.Scenario.Authority
+	authority.Receipts = append([]kernel.AuthorityReceipt(nil), authority.Receipts...)
+	authority.Receipts[0].ExpiresAt = fixture.Clock.Now().Add(time.Hour)
+	request, prescription := resolve(t, runtime, fixture.Scenario, transition, &fixture.Scenario.Objective, authority)
 	fixture.Scenario.AdvanceClock(2 * time.Hour)
 	before := fixture.Scenario.Snapshot()
 	_, err := runtime.Apply(context.Background(), kernel.ApplyRequest{ResolveRequest: request, Prescription: prescription})

boatstack/kernel/conformance/integer.go

@@ -347,7 +347,7 @@ func newIntegerFixture(setup Setup) KernelConformance {
 		state.Mode, state.ObjectiveBinding, value = "one", &binding, 1
 	}
 	now := time.Date(2026, 8, 12, 10, 0, 0, 0, time.UTC)
-	authority := kernel.Authority{Receipts: []kernel.AuthorityReceipt{{ID: "human-counter", Subject: "fixture", Fingerprint: "fixture-authority", Capabilities: []kernel.Capability{"counter.audit", "counter.increment", "counter.reset", "objective.bind"}, IssuedAt: now.Add(-time.Minute), ExpiresAt: now.Add(time.Hour)}}}
+	authority := kernel.Authority{Receipts: []kernel.AuthorityReceipt{{ID: "human-counter", Subject: "fixture", Fingerprint: "fixture-authority", Capabilities: []kernel.Capability{"counter.audit", "counter.increment", "counter.reset", "objective.bind"}, IssuedAt: now.Add(-time.Minute), ExpiresAt: now.Add(24 * time.Hour)}}}
 	domain := &IntegerDomain{value: value, executions: map[string]int{}}
 	receipts := &MemoryReceipts{}
 	store := &MemoryStateStore{state: state, receipts: receipts}