coulomb/gate-house
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Rule what A12 reaches, and where the version goes when it leaves the declaration

Browse source 
Thirteen repositories applied GH-DEC-2026-017 and split on what section 5 reaches.
GH-DEC-2026-020 rules the four questions, with counts re-measured from files.

1. A version-bearing standard: path is a standard version. A12 reaches every key
   and value of the declaration, not a key name. audit-core, user-engine and
   whitehat-security change; the nine that de-versioned made a required change
   and nothing reverts. Comments and schema_version are not reached.
2. companion_version counts. approval-engine removes it; informed-decision's
   removal was required.
3. Stance maps, claims maps and evidence classifications are not reached. Nobody
   changes.
4. Section 11 requires no emitted conformance record, and 017 section 5 was wrong
   to say one exists. A re-runnable checker is sufficient if every run prints the
   version or commit checked against and its scope; kings-guard's constant is the
   reference pattern. Six checkers must print a version; all seven, and
   flex-auth's, must widen past the field name.

Citation: GH-DEC-2026-017 section 5 (body numbering) is canonical; the rationale
part numbers are a summary. whitehat-security was never sent 017 by gate-house,
and that omission is recorded as gate-house's.

A12 is revised as A12 r2 in the amendment set and re-circulated for assent under
GH-WP-0004-T09. No net-kingdom canon file is edited.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
This commit is contained in:
tegwick 2026-09-21 08:29:03 +02:00
parent 760288530d
commit 104f3fc11d
3 changed files with 351 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

55
docs/amendments/v0.8-section-11-declaration-amendments.md
View file

@ -4,7 +4,7 @@
**Publisher:** net-kingdom
**Project family:** NetKingdom security layer
**Status:** drafted — circulating for assent; the v0.8 acceptance flip is held on it (`GH-DEC-2026-019`)
**Version:** 0.1
**Version:** 0.2 — A12 revised as A12 r2 (`GH-DEC-2026-020`); re-circulated for assent
**Date:** 2026-09-21
**Workplan:** `GH-WP-0004`
**Base:** `net-kingdom/canon/standards/security-layer-model_v0.8.md` (proposed, not accepted)
@ -29,7 +29,7 @@ its authority. This document moves them into the statute; it does not decide the
| A9 | §3 | `GH-DEC-2026-017` §2, §3 | T01 |
| A10 | §4, §11 | `GH-DEC-2026-018` §5 | T02 |
| A11 | §11 | `GH-DEC-2026-017` §1, §4 | T03 |
| A12 | §11 | `GH-DEC-2026-017` §5 | T04 |
| A12 r2 | §11 | `GH-DEC-2026-017` §5, `GH-DEC-2026-020` | T04 |
| A13 | §4 | `access-engine` B5, `FLEX-WP-0020` | T05 |
**A note on A2.** The clause A10 repairs is `gate-house`'s own, added as `A2` of the v0.8
@ -172,13 +172,23 @@ outside §4.
---
## A12 — §11, a declaration carries no standard version (T04)
## A12 r2 — §11, a declaration carries no standard version, and a run states the version it checks against (T04)
**Why.** `access-engine` removed `0.7` from its own declaration, enforced the absence by
test, and asked that §11 say so generally rather than leave each repository to work it out.
Every sidecar in the estate carries `standard_version: "0.7"`, including `ops-warden`'s
reference form and the seven repositories that adopted it — so this is the reference form's
field, not one repository's habit.
**Revision note (r2, 2026-09-21).** A12 as first circulated said *"MUST NOT carry a
standard version"*, and every checker in the estate implemented it as *"no key named
`standard_version`"*. Thirteen repositories applied it and split on what it reached: a
version-bearing `standard:` path, a `companion_version`, and `standard_version` in stance
and claims maps. Its second paragraph also sent version-scoped state to a *"derived
conformance record"* that §11 obliges nobody to produce. `GH-DEC-2026-020` rules all four;
r2 states them in the statute. **Assent given to A12 as first circulated is to that text and
is asked again for r2**, not carried over.
**Why.** `access-engine` removed `0.7` from its own declaration, enforced the absence by test,
and asked that §11 say so generally rather than leave each repository to work it out. Every
sidecar in the estate carried `standard_version: "0.7"`, including `ops-warden`'s reference
form and the repositories that adopted it — so this was the reference form's field, not one
repository's habit. The r2 additions exist because a rule stated as a key name was satisfied
by key-name checkers that could not see the same pin under another name.
**Add to §11's "Declaration form" paragraph:**
@ -189,17 +199,36 @@ field, not one repository's habit.
> prevent: assent records assent to a **boundary**, given at the version named, and is not
> assent to the current text.
>
> Version-scoped state belongs in the **derived conformance record**, which under this
> section's derived-artifact rule already MUST name what it derives from and carry the
> version or commit it was derived at.
> **The rule reaches content, not a key name.** The declaration, for this purpose, is every
> key of the `INTENT.md` frontmatter and every key of a derived declaration file. No key or
> value of either carries a version of this standard **or of its companion** — including a
> version carried in a path or file name, such as a `standard:` key naming
> `…security-layer-model_v0.7.md`. Comments, and the version of a declaration file's own
> schema, are not versions of this standard and are not reached.
>
> **The rule reaches the declaration only.** A stance map, claims map, or evidence
> classification states a position on clause text, which is version-scoped as a layer is
> not, and it SHOULD carry the version of the text it answers; this rule does not apply to
> it and a conformance run MUST NOT apply it there.
>
> **Version-scoped state belongs to the conformance run.** Every run MUST state, in its
> output, the version or commit of this standard it checked against and its scope. A checker
> re-run on demand satisfies this by stating both on every run; no declaring repository is
> required to emit a durable conformance record. Where a run's output is **retained or
> relied upon**, the retained output is a derived artifact under this section's
> derived-artifact rule, and the party retaining it carries the version or commit it was
> derived at.
>
> If a future revision changes §3's vocabulary such that a declared token no longer denotes
> the same layer, declarations do **not** silently retarget: that revision carries a
> re-declaration round, run in this standard's authoring voice. A per-file version pin would
> not have caused anyone to re-read anything.
**Authority.** `GH-DEC-2026-017` §5. Raised by `access-engine` against its own file, which
is where this whole review started.
**Authority.** `GH-DEC-2026-017` §5 — cited by its body section; the decision's
`rationale:` part numbering is a summary and is not cited (`GH-DEC-2026-020` §5) — and
`GH-DEC-2026-020` §1–§4. Raised by `access-engine` against its own file, which is where this
whole review started; the reach questions raised by `approval-engine`, `ops-warden` and
`informed-decision` in applying it, and collected with measured counts by `the-custodian`.
---