Apply GH-DEC-2026-020: de-version the INTENT.md standard: path.

A12 r2 reaches every key and value of the declaration, so the _v0.7
inside the standard: path is a standard version. The path is now
canon/standards/security-layer-model. Comments and schema_version are
not reached and are left as they were.

The conformance test now fails on a version anywhere in either form of
the declaration, including a versioned standard: path and
companion_version, and carries a self-test that it catches those forms.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

INTENT.md

@@ -4,7 +4,7 @@
 # and the full conformance map: layer.yaml
 layer: Engine
 role: Evidence
-standard: canon/standards/security-layer-model_v0.7.md
+standard: canon/standards/security-layer-model
 declared_by: intakes/intakes.md AUDIT-IN-0001
 declared_at: "2026-08-29"
 ---

tests/test_layer_conformance.py

@@ -7,6 +7,7 @@ nobody checks decays into a list nobody updates. These tests make the claim of
 totality mechanical.
 """
 
+import re
 from pathlib import Path
 
 import pytest
@@ -181,3 +182,55 @@ def test_the_two_forms_agree_after_folding_and_nobody_re_spells():
 def test_no_standard_version_in_either_form():
     assert "standard_version" not in LAYER
     assert "standard_version" not in _intent_frontmatter()
+
+
+# GH-DEC-2026-020 (A12 r2): A12 reaches every key and value of the declaration,
+# so a version inside the `standard:` path counts, and so does
+# `companion_version`. Comments and `schema_version` are not reached. Stance,
+# claims and classification maps are not declaration files and are not checked.
+_VERSION = re.compile(r"(?i)(?:_v|\bv)\d+(?:\.\d+)+|\b\d+\.\d+(?:\.\d+)?\b")
+_NOT_REACHED = {"schema_version"}
+
+
+def _walk(node, path=""):
+    if isinstance(node, dict):
+        for key, value in node.items():
+            if key in _NOT_REACHED:
+                continue
+            yield f"{path}.{key}", str(key)
+            yield from _walk(value, f"{path}.{key}")
+    elif isinstance(node, list):
+        for i, value in enumerate(node):
+            yield from _walk(value, f"{path}[{i}]")
+    elif isinstance(node, str):
+        yield path, node
+
+
+def _standard_versions(declaration: dict) -> list[str]:
+    found = [p for p, text in _walk(declaration) if _VERSION.search(text)]
+    if "companion_version" in declaration:
+        found.append(".companion_version")
+    return found
+
+
+@pytest.mark.parametrize("form", ["INTENT.md", "layer.yaml"])
+def test_no_version_anywhere_in_the_declaration(form):
+    declaration = _intent_frontmatter() if form == "INTENT.md" else LAYER
+    assert "companion_version" not in declaration
+    standard = declaration.get("standard")
+    if standard is not None:
+        assert not _VERSION.search(str(standard)), standard
+    assert _standard_versions(declaration) == []
+
+
+def test_the_version_check_catches_what_a12_r2_rules():
+    """The check must fail on the forms GH-DEC-2026-020 names, not only on a
+    key literally named `standard_version`."""
+    assert _standard_versions(
+        {"standard": "canon/standards/security-layer-model_v0.7.md"}
+    )
+    assert _standard_versions({"companion_version": "0.3"})
+    assert _standard_versions({"standard_version": "0.8"})
+    assert not _standard_versions(
+        {"standard": "canon/standards/security-layer-model", "schema_version": "0.1"}
+    )