Make the B1 survey a command, which immediately falsified B1.

B1 was found with a shell pipeline and published as a finding. The review it
appeared in had already argued that a mechanical check nobody can re-run is an
assertion, and §11's entire claim is mechanical checkability — so asserting B1
unmechanically was that defect committed by the repository reporting it.

tools/survey_layer_declarations.go reads both §11 forms per repository, reports
intra-repository disagreement, and writes a receipt. Run once, it showed the
published B1 was wrong: the estate does not spell layer: three ways across
repositories. The original pipeline took the first ^layer: match per repository
without recording which file it came from, reporting one value where there were
two.

The corrected finding is stronger. Nine of nine repositories carrying both §11
forms declare a different value in each: INTENT.md says Engine/Staff, layer.yaml
says engine/staff. The disagreement is within each repository, between the two
forms §11 permits, and it is universal rather than careless — two generators, two
conventions. Nobody is inconsistent with anybody else.

That relocates the question from casing to precedence: §11 accepts either form
and does not say which governs when both exist and disagree, so a conformance run
reading INTENT.md and one reading layer.yaml reach different answers for nine
repositories while both follow §11. flex-auth is the only declared repository
that cannot exhibit this, and only because it never wrote the second file.

The correction is recorded in the review rather than edited away: a published
review corrected silently is FLEX-DEC-2026-008's defect, and that rule has no
exception for the reviewer.

Four tests cover the disagreement case, the refusal to fold case, a missing
declaration, and the single-form shape that must not read as self-disagreement.
The survey checks only the §3 vocabulary and never applies flex-auth's house
rules to peers.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d

internal/layer/conformance.go

@@ -11,7 +11,7 @@ import (
 	"gopkg.in/yaml.v3"
 )
 
-// Layer vocabulary from security-layer-model_v0.7 §3.
+// Layer vocabulary from the Security Layer Model §3.
 var validLayers = map[string]bool{
 	"Staff":   true,
 	"Engine":  true,
@@ -80,8 +80,14 @@ func LoadDeclaration(path string) (Declaration, error) {
 	if err != nil {
 		return Declaration{}, err
 	}
+	return parseDeclarationYAML(frontmatter)
+}
+
+// parseDeclarationYAML unmarshals a bare declaration document. Shared with the
+// estate survey, which reads layer.yaml files that carry no frontmatter fence.
+func parseDeclarationYAML(doc string) (Declaration, error) {
 	var decl Declaration
-	if err := yaml.Unmarshal([]byte(frontmatter), &decl); err != nil {
+	if err := yaml.Unmarshal([]byte(doc), &decl); err != nil {
 		return Declaration{}, fmt.Errorf("parse layer declaration: %w", err)
 	}
 	return decl, nil

internal/layer/survey.go

@@ -0,0 +1,183 @@
+package layer
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+// Form is one of the two shapes §11 accepts for a declaration: a layer: key in
+// INTENT.md frontmatter, or an equivalent declaration file.
+type Form struct {
+	Source string // path relative to the survey root, "" when the form is absent
+	Layer  string // the layer: value exactly as written
+	Role   string
+	Found  bool
+	// InVocabulary reports whether Layer is in the §3 vocabulary as written.
+	// Deliberately case-sensitive: whether §3 is case-insensitive is the open
+	// question (FLEX-WP-0030 B1), and folding case here would hide it.
+	InVocabulary bool
+}
+
+// SurveyRow is one repository's declaration as observed from outside. It holds
+// BOTH forms, because §11 permits either and does not say which is
+// authoritative when a repository carries both and they disagree.
+type SurveyRow struct {
+	Repo   string
+	Intent Form // INTENT.md frontmatter
+	File   Form // layer.yaml or equivalent
+}
+
+// Declared reports whether any machine-readable form was found.
+func (r SurveyRow) Declared() bool { return r.Intent.Found || r.File.Found }
+
+// SelfDisagrees reports a repository whose two §11 forms state different layer
+// values. Case counts: that is the point of the finding, not an artifact of it.
+func (r SurveyRow) SelfDisagrees() bool {
+	return r.Intent.Found && r.File.Found && r.Intent.Layer != r.File.Layer
+}
+
+// Layer returns the value to report, preferring INTENT.md, which §11 names
+// first. The preference is this survey's, not a ruling — which form governs is
+// exactly what FLEX-WP-0030 B1 asks.
+func (r SurveyRow) Layer() string {
+	if r.Intent.Found {
+		return r.Intent.Layer
+	}
+	return r.File.Layer
+}
+
+var declarationFiles = []string{"layer.yaml", "layer.yml"}
+
+// SurveyDeclarations reads both §11 forms for every repository under root.
+//
+// It checks ONE property: whether each layer: value sits in the §3 vocabulary
+// as written. It deliberately does not apply flex-auth's own declaration rules
+// — pep_stance, tooling_contacts, conformance_record — to any other repository.
+// Those are flex-auth's invariants for flex-auth, and §11 is explicit that a
+// layer stated about a repository by another repository is not a declaration.
+// A survey that graded peers by the surveyor's house rules would be that defect
+// wearing a tool for a hat.
+func SurveyDeclarations(root string, repos []string) ([]SurveyRow, error) {
+	var rows []SurveyRow
+	for _, repo := range repos {
+		row := SurveyRow{Repo: repo}
+		row.Intent = readForm(root, filepath.Join(repo, "INTENT.md"))
+		for _, name := range declarationFiles {
+			if f := readForm(root, filepath.Join(repo, name)); f.Found {
+				row.File = f
+				break
+			}
+		}
+		rows = append(rows, row)
+	}
+	sort.Slice(rows, func(i, j int) bool { return rows[i].Repo < rows[j].Repo })
+	return rows, nil
+}
+
+func readForm(root, rel string) Form {
+	path := filepath.Join(root, rel)
+	if _, err := os.Stat(path); err != nil {
+		return Form{}
+	}
+	decl, err := loadAnyDeclaration(path)
+	if err != nil || strings.TrimSpace(decl.Layer) == "" {
+		return Form{}
+	}
+	return Form{
+		Source:       rel,
+		Layer:        decl.Layer,
+		Role:         decl.Role,
+		Found:        true,
+		InVocabulary: validLayers[decl.Layer],
+	}
+}
+
+// loadAnyDeclaration reads INTENT.md frontmatter or a bare declaration file.
+func loadAnyDeclaration(path string) (Declaration, error) {
+	if strings.HasSuffix(path, ".md") {
+		return LoadDeclaration(path)
+	}
+	body, err := os.ReadFile(path)
+	if err != nil {
+		return Declaration{}, err
+	}
+	return parseDeclarationYAML(string(body))
+}
+
+// Spellings groups every observed layer: value across both forms, so the spread
+// is a result rather than a claim.
+func Spellings(rows []SurveyRow) map[string][]string {
+	out := map[string][]string{}
+	add := func(v, where string) {
+		if v != "" {
+			out[v] = append(out[v], where)
+		}
+	}
+	for _, r := range rows {
+		if r.Intent.Found {
+			add(r.Intent.Layer, r.Repo+"/INTENT.md")
+		}
+		if r.File.Found {
+			add(r.File.Layer, r.File.Source)
+		}
+	}
+	return out
+}
+
+// Undeclared lists repositories with no machine-readable declaration in either form.
+func Undeclared(rows []SurveyRow) []string {
+	var out []string
+	for _, r := range rows {
+		if !r.Declared() {
+			out = append(out, r.Repo)
+		}
+	}
+	return out
+}
+
+// SelfDisagreeing lists repositories whose two §11 forms disagree.
+func SelfDisagreeing(rows []SurveyRow) []SurveyRow {
+	var out []SurveyRow
+	for _, r := range rows {
+		if r.SelfDisagrees() {
+			out = append(out, r)
+		}
+	}
+	return out
+}
+
+// FormatSurvey renders the survey as a stable, diffable report.
+func FormatSurvey(rows []SurveyRow) string {
+	var b strings.Builder
+	fmt.Fprintf(&b, "%-18s %-16s %-16s %s\n", "REPO", "INTENT.md", "DECL FILE", "NOTE")
+	for _, r := range rows {
+		note := ""
+		switch {
+		case !r.Declared():
+			note = "NO DECLARATION (§11)"
+		case r.SelfDisagrees():
+			note = "forms disagree"
+		case !r.Intent.Found:
+			note = "declaration file only"
+		case !r.File.Found:
+			note = "INTENT.md only"
+		}
+		for _, f := range []Form{r.Intent, r.File} {
+			if f.Found && !f.InVocabulary {
+				note += "; outside §3 vocabulary as written"
+			}
+		}
+		fmt.Fprintf(&b, "%-18s %-16s %-16s %s\n", r.Repo, dash(r.Intent.Layer), dash(r.File.Layer), note)
+	}
+	return b.String()
+}
+
+func dash(s string) string {
+	if strings.TrimSpace(s) == "" {
+		return "—"
+	}
+	return s
+}

internal/layer/survey_test.go

@@ -0,0 +1,89 @@
+package layer_test
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/netkingdom/flex-auth/internal/layer"
+)
+
+func writeRepo(t *testing.T, root, name, intent, declFile string) {
+	t.Helper()
+	dir := filepath.Join(root, name)
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if intent != "" {
+		body := "---\nlayer: " + intent + "\nrole: PDP\n---\n\n# x\n"
+		if err := os.WriteFile(filepath.Join(dir, "INTENT.md"), []byte(body), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if declFile != "" {
+		if err := os.WriteFile(filepath.Join(dir, "layer.yaml"), []byte("layer: "+declFile+"\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+// The finding FLEX-WP-0030 B1 rests on: §11 accepts either form and does not
+// say which governs when a repository carries both and they disagree.
+func TestSurveyDetectsFormsDisagreeingWithinOneRepo(t *testing.T) {
+	root := t.TempDir()
+	writeRepo(t, root, "peer", "Engine", "engine")
+
+	rows, err := layer.SurveyDeclarations(root, []string{"peer"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rows) != 1 {
+		t.Fatalf("rows = %d; want 1", len(rows))
+	}
+	if !rows[0].SelfDisagrees() {
+		t.Fatal("Engine vs engine across the two §11 forms was not reported as disagreement")
+	}
+	if got := len(layer.SelfDisagreeing(rows)); got != 1 {
+		t.Fatalf("SelfDisagreeing = %d; want 1", got)
+	}
+}
+
+// Case is not folded: whether §3 is case-insensitive is the open question, and
+// folding here would hide the finding rather than resolve it.
+func TestSurveyDoesNotFoldCase(t *testing.T) {
+	root := t.TempDir()
+	writeRepo(t, root, "peer", "", "engine")
+
+	rows, _ := layer.SurveyDeclarations(root, []string{"peer"})
+	if rows[0].File.InVocabulary {
+		t.Fatal(`"engine" was accepted into the §3 vocabulary; the survey must not fold case`)
+	}
+}
+
+func TestSurveyReportsMissingDeclaration(t *testing.T) {
+	root := t.TempDir()
+	writeRepo(t, root, "silent", "", "")
+
+	rows, _ := layer.SurveyDeclarations(root, []string{"silent"})
+	if rows[0].Declared() {
+		t.Fatal("a repository with neither form was reported as declared")
+	}
+	if got := layer.Undeclared(rows); len(got) != 1 || got[0] != "silent" {
+		t.Fatalf("Undeclared = %v; want [silent]", got)
+	}
+}
+
+// A single well-formed declaration must not be reported as disagreeing with
+// itself — flex-auth is exactly this shape.
+func TestSurveySingleFormIsNotDisagreement(t *testing.T) {
+	root := t.TempDir()
+	writeRepo(t, root, "solo", "Engine", "")
+
+	rows, _ := layer.SurveyDeclarations(root, []string{"solo"})
+	if rows[0].SelfDisagrees() {
+		t.Fatal("a repository with only INTENT.md was reported as self-disagreeing")
+	}
+	if !rows[0].Intent.InVocabulary {
+		t.Fatal(`"Engine" was rejected from the §3 vocabulary`)
+	}
+}