Apply GH-DEC-2026-017 to the layer declaration; close KG-IN-0007.

INTENT.md frontmatter governs and layer.yaml is marked derived from it.
standard_version is removed from both forms (A12). The checker and its
tests change in the same commit: they no longer require the field, they
reject it, they fold case against the four-token vocabulary (A9) instead
of comparing with plain equality, and they still fail a layer disagreement
that survives the fold (A11). Neither layer value is re-spelled.

The ruling answers kings-guard's "validated-against" reading of the field
(§5: version-scoped state belongs in the derived conformance record), so
that version now lives in the checker as VALIDATED_AGAINST and is printed
in every run's output. The standard: path in INTENT.md is unversioned to
match the reference form.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

tests/test_layer_conformance.py

@@ -34,10 +34,91 @@ def test_declaration_exists_and_declares_staff():
     assert DECL.exists(), "no layer.yaml — §11 requires a machine-readable declaration"
     data = yaml.safe_load(DECL.read_text())
     assert data["repository"] == "kings-guard"
-    assert data["layer"] == "staff"
+    # Folded, not equal: §3's vocabulary is case-insensitive (GH-DEC-2026-017 §2).
+    # An equality assertion here would perform the re-spelling the ruling declined.
+    assert data["layer"].lower() == "staff"
     assert data["framework"] == "netkingdom-security-layer-model"
 
 
+def _load_checker():
+    import importlib.util
+
+    spec = importlib.util.spec_from_file_location("check_layer_conformance", SCRIPT)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def _intent_frontmatter() -> dict:
+    lines = (ROOT / "INTENT.md").read_text().splitlines()
+    assert lines[0].strip() == "---"
+    end = lines[1:].index("---") + 1
+    return yaml.safe_load("\n".join(lines[1:end]))
+
+
+def test_intent_governs_and_the_sidecar_is_marked_derived():
+    """GH-DEC-2026-017 §1 / A11: INTENT.md governs; layer.yaml is derived from it."""
+    front = _intent_frontmatter()
+    assert front["layer"].lower() == "staff"
+    data = yaml.safe_load(DECL.read_text())
+    assert data["derived"] is True
+    assert data["derived_from"] == "INTENT.md"
+
+
+def test_no_standard_version_in_either_form():
+    """GH-DEC-2026-017 §5 / A12: a layer declaration carries no standard version."""
+    assert "standard_version" not in _intent_frontmatter()
+    assert "standard_version" not in yaml.safe_load(DECL.read_text())
+    # The validated-against version moved to the conformance record, not away.
+    assert _load_checker().VALIDATED_AGAINST.startswith(
+        "net-kingdom/canon/standards/security-layer-model"
+    )
+
+
+def test_the_two_forms_agree_after_folding_case():
+    """`Staff` in INTENT.md and `staff` in layer.yaml are one value, not a finding."""
+    module = _load_checker()
+    front = _intent_frontmatter()
+    data = yaml.safe_load(DECL.read_text())
+    assert not module.forms_disagree(front["layer"], data["layer"])
+    assert not module.forms_disagree("Staff", "STAFF")
+
+
+def test_a_real_layer_disagreement_survives_the_fold():
+    """The fold must not blind the check: Staff vs Engine is still a finding."""
+    module = _load_checker()
+    assert module.forms_disagree("Staff", "engine")
+
+
+def test_vocabulary_is_the_four_tokens_including_taxonomy():
+    """A9: closed at four tokens; a three-token validator carries the defect."""
+    assert _load_checker().LAYER_VOCABULARY == {"taxonomy", "tooling", "engine", "staff"}
+
+
+def test_checker_rejects_a_declaration_carrying_a_standard_version(tmp_path, monkeypatch):
+    module = _load_checker()
+    decl = tmp_path / "layer.yaml"
+    decl.write_text(DECL.read_text() + '\nstandard_version: "0.7"\n')
+    monkeypatch.setattr(module, "DECL", decl)
+    monkeypatch.setattr(module, "ROOT", tmp_path)
+    with pytest.raises(SystemExit) as exc:
+        module.load_declaration()
+    assert exc.value.code == 2
+
+
+def test_checker_rejects_an_unmarked_sidecar(tmp_path, monkeypatch):
+    module = _load_checker()
+    data = yaml.safe_load(DECL.read_text())
+    data.pop("derived")
+    decl = tmp_path / "layer.yaml"
+    decl.write_text(yaml.safe_dump(data))
+    monkeypatch.setattr(module, "DECL", decl)
+    monkeypatch.setattr(module, "ROOT", tmp_path)
+    with pytest.raises(SystemExit) as exc:
+        module.load_declaration()
+    assert exc.value.code == 2
+
+
 def test_no_tooling_contacts_declared():
     """The blocked-clean position: nothing to declare, because nothing is touched."""
     data = yaml.safe_load(DECL.read_text())