Make the layer declaration a boundary, and review the boundaries it implies.

INTENT.md pinned standard_version: "0.7" in the frontmatter §11 requires. That
conflated two things the standard separates itself: assent "records assent to a
BOUNDARY, given at the version named. It is not assent to the current text."
flex-auth is Engine/PDP at v0.6, v0.7, v0.8 and after; the role does not change
when the text is amended. The field was also decorative — parsed into
Declaration.StandardVersion and never validated — so the version was load-bearing
only via a test asserting it equalled 0.7.

That test is inverted rather than deleted: internal/layer now rejects a version
pin in the declaration and requires conformance_record to name a file that
exists. Version-scoped state moves to docs/conformance/security-layer-conformance.md,
a derived artifact carrying what it derives from and the version derived at, as
§11 requires of derived artifacts.

SCOPE.md: gap assessment replaces "conforming with one declared gap" with three
gaps, each with an owner and a route. G2 is new — flex-auth declares no emission
guarantee where §11 requires one of every §4 source of evidence. It is recorded
as a gap rather than as conformance because the flattering reading, that
audit-core is the source and flex-auth merely produces, has been asserted by
nobody but flex-auth. Also corrects the stance register from two rows to five.

Fixing one line meant reading what the declaration asserts, and a boundary is
only half held here. docs/conformance/boundaries-review.md checks the other
halves across twelve counterparts and finds four security-relevant repositories
with no layer declaration at all — including key-cape, the identity source whose
claims flex-auth consumes as normative input. That boundary is asserted from one
side only. Recorded as unstated, never as agreed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d

internal/layer/conformance.go

@@ -37,9 +37,15 @@ type Declaration struct {
 	Layer           string `yaml:"layer"`
 	Role            string `yaml:"role"`
 	Framework       string `yaml:"framework"`
-	StandardVersion string `yaml:"standard_version"`
 	DeclaredBy      string `yaml:"declared_by"`
 	DeclaredAt      string `yaml:"declared_at"`
+	// ConformanceRecord points at the derived, version-stamped conformance state.
+	// The declaration itself is a boundary and carries no standard version.
+	ConformanceRecord string `yaml:"conformance_record"`
+	// StandardVersion must stay empty: a layer is a boundary, and the standard
+	// says assent is "to a BOUNDARY, given at the version named. It is not
+	// assent to the current text."
+	StandardVersion string `yaml:"standard_version"`
 	PepStance       any    `yaml:"pep_stance"`
 	ToolingContacts []any  `yaml:"tooling_contacts"`
 }
@@ -98,6 +104,12 @@ func ValidateDeclaration(decl Declaration) error {
 	if decl.PepStance != nil {
 		return fmt.Errorf("flex-auth is not PEP-shaped; pep_stance must be null")
 	}
+	if strings.TrimSpace(decl.StandardVersion) != "" {
+		return fmt.Errorf("layer declaration must carry no standard_version: a layer is a boundary, not a version-scoped claim; version-stamped state belongs in conformance_record (got %q)", decl.StandardVersion)
+	}
+	if strings.TrimSpace(decl.ConformanceRecord) == "" {
+		return fmt.Errorf("layer declaration must name a conformance_record: §11 requires a derived artifact to carry the version it was derived at")
+	}
 	return nil
 }
 

internal/layer/conformance_test.go

@@ -1,6 +1,7 @@
 package layer_test
 
 import (
+	"os"
 	"path/filepath"
 	"runtime"
 	"testing"
@@ -27,8 +28,28 @@ func TestLayerDeclarationConforms(t *testing.T) {
 	if decl.Framework != "netkingdom-security-layer-model" {
 		t.Fatalf("framework = %q", decl.Framework)
 	}
-	if decl.StandardVersion != "0.7" {
-		t.Fatalf("standard_version = %q; want 0.7", decl.StandardVersion)
+	// The declaration is a boundary and must NOT pin a standard version: the
+	// role does not change when the standard text is amended. Version-scoped
+	// conformance state lives in the derived record named below.
+	if decl.StandardVersion != "" {
+		t.Fatalf("standard_version = %q; want empty (boundary, not version-scoped)", decl.StandardVersion)
+	}
+	if decl.ConformanceRecord == "" {
+		t.Fatal("conformance_record is empty; version-stamped state must have a home")
+	}
+	if _, err := os.Stat(filepath.Join(repoRoot(t), decl.ConformanceRecord)); err != nil {
+		t.Fatalf("conformance_record %q does not exist: %v", decl.ConformanceRecord, err)
+	}
+}
+
+func TestVersionPinInDeclarationIsRejected(t *testing.T) {
+	err := layer.ValidateDeclaration(layer.Declaration{
+		Layer: "Engine", Role: "PDP",
+		ConformanceRecord: "docs/conformance/security-layer-conformance.md",
+		StandardVersion:   "0.8",
+	})
+	if err == nil {
+		t.Fatal("a standard_version pin in the boundary declaration was accepted")
 	}
 }