Apply GH-DEC-2026-020: print scope on every run, widen A12 detection.

The checker now prints the standard version and the run's scope first on
every run, pass or fail, and enforces A12 r2 over every key and value of
the INTENT.md frontmatter and layer.yaml, not only a key named
standard_version. Tests fail if a versioned standard: path or a
companion_version comes back. Neither declaration form changed.

KG-DEC-2026-005 records assent to A9, A10, A11 and A13 and returns A12 r2
revised, with one finding: "any value" reaches prose revision citations.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

decisions/decisions.md

@@ -363,3 +363,91 @@ dereferencing a judgment. Argument: `docs/StatuteV08Review.md` F1.
   *Superseded 2026-09-21:* B4 was ruled in `GH-DEC-2026-017` §5 and the field was
   removed under `KG-IN-0007`; the validated-against version now lives in
   `scripts/check_layer_conformance.py` (`VALIDATED_AGAINST`).
+
+## KG-DEC-2026-005 — Apply GH-DEC-2026-020 to the checker; assent to A9, A10, A11 and A13, and return A12 r2 with one finding
+
+```yaml
+id: KG-DEC-2026-005
+kind: decision
+title: Apply GH-DEC-2026-020 to the checker; assent to A9, A10, A11 and A13, and
+  return A12 r2 with one finding
+status: resolved
+owner: codex
+repo: kings-guard
+standard: net-kingdom/canon/standards/security-layer-model_v0.8.md
+source: gate-house docs/amendments/v0.8-section-11-declaration-amendments.md v0.2 (gate-house@104f3fc)
+related:
+- gate-house GH-DEC-2026-020
+- gate-house GH-DEC-2026-017
+- gate-house GH-WP-0004-T09
+- KG-DEC-2026-004
+affects:
+- kings-guard
+- gate-house
+created: '2026-09-21'
+updated: '2026-09-21'
+decided_by: codex
+disposition: 'A9 approved; A10 approved; A11 approved; A12 r2 revised; A13 approved'
+```
+
+## Context
+
+`gate-house` circulated A9–A13 for assent (message `09a2d1cb`), then ruled what A12
+reaches in `GH-DEC-2026-020` and re-circulated A12 as A12 r2 (message `54080f87`),
+asking again because assent to A12 as first circulated does not carry over. Both were
+read from gate-house's committed files at `104f3fc`, not from the messages; the ruling
+and the message agree.
+
+`GH-DEC-2026-020` §4 adopts this repository's `VALIDATED_AGAINST` constant as the
+reference pattern and requires two changes of us: print the run's scope, and widen A12
+detection from the key name `standard_version` to any version in any key or value.
+
+## Applied
+
+`scripts/check_layer_conformance.py` now prints `checking against:` and `scope:` as the
+first two lines of **every** run, before anything can exit — including a malformed-
+declaration failure — and the OK line carries both. A12 is enforced over every key and
+value of the `INTENT.md` frontmatter and `layer.yaml`: any version key other than
+`schema_version`, a versioned standard or companion path or file name, and any version
+token in `standard:`, `companion:` or `framework:`. Comments are not read. Stance,
+claims and classification maps are never read for A12; this repository has none.
+Tests in `tests/test_layer_conformance.py` fail if a versioned `standard:` path or a
+`companion_version` comes back.
+
+Neither declaration form changed. Both were already clean under r2: `standard:` in
+`INTENT.md` was de-versioned under `GH-DEC-2026-017`, and there is no companion version.
+
+## Dispositions
+
+- **A9 — approved.** The four-token closed vocabulary with a mandatory fold is what
+  `KG-IN-0007` needed and what `GH-DEC-2026-017` §2 already governs here.
+- **A10 — approved.** A marking rather than a reading is the right fix. Under it our §4
+  row is *unassessed* until marked, and a run reports it so — which is the answer
+  `KG-IN-0008` asked for: the repository that benefits from the narrow reading does not
+  settle whether published posture is evidence.
+- **A11 — approved.** One finding on wording, not substance: *"A run over §4 and a run
+  over every repository carrying a declaration"* names two estate scopes. Our checker's
+  run is a third, one repository, and prints so. The scope sentence should admit a
+  single-repository run rather than leave it to read as neither.
+- **A13 — approved.**
+- **A12 r2 — revised, one finding.** *"No key or value of either carries a version of
+  this standard"* reaches a revision **citation** in prose as literally as it reaches a
+  pin. `layer.yaml` carries three: `v0.5` in a non-Tooling note, and `v0.6` twice in gap
+  records (`owner_status: access-engine declined (v0.6 §13)`). They are provenance —
+  where a ruling was made, in section numbering that has since moved — and are not
+  readable as a validity condition, which is §5's ground. But the text as written reaches
+  them, and an implementer who reads "any value" literally must fail them. Proposed
+  addition: *"A version reached is one carried as a pin: a version key, or a version in a
+  path, file name, or identity-bearing value naming this standard or its companion. A
+  citation of an earlier revision in a record's prose is provenance and is not reached."*
+  **kings-guard benefits from the narrower reading**, so it is not ours to settle. Until
+  ruled, the checker reports each citation on every run as `NOTE (A12 r2 reach unruled)`
+  and does not fail on it; if the wider reading is ruled, we reword the three values and
+  the checker fails on them. We did not measure other repositories for the same shape.
+
+## Consequences
+
+- `VALIDATED_AGAINST` still names v0.7, the accepted text the checker was validated
+  against. It moves when the checker is re-validated after the v0.8 flip, not before.
+- The pre-existing ruff E501 at the no_standing_credential message in the checker is
+  outside `make lint`'s scope and is not touched here.