Apply gate-house's section 11 rulings: four-token validator, emission guarantee, resource.system.

GH-DEC-2026-017: the validator admitted {Staff, Engine, Tooling}, built from
section 4's catalog rows, and rejected Taxonomy, which section 3.1 defines.
railiance-master was conforming; the validator was the divergent artifact.
Now four tokens, ASCII case folded, section 4's spelling canonical, INTENT.md
governing while form disagreements are still reported, and every run states
its scope (section 11 binds section 4; volunteers are not non-conformances).
Also fixes the survey silently dropping audit-core's layer.yaml by decoding
peers into flex-auth's own struct.

GH-DEC-2026-018: flex-auth is a section 4 source of evidence. G2 closes as a
question and reopens as a dated gap (review 2026-10-19). cadence.yaml
publishes the per-event-class inventory: deny, redact, not_applicable and
audit_only rare load-bearing (heartbeat and reconciliation, rate forbidden);
allow volume load-bearing (expected-rate and reconciliation). INTENT.md
declares source_of_evidence and names it; tests assert both. Delivery is
FLEX-WP-0031.

FLEX-DEC-2026-015: resource.system follows the runtime, not the repository,
answering ops-warden's WARDEN-IN-0003.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

internal/layer/conformance.go

@@ -11,13 +11,46 @@ import (
 	"gopkg.in/yaml.v3"
 )
 
-// Layer vocabulary from the Security Layer Model §3.
-var validLayers = map[string]bool{
-	"Staff":   true,
-	"Engine":  true,
-	"Tooling": true,
+// Layer vocabulary from the Security Layer Model §3, as stated once and closed
+// by amendment A9 (GH-DEC-2026-017 §2 and §3).
+//
+// It has FOUR tokens, not three. The earlier set here admitted
+// {Staff, Engine, Tooling} and rejected Taxonomy — which §3.1 defines, §4
+// catalogues twice (info-tech-canon, net-kingdom), and the standard itself is
+// an instance of. That set was built from §4's role-typed catalog rows rather
+// than from §3's layer table, so it inherited §4's shape and lost §3's fourth
+// row. railiance-master's `Taxonomy` was conforming the whole time and this
+// validator was the divergent artifact; see docs/conformance/boundaries-review.md.
+//
+// The spelling below is §4's Layer column form, which GH-DEC-2026-017 §2 makes
+// canonical. §3's table heading reads `Engines`, plural; the token is `Engine`.
+// Comparison is ASCII case-insensitive and a run MUST fold case before
+// comparing (A9): two spellings of Engine do not describe two boundaries, and a
+// check that reports nine findings about capital letters has buried the one
+// real disagreement it exists to find.
+var canonicalLayers = []string{"Taxonomy", "Tooling", "Engine", "Staff"}
+
+// foldedLayers maps the ASCII-case-folded form of each token to its canonical
+// §4 spelling.
+var foldedLayers = func() map[string]string {
+	m := make(map[string]string, len(canonicalLayers))
+	for _, l := range canonicalLayers {
+		m[strings.ToLower(l)] = l
+	}
+	return m
+}()
+
+// CanonicalLayer folds ASCII case and returns the §4 column spelling of a
+// declared layer value, plus whether the value is in the §3 vocabulary at all.
+// A lowercase declaration is conforming, not tolerated (GH-DEC-2026-017 §2).
+func CanonicalLayer(declared string) (string, bool) {
+	canon, ok := foldedLayers[strings.ToLower(strings.TrimSpace(declared))]
+	return canon, ok
 }
 
+// Vocabulary returns the four §3 tokens in their canonical spelling.
+func Vocabulary() []string { return append([]string(nil), canonicalLayers...) }
+
 // Engine roles from §3.3. An Engine declaration must state one.
 var validEngineRoles = map[string]bool{
 	"PDP": true,
@@ -34,11 +67,11 @@ var toolingPatterns = []*regexp.Regexp{
 
 // Declaration is the machine-readable §11 form carried in INTENT.md frontmatter.
 type Declaration struct {
-	Layer           string `yaml:"layer"`
-	Role            string `yaml:"role"`
-	Framework       string `yaml:"framework"`
-	DeclaredBy      string `yaml:"declared_by"`
-	DeclaredAt      string `yaml:"declared_at"`
+	Layer      string `yaml:"layer"`
+	Role       string `yaml:"role"`
+	Framework  string `yaml:"framework"`
+	DeclaredBy string `yaml:"declared_by"`
+	DeclaredAt string `yaml:"declared_at"`
 	// ConformanceRecord points at the derived, version-stamped conformance state.
 	// The declaration itself is a boundary and carries no standard version.
 	ConformanceRecord string `yaml:"conformance_record"`
@@ -48,6 +81,18 @@ type Declaration struct {
 	StandardVersion string `yaml:"standard_version"`
 	PepStance       any    `yaml:"pep_stance"`
 	ToolingContacts []any  `yaml:"tooling_contacts"`
+	// SourceOfEvidence records whether §4 marks this repository as a source of
+	// evidence (A10). GH-DEC-2026-018 §2 rules that flex-auth is one: custody is
+	// never source, and the decision record is emitted by the repository that
+	// renders the decision.
+	SourceOfEvidence *bool `yaml:"source_of_evidence"`
+	// EmissionGuarantee names the per-event-class emission declaration §11
+	// requires of a marked source. GH-DEC-2026-018 §3 rules that the declaration
+	// is PER EVENT CLASS, not per repository: one guarantee averaged over a
+	// stream holding both a high-volume allow and a rare deny is not a
+	// declaration, and would be satisfied by rate monitoring that cannot see the
+	// deny go missing.
+	EmissionGuarantee string `yaml:"emission_guarantee"`
 }
 
 // Check parses INTENT.md, asserts the Engine/PDP declaration, and scans
@@ -60,6 +105,17 @@ func Check(root string) error {
 	if err := ValidateDeclaration(decl); err != nil {
 		return err
 	}
+	for _, named := range []struct{ field, path string }{
+		{"conformance_record", decl.ConformanceRecord},
+		{"emission_guarantee", decl.EmissionGuarantee},
+	} {
+		if strings.TrimSpace(named.path) == "" {
+			continue
+		}
+		if _, err := os.Stat(filepath.Join(root, named.path)); err != nil {
+			return fmt.Errorf("%s names %q, which is not on disk: §11's derived-artifact rule needs the artifact, not the pointer", named.field, named.path)
+		}
+	}
 	hits, err := ScanToolingClients(root)
 	if err != nil {
 		return err
@@ -95,13 +151,14 @@ func parseDeclarationYAML(doc string) (Declaration, error) {
 
 // ValidateDeclaration asserts §3 vocabulary and Engine-role presence.
 func ValidateDeclaration(decl Declaration) error {
-	if !validLayers[decl.Layer] {
-		return fmt.Errorf("layer %q is not in the §3 vocabulary (Staff, Engine, Tooling)", decl.Layer)
+	canon, ok := CanonicalLayer(decl.Layer)
+	if !ok {
+		return fmt.Errorf("layer %q is not in the §3 vocabulary (%s); the vocabulary is closed and a fifth layer arrives by amending §3, not by declaring one", decl.Layer, strings.Join(canonicalLayers, ", "))
 	}
-	if decl.Layer == "Engine" && !validEngineRoles[decl.Role] {
+	if canon == "Engine" && !validEngineRoles[decl.Role] {
 		return fmt.Errorf("Engine declaration must state role PDP or PIP; got %q", decl.Role)
 	}
-	if decl.Layer != "Engine" && strings.TrimSpace(decl.Role) != "" {
+	if canon != "Engine" && strings.TrimSpace(decl.Role) != "" {
 		return fmt.Errorf("layer %q must not state an Engine role", decl.Layer)
 	}
 	if len(decl.ToolingContacts) > 0 {
@@ -116,6 +173,15 @@ func ValidateDeclaration(decl Declaration) error {
 	if strings.TrimSpace(decl.ConformanceRecord) == "" {
 		return fmt.Errorf("layer declaration must name a conformance_record: §11 requires a derived artifact to carry the version it was derived at")
 	}
+	if decl.SourceOfEvidence == nil {
+		return fmt.Errorf("layer declaration must state source_of_evidence: §4 marks it (A10) and §11's emission check may not infer it — GH-DEC-2026-018 §5")
+	}
+	if *decl.SourceOfEvidence && strings.TrimSpace(decl.EmissionGuarantee) == "" {
+		return fmt.Errorf("a §4 evidence source must name an emission_guarantee declaration, per event class: §11, GH-DEC-2026-018 §3")
+	}
+	if !*decl.SourceOfEvidence && strings.TrimSpace(decl.EmissionGuarantee) != "" {
+		return fmt.Errorf("emission_guarantee is declared but source_of_evidence is false")
+	}
 	return nil
 }
 

internal/layer/conformance_test.go

@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/netkingdom/flex-auth/internal/layer"
+	"gopkg.in/yaml.v3"
 )
 
 func TestLayerDeclarationConforms(t *testing.T) {
@@ -40,6 +41,67 @@ func TestLayerDeclarationConforms(t *testing.T) {
 	if _, err := os.Stat(filepath.Join(repoRoot(t), decl.ConformanceRecord)); err != nil {
 		t.Fatalf("conformance_record %q does not exist: %v", decl.ConformanceRecord, err)
 	}
+	// GH-DEC-2026-018: flex-auth is the §4 source of evidence for the decision
+	// record and owes a per-event-class emission guarantee. The declaration
+	// must say so and must name the published inventory.
+	if decl.SourceOfEvidence == nil || !*decl.SourceOfEvidence {
+		t.Fatal("source_of_evidence must be true: GH-DEC-2026-018 §2")
+	}
+	if decl.EmissionGuarantee == "" {
+		t.Fatal("emission_guarantee is empty; §11 requires it of a §4 evidence source")
+	}
+	if _, err := os.Stat(filepath.Join(repoRoot(t), decl.EmissionGuarantee)); err != nil {
+		t.Fatalf("emission_guarantee %q does not exist: %v", decl.EmissionGuarantee, err)
+	}
+}
+
+// The per-class rule is the operative half of GH-DEC-2026-018 §3: a single
+// repository-level guarantee over a stream carrying both a high-volume allow
+// and a rare deny is an average, not a declaration. Assert the published
+// inventory actually classifies each class, so a later edit cannot collapse it
+// back into one number.
+func TestEmissionInventoryIsPerEventClass(t *testing.T) {
+	root := repoRoot(t)
+	body, err := os.ReadFile(filepath.Join(root, "cadence.yaml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var doc struct {
+		Source  string `yaml:"source"`
+		Classes map[string]struct {
+			Action         string   `yaml:"action"`
+			EvidenceClass  string   `yaml:"evidence_class"`
+			Rarity         string   `yaml:"rarity"`
+			RateMonitoring string   `yaml:"rate_monitoring"`
+			Detection      []string `yaml:"detection"`
+		} `yaml:"classes"`
+	}
+	if err := yaml.Unmarshal(body, &doc); err != nil {
+		t.Fatal(err)
+	}
+	if len(doc.Classes) < 2 {
+		t.Fatal("cadence.yaml declares fewer than two event classes; §11 requires the guarantee per class, not per repository")
+	}
+	for name, c := range doc.Classes {
+		if c.Action == "" || c.EvidenceClass == "" || c.Rarity == "" {
+			t.Errorf("class %q: action, evidence_class and rarity must all be published — a run may not infer them (§11)", name)
+		}
+		// A rare load-bearing class MUST carry heartbeat AND reconciliation and
+		// MUST NOT be covered by rate monitoring.
+		if c.EvidenceClass == "load-bearing" && c.Rarity == "rare" {
+			if c.RateMonitoring != "forbidden" {
+				t.Errorf("class %q is rare load-bearing; rate_monitoring must be forbidden", name)
+			}
+			var heartbeat, reconciliation bool
+			for _, d := range c.Detection {
+				heartbeat = heartbeat || d == "heartbeat"
+				reconciliation = reconciliation || d == "reconciliation"
+			}
+			if !heartbeat || !reconciliation {
+				t.Errorf("class %q is rare load-bearing; it must carry heartbeat AND reconciliation, not either alone", name)
+			}
+		}
+	}
 }
 
 func TestVersionPinInDeclarationIsRejected(t *testing.T) {
@@ -67,6 +129,71 @@ func TestUnknownLayerIsRejected(t *testing.T) {
 	}
 }
 
+// The defect this validator carried: the vocabulary has FOUR tokens and this
+// set admitted three, omitting the layer the standard itself occupies.
+// railiance-master's `Taxonomy` was conforming and the checker was wrong.
+func TestVocabularyHasFourTokensIncludingTaxonomy(t *testing.T) {
+	want := map[string]bool{"Taxonomy": true, "Tooling": true, "Engine": true, "Staff": true}
+	got := layer.Vocabulary()
+	if len(got) != len(want) {
+		t.Fatalf("vocabulary = %v; want the four §3 tokens", got)
+	}
+	for _, tok := range got {
+		if !want[tok] {
+			t.Errorf("unexpected token %q", tok)
+		}
+	}
+	if canon, ok := layer.CanonicalLayer("Taxonomy"); !ok || canon != "Taxonomy" {
+		t.Fatal("Taxonomy was rejected: §3.1 defines it, §4 catalogues it twice, and the standard is an instance of it")
+	}
+}
+
+// GH-DEC-2026-017 §2: comparison is ASCII case-insensitive and a run MUST fold
+// before comparing. A lowercase declaration is conforming, not tolerated.
+func TestVocabularyComparisonFoldsCase(t *testing.T) {
+	for _, in := range []string{"engine", "ENGINE", "Engine", " engine "} {
+		canon, ok := layer.CanonicalLayer(in)
+		if !ok {
+			t.Fatalf("%q was rejected; comparison must fold ASCII case", in)
+		}
+		// §4's column form is canonical, so the folded result reports as `Engine`
+		// however the declaration spelled it.
+		if canon != "Engine" {
+			t.Fatalf("CanonicalLayer(%q) = %q; want the §4 column spelling Engine", in, canon)
+		}
+	}
+	if err := layer.ValidateDeclaration(layer.Declaration{
+		Layer: "engine", Role: "PDP",
+		ConformanceRecord: "docs/conformance/security-layer-conformance.md",
+		SourceOfEvidence:  boolPtr(true), EmissionGuarantee: "cadence.yaml",
+	}); err != nil {
+		t.Fatalf("a lowercase declaration was rejected: %v", err)
+	}
+}
+
+// §3's table heading reads `Engines`, plural, while §4's column reads `Engine`.
+// A9 states the token once and it is §4's. A declaration of `Engines` is a
+// declaration of a token the vocabulary does not have.
+func TestPluralEnginesIsNotTheToken(t *testing.T) {
+	if _, ok := layer.CanonicalLayer("Engines"); ok {
+		t.Fatal("`Engines` was admitted; the token is `Engine`, as §4's Layer column carries it")
+	}
+}
+
+// A §4 evidence source that names no emission guarantee is not conforming.
+func TestEvidenceSourceWithoutEmissionGuaranteeIsRejected(t *testing.T) {
+	err := layer.ValidateDeclaration(layer.Declaration{
+		Layer: "Engine", Role: "PDP",
+		ConformanceRecord: "docs/conformance/security-layer-conformance.md",
+		SourceOfEvidence:  boolPtr(true),
+	})
+	if err == nil {
+		t.Fatal("a marked evidence source with no emission_guarantee was accepted")
+	}
+}
+
+func boolPtr(b bool) *bool { return &b }
+
 func repoRoot(t *testing.T) string {
 	t.Helper()
 	_, file, _, ok := runtime.Caller(0)

internal/layer/survey.go

@@ -6,6 +6,8 @@ import (
 	"path/filepath"
 	"sort"
 	"strings"
+
+	"gopkg.in/yaml.v3"
 )
 
 // Form is one of the two shapes §11 accepts for a declaration: a layer: key in
@@ -15,10 +17,14 @@ type Form struct {
 	Layer  string // the layer: value exactly as written
 	Role   string
 	Found  bool
-	// InVocabulary reports whether Layer is in the §3 vocabulary as written.
-	// Deliberately case-sensitive: whether §3 is case-insensitive is the open
-	// question (FLEX-WP-0030 B1), and folding case here would hide it.
+	// InVocabulary reports whether Layer is in the §3 vocabulary after ASCII
+	// case folding. GH-DEC-2026-017 §2 ruled comparison case-insensitive and
+	// requires a run to fold before comparing, so a lowercase declaration is
+	// conforming rather than tolerated. The earlier field was deliberately
+	// case-sensitive while that was the open question; it is now answered.
 	InVocabulary bool
+	// Canonical is the §4 column spelling of Layer, empty when out of vocabulary.
+	Canonical string
 }
 
 // SurveyRow is one repository's declaration as observed from outside. It holds
@@ -28,20 +34,37 @@ type SurveyRow struct {
 	Repo   string
 	Intent Form // INTENT.md frontmatter
 	File   Form // layer.yaml or equivalent
+	// InCatalog reports whether this repository is a §4 row. §11 binds §4, so a
+	// row that is false can be a volunteer but cannot be a §11 non-conformance.
+	InCatalog bool
 }
 
 // Declared reports whether any machine-readable form was found.
 func (r SurveyRow) Declared() bool { return r.Intent.Found || r.File.Found }
 
 // SelfDisagrees reports a repository whose two §11 forms state different layer
-// values. Case counts: that is the point of the finding, not an artifact of it.
+// values as written. Under GH-DEC-2026-017 §1 a disagreement between the two
+// forms is a finding IN ITS OWN RIGHT and MUST be reported rather than resolved
+// away by precedence: precedence says which value is the repository's answer,
+// it does not say the disagreement did not happen. So case still counts here.
 func (r SurveyRow) SelfDisagrees() bool {
 	return r.Intent.Found && r.File.Found && r.Intent.Layer != r.File.Layer
 }
 
-// Layer returns the value to report, preferring INTENT.md, which §11 names
-// first. The preference is this survey's, not a ruling — which form governs is
-// exactly what FLEX-WP-0030 B1 asks.
+// DisagreesOnLayer reports the stronger case: the two forms name different
+// LAYERS, not merely different spellings of one. Case-folded per A9. Nine of
+// the estate's nine self-disagreements are spelling only, and none of them is
+// this.
+func (r SurveyRow) DisagreesOnLayer() bool {
+	return r.Intent.Found && r.File.Found && r.Intent.Canonical != r.File.Canonical
+}
+
+// Layer returns the repository's answer. INTENT.md governs: GH-DEC-2026-017 §1
+// rules that a layer.yaml or equivalent is a DERIVED artifact under §11's own
+// derived-artifact rule — marked derived, naming INTENT.md, required to agree —
+// and that the declaration-form paragraph gave the declaration a machine-readable
+// FORM, not a second AUTHORITY. That is now a ruling, no longer this survey's
+// preference.
 func (r SurveyRow) Layer() string {
 	if r.Intent.Found {
 		return r.Intent.Layer
@@ -51,6 +74,74 @@ func (r SurveyRow) Layer() string {
 
 var declarationFiles = []string{"layer.yaml", "layer.yml"}
 
+// catalogRows are §4's layer-catalog repositories. §11's obligations attach to
+// estate-authored repositories IN §4; a repository outside it may declare
+// voluntarily, and a run that grades a volunteer is over-scoped
+// (GH-DEC-2026-017 §4, amendment A11). `OpenBao` is a §4 row but is not
+// estate-authored, so no declaration is owed there.
+var catalogRows = map[string]bool{
+	"info-tech-canon": true, "net-kingdom": true, "key-cape": true,
+	"user-engine": true, "tenant-engine": true, "zone-engine": true,
+	"secrets-engine": true, "audit-core": true, "access-engine": true,
+	"approval-engine": true, "maturity-engine": true, "gate-house": true,
+	"ops-mason": true, "ops-warden": true, "kings-guard": true,
+	"whitehat-security": true,
+}
+
+// catalogAliases maps a checkout directory to the §4 row it is. The rename to
+// access-engine is ruled and sequenced (FLEX-DEC-2026-013, FLEX-WP-0020) and
+// has not landed; §4's own note says both names denote the same authority until
+// it does.
+var catalogAliases = map[string]string{"flex-auth": "access-engine"}
+
+// InCatalog reports whether a checkout directory is a §4 catalog row.
+func InCatalog(repo string) bool {
+	if alias, ok := catalogAliases[repo]; ok {
+		repo = alias
+	}
+	return catalogRows[repo]
+}
+
+// Scope is what a conformance run ranged over.
+//
+// §11 as amended by A11 requires a run to STATE its scope: a run over §4 and a
+// run over every repository carrying a declaration answer different questions,
+// and a report that does not say which it did cannot be acted on. That is the
+// same defect as a survey that did not record which file a value came from —
+// the defect this survey was built to remove — one level up.
+type Scope struct {
+	Name      string
+	Statement string
+	Repos     []string
+}
+
+// CatalogScope is a run over the §4 catalog: the set §11's obligations bind.
+func CatalogScope(repos []string) Scope {
+	var in []string
+	for _, r := range repos {
+		if InCatalog(r) {
+			in = append(in, r)
+		}
+	}
+	return Scope{
+		Name:      "§4 catalog",
+		Statement: "estate-authored repositories catalogued in §4. §11's obligations attach here, and only here.",
+		Repos:     in,
+	}
+}
+
+// EstateScope is a run over every repository asked, catalogued or not. It
+// answers a different question from CatalogScope and says so: a repository
+// outside §4 that declares is reported as a volunteer, never as a §11
+// non-conformance.
+func EstateScope(repos []string) Scope {
+	return Scope{
+		Name:      "estate-wide",
+		Statement: "every repository surveyed, catalogued or not. Repositories outside §4 are reported as declared voluntarily, outside catalog scope — never as §11 non-conformances.",
+		Repos:     append([]string(nil), repos...),
+	}
+}
+
 // SurveyDeclarations reads both §11 forms for every repository under root.
 //
 // It checks ONE property: whether each layer: value sits in the §3 vocabulary
@@ -71,6 +162,7 @@ func SurveyDeclarations(root string, repos []string) ([]SurveyRow, error) {
 				break
 			}
 		}
+		row.InCatalog = InCatalog(repo)
 		rows = append(rows, row)
 	}
 	sort.Slice(rows, func(i, j int) bool { return rows[i].Repo < rows[j].Repo })
@@ -86,25 +178,45 @@ func readForm(root, rel string) Form {
 	if err != nil || strings.TrimSpace(decl.Layer) == "" {
 		return Form{}
 	}
+	canon, ok := CanonicalLayer(decl.Layer)
 	return Form{
 		Source:       rel,
 		Layer:        decl.Layer,
 		Role:         decl.Role,
 		Found:        true,
-		InVocabulary: validLayers[decl.Layer],
+		InVocabulary: ok,
+		Canonical:    canon,
 	}
 }
 
+// peerDeclaration is the ONLY shape the survey reads from another repository:
+// layer and role. Decoding a peer into flex-auth's own Declaration applied
+// flex-auth's field types to someone else's file — and when flex-auth's
+// emission_guarantee became a path string, audit-core's list-shaped
+// emission_guarantee failed to decode and its layer.yaml silently vanished
+// from the survey. A surveyor's schema is a house rule too.
+type peerDeclaration struct {
+	Layer string `yaml:"layer"`
+	Role  string `yaml:"role"`
+}
+
 // loadAnyDeclaration reads INTENT.md frontmatter or a bare declaration file.
-func loadAnyDeclaration(path string) (Declaration, error) {
-	if strings.HasSuffix(path, ".md") {
-		return LoadDeclaration(path)
-	}
+func loadAnyDeclaration(path string) (peerDeclaration, error) {
 	body, err := os.ReadFile(path)
 	if err != nil {
-		return Declaration{}, err
+		return peerDeclaration{}, err
 	}
-	return parseDeclarationYAML(string(body))
+	doc := string(body)
+	if strings.HasSuffix(path, ".md") {
+		if doc, err = splitFrontmatter(doc); err != nil {
+			return peerDeclaration{}, err
+		}
+	}
+	var decl peerDeclaration
+	if err := yaml.Unmarshal([]byte(doc), &decl); err != nil {
+		return peerDeclaration{}, fmt.Errorf("parse layer declaration %s: %w", path, err)
+	}
+	return decl, nil
 }
 
 // Spellings groups every observed layer: value across both forms, so the spread
@@ -149,17 +261,38 @@ func SelfDisagreeing(rows []SurveyRow) []SurveyRow {
 	return out
 }
 
-// FormatSurvey renders the survey as a stable, diffable report.
-func FormatSurvey(rows []SurveyRow) string {
+// VolunteerDeclarations lists repositories outside §4 that declared anyway. The
+// correct report for them is "declared voluntarily, outside catalog scope"
+// (GH-DEC-2026-017 §4): treating a volunteer's declaration as a non-conformance
+// is both wrong about who §11 binds and the fastest way to stop getting
+// volunteers.
+func VolunteerDeclarations(rows []SurveyRow) []string {
+	var out []string
+	for _, r := range rows {
+		if !r.InCatalog && r.Declared() {
+			out = append(out, r.Repo)
+		}
+	}
+	return out
+}
+
+// FormatSurvey renders the survey as a stable, diffable report. It leads with
+// the scope because §11 requires a run to state what it ranged over.
+func FormatSurvey(scope Scope, rows []SurveyRow) string {
 	var b strings.Builder
+	fmt.Fprintf(&b, "Scope: %s — %s\n\n", scope.Name, scope.Statement)
 	fmt.Fprintf(&b, "%-18s %-16s %-16s %s\n", "REPO", "INTENT.md", "DECL FILE", "NOTE")
 	for _, r := range rows {
 		note := ""
 		switch {
+		case !r.Declared() && !r.InCatalog:
+			note = "no declaration; outside §4 — none owed"
 		case !r.Declared():
 			note = "NO DECLARATION (§11)"
+		case r.DisagreesOnLayer():
+			note = "forms name DIFFERENT LAYERS; INTENT.md governs"
 		case r.SelfDisagrees():
-			note = "forms disagree"
+			note = "forms disagree on spelling only; INTENT.md governs, still a finding"
 		case !r.Intent.Found:
 			note = "declaration file only"
 		case !r.File.Found:
@@ -167,9 +300,12 @@ func FormatSurvey(rows []SurveyRow) string {
 		}
 		for _, f := range []Form{r.Intent, r.File} {
 			if f.Found && !f.InVocabulary {
-				note += "; outside §3 vocabulary as written"
+				note += "; " + f.Layer + " is outside the closed §3 vocabulary"
 			}
 		}
+		if r.Declared() && !r.InCatalog {
+			note += "; declared voluntarily, outside §4 catalog scope"
+		}
 		fmt.Fprintf(&b, "%-18s %-16s %-16s %s\n", r.Repo, dash(r.Intent.Layer), dash(r.File.Layer), note)
 	}
 	return b.String()

internal/layer/survey_test.go

@@ -48,15 +48,82 @@ func TestSurveyDetectsFormsDisagreeingWithinOneRepo(t *testing.T) {
 	}
 }
 
-// Case is not folded: whether §3 is case-insensitive is the open question, and
-// folding here would hide the finding rather than resolve it.
-func TestSurveyDoesNotFoldCase(t *testing.T) {
+// Case IS folded now. GH-DEC-2026-017 §2 ruled comparison ASCII case-insensitive
+// and requires a run to fold before comparing. This test was the inverse
+// assertion while that was the open question; it is inverted rather than
+// deleted, so the ruling is visible in the place the old behaviour lived.
+func TestSurveyFoldsCaseAfterGHDEC017(t *testing.T) {
 	root := t.TempDir()
 	writeRepo(t, root, "peer", "", "engine")
 
 	rows, _ := layer.SurveyDeclarations(root, []string{"peer"})
-	if rows[0].File.InVocabulary {
-		t.Fatal(`"engine" was accepted into the §3 vocabulary; the survey must not fold case`)
+	if !rows[0].File.InVocabulary {
+		t.Fatal(`"engine" was rejected; a lowercase declaration is conforming, not tolerated`)
+	}
+	if rows[0].File.Canonical != "Engine" {
+		t.Fatalf("Canonical = %q; want the §4 column spelling Engine", rows[0].File.Canonical)
+	}
+}
+
+// The two forms disagreeing only in spelling is still reported — precedence
+// says which value is the repository's answer, it does not say the
+// disagreement did not happen (GH-DEC-2026-017 §1) — but it is not a
+// disagreement about a LAYER.
+func TestSpellingDisagreementIsReportedButIsNotALayerDisagreement(t *testing.T) {
+	root := t.TempDir()
+	writeRepo(t, root, "peer", "Engine", "engine")
+
+	rows, _ := layer.SurveyDeclarations(root, []string{"peer"})
+	if !rows[0].SelfDisagrees() {
+		t.Fatal("the form disagreement was not reported; it is a finding in its own right")
+	}
+	if rows[0].DisagreesOnLayer() {
+		t.Fatal("Engine vs engine was reported as a disagreement about a layer; two spellings of Engine do not describe two boundaries")
+	}
+	if rows[0].Layer() != "Engine" {
+		t.Fatal("INTENT.md governs; the repository's answer is its INTENT.md value")
+	}
+}
+
+// Taxonomy is in the vocabulary, and railiance-master — which declares it and
+// is not a §4 row — is a volunteer, not a non-conformance.
+func TestTaxonomyVolunteerIsInVocabularyAndOutOfScope(t *testing.T) {
+	root := t.TempDir()
+	writeRepo(t, root, "railiance-master", "Taxonomy", "")
+
+	rows, _ := layer.SurveyDeclarations(root, []string{"railiance-master"})
+	if !rows[0].Intent.InVocabulary {
+		t.Fatal("Taxonomy was rejected: §3.1 defines it and §4 catalogues it twice")
+	}
+	if rows[0].InCatalog {
+		t.Fatal("railiance-master was treated as a §4 catalog row")
+	}
+	if got := layer.VolunteerDeclarations(rows); len(got) != 1 || got[0] != "railiance-master" {
+		t.Fatalf("VolunteerDeclarations = %v; want [railiance-master]", got)
+	}
+}
+
+// §11 binds §4, and A11 requires a run to state what it ranged over.
+func TestRunStatesItsScope(t *testing.T) {
+	repos := []string{"flex-auth", "gate-house", "railiance-master"}
+
+	catalog := layer.CatalogScope(repos)
+	if catalog.Statement == "" {
+		t.Fatal("a scope with no statement cannot be acted on")
+	}
+	if len(catalog.Repos) != 2 {
+		t.Fatalf("CatalogScope = %v; want the two §4 rows (flex-auth is the access-engine row)", catalog.Repos)
+	}
+	if !layer.InCatalog("flex-auth") || !layer.InCatalog("access-engine") {
+		t.Fatal("the §4 row resolves under both names until the ruled rename lands")
+	}
+	if layer.InCatalog("railiance-master") {
+		t.Fatal("railiance-master is not a §4 row")
+	}
+
+	estate := layer.EstateScope(repos)
+	if len(estate.Repos) != 3 || estate.Name == catalog.Name {
+		t.Fatal("the estate-wide run and the §4 run must be distinguishable; they answer different questions")
 	}
 }
 
@@ -87,3 +154,21 @@ func TestSurveySingleFormIsNotDisagreement(t *testing.T) {
 		t.Fatal(`"Engine" was rejected from the §3 vocabulary`)
 	}
 }
+
+// A peer's declaration is read for layer and role only. A peer carrying a field
+// flex-auth also uses, in a different shape, must not drop out of the survey.
+func TestPeerWithForeignFieldShapesIsStillSurveyed(t *testing.T) {
+	root := t.TempDir()
+	dir := filepath.Join(root, "audit-core")
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	body := "layer: engine\nrole: evidence\nemission_guarantee:\n  - id: chain-head-attestation\n"
+	if err := os.WriteFile(filepath.Join(dir, "layer.yaml"), []byte(body), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	rows, _ := layer.SurveyDeclarations(root, []string{"audit-core"})
+	if !rows[0].File.Found || rows[0].File.Canonical != "Engine" {
+		t.Fatalf("audit-core's layer.yaml was dropped: %+v", rows[0].File)
+	}
+}