fw: A8 template migration (drop on_fail: continue) and cp-docs-token/v1 layer (be110e25, 1d7ef09a)

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

tests/invariants/test_cp_docs_token_layer.py

@@ -0,0 +1,56 @@
+"""cp-docs-token/v1 context: env-only step-docs layer (PLN-CLI-16, D-40, AU-59).
+
+The per-step wfcd_ token and CA file are delivered by the dispatcher. The layer
+sets the env contract and ships one context doc; no ESO mount, no init script,
+and no reference to the cp-service-token layer.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+import yaml
+
+_LAYER = (
+    Path(__file__).resolve().parents[2] / "harnesses" / "contexts" / "cp-docs-token" / "v1"
+)
+
+
+def _doc() -> dict:
+    return yaml.safe_load((_LAYER / "harness.yaml").read_text())
+
+
+def test_cp_docs_token_layer_parses_with_env_keys():
+    doc = _doc()
+    assert doc["kind"] == "context"
+    assert doc["name"] == "cp-docs-token"
+    assert doc["version"] == 1
+    assert doc["requires"] == []
+    assert doc["provides"] == ["cp-docs-token"]
+    assert doc["env"] == {
+        "CP_DOCS_TOKEN_FILE": "/run/agent/cp-docs/token",
+        "CP_DOCS_CA_FILE": "/run/agent/cp-docs/ca.crt",
+    }
+
+
+def test_cp_docs_token_layer_declares_no_secrets_and_no_init():
+    doc = _doc()
+    assert not doc.get("secrets_required")
+    assert not doc.get("scripts")
+    assert not (_LAYER / "init.sh").exists()
+
+
+def test_cp_docs_token_layer_context_file_mapping():
+    doc = _doc()
+    assert doc["context_files"] == [
+        {
+            "source": "./CLAUDE.md",
+            "target": "/opt/harness/context/cp-docs-token/CLAUDE.md",
+        }
+    ]
+    assert (_LAYER / "CLAUDE.md").is_file()
+
+
+def test_cp_docs_token_layer_never_mentions_cp_service_token():
+    for path in _LAYER.rglob("*"):
+        if path.is_file():
+            assert "cp-service-token" not in path.read_text(), path