Record exact layer review and migrate checker to accepted v0.8

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

docs/conformance/2026-10-11-layer-v08-migration.md

@@ -0,0 +1,31 @@
+---
+type: conformance-record
+derived: true
+derived_from: net-kingdom/canon/standards/security-layer-model_v0.8.md
+derived_source_sha256: "3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b"
+updated: "2026-10-11"
+---
+
+# kings-guard accepted v0.8 checker migration
+
+This owner applies GH-WP-0004-T11's post-flip migration to the confirmed
+accepted NetKingdom v0.8 cut, immutable accepted-1 artifact SHA256
+3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b.
+The checker names that artifact and its local scope in every run. INTENT
+frontmatter remains authoritative and the sidecar remains derived; a
+contradiction is a finding, never hidden by choosing one form. No declaration
+acquires a standard version.
+
+The pin detector follows OpsWarden's A12 r3 reference semantics: standard and
+companion identity values (including nested lists), version-bearing paths and
+standard/companion version keys are pins; unrelated intent/schema/spec versions
+and bare prose provenance are not. Existing local Tooling/contact and capability
+detectors remain in place. Historical version strings in negative fixtures are
+retained. This source migration grants no native capability or runtime authority.
+
+Validation includes the existing local declaration/contact suite and the same
+12-case pin/provenance corpus across all four assigned owners, with exact
+accepted-artifact and scope assertions. The local test counts and staged source
+digests are retained in the coordinating Custodian evidence receipt. Standalone
+checker runs continue to inspect only this repository; no estate-wide compliance
+claim or novel declaration is produced.

docs/reviews/2026-10-10-a11-r2-a12-r3.md

@@ -0,0 +1,75 @@
+# Kings Guard technical owner review — A11 r2 and A12 r3
+
+```yaml
+reviewer: kings-guard-owner (agent kings-guard, codex)
+decision: approved
+reviewed_at: "2026-10-10"
+work_item: KG-WP-ADHOC-2026-10-10-T01
+amendments:
+  - A11 r2
+  - A12 r3
+source_repo: gate-house
+source_revision: 4bd50bfcac850f34e5563ade61fc92103b062f4d
+source_path: docs/amendments/v0.8-section-11-declaration-amendments.md
+source_sha256: 9b454b83c9aeed08ba13dba4d812f5ae6b4293ced9e43088d64cc3cc00b1459d
+section_sha256:
+  A11 r2: 5eac52f955d1dacd1930ff290e4b4d782db9580a431ba350ba278eeb14ab1745
+  A12 r3: 955292aa69f607e7053182fbfee2eb7f29696d38d659251ccccb0de45d77a8e8
+comment: >-
+  INTENT.md's Staff declaration, Responsibility Boundary and Declared engine
+  gaps require one authoritative repository declaration, an agreeing derived
+  sidecar and explicit blocked-clean engine gaps. A11 r2 explicitly permits
+  Kings Guard's single-repository scope and reports outside-catalog runs as
+  voluntary. A12 r3 separates a validity pin from provenance, resolving the
+  precise KG-DEC-2026-005 finding under independent GH-DEC-2026-021 section 1.
+  Approved owner technical review of the exact source revision and section
+  digests above, under KG-WP-ADHOC-2026-10-10-T01; no founder approval or v0.8
+  publication acceptance is recorded here.
+```
+
+The dedicated Kings Guard worker independently read this repository's
+`AGENTS.md` and `INTENT.md`, the exact amendment source and its prior
+`KG-DEC-2026-005` finding. The fleet accepted
+`the-custodian/canon/standards/delegated-owner-review_v0.1.md` permits this
+INTENT-grounded owner review and keeps founder approval as a separate act.
+No human-only reservation for this technical amendment review was found.
+
+A11 r2 preserves Kings Guard's own Staff declaration in `INTENT.md` as the
+source of authority, requires its `layer.yaml` derived form to agree, and
+reports disagreement as a finding. Its new single-repository sentence
+expressly permits this repository's existing checker scope and requires the
+catalog membership statement already printed by that checker. This resolves
+our A11 wording finding in `KG-DEC-2026-005` without changing the Staff boundary.
+
+A12 r3 adopts the distinction requested in `KG-DEC-2026-005`: a version pin
+identifies a standard/companion version to use; a historical citation records
+where a rule came from. Kings Guard benefits from the exemption for three
+sidecar provenance values, so the independent ruling matters.
+`GH-DEC-2026-021` section 1 (resolved by Bernd Worsch; State Hub decision
+`f2e34b44-060c-4367-84bf-0d6d29bc4025`) supplies that ruling. The exact r3 text
+resolves our finding; there is no remaining changes-requested condition for
+these two amendments. Prior r2 dispositions remain immutable history.
+
+Kings Guard continues to judge and propose posture through Engine surfaces.
+This review changes no direct Tooling contact, credential, containment
+actuation, authorization decision/cache, evidence-source classification or
+runtime authority. It covers A11 r2 and A12 r3 alone; it provides no assent to
+other new clause revisions or any unreturned section 9.5 review.
+
+Verification in the Kings Guard checkout on 2026-10-10:
+
+- Exact whole amendment file and both complete section hashes match the
+  retained review unit; Gate House HEAD equals the source revision above.
+- `PYTHONDONTWRITEBYTECODE=1 .venv/bin/python scripts/check_layer_conformance.py`
+  passed, naming accepted v0.7 and Kings Guard's single-repository section 4
+  scope. Declaration forms agree; no direct Tooling client or standing
+  credential was found by this checker.
+- `PYTHONDONTWRITEBYTECODE=1 .venv/bin/python -m pytest tests/test_layer_conformance.py -q -p no:cacheprovider --basetemp=/tmp/security-kings-owner-layer-tests`
+  passed: 25 tests in 1.04 seconds.
+
+The unchanged checker still prints its historical "A12 r2 reach unruled"
+notice for three citations; that wording predates the independent r3 ruling
+and is not a current unresolved finding. This technical review leaves the
+checker and `VALIDATED_AGAINST` at v0.7. Actual v0.8 acceptance/publication and
+post-flip detector convergence are tracked separately by
+`GH-WP-0004-T10`/`GH-WP-0004-T11`.

scripts/check_layer_conformance.py

@@ -23,8 +23,8 @@ case against §3's closed four-token vocabulary, so `Staff` and `staff` agree an
 neither file is re-spelled. A disagreement that survives the fold is reported as
 a finding, not resolved by precedence. Neither form may carry a version of the
 standard or its companion in any key or value (A12 r2, GH-DEC-2026-020 §1–§2):
-not only a key named `standard_version`, but `companion_version`, any other
-version key, and a version-bearing path or file name such as a `standard:` of
+not only a key named `standard_version`, but `companion_version`, another
+key naming a standard/companion version, and a version-bearing path or file name such as a `standard:` of
 `…security-layer-model_v0.7.md`. Comments are not read (YAML drops them) and
 `schema_version` is the sidecar's own schema, so neither is reached. Only
 INTENT.md frontmatter and layer.yaml are read for A12: stance, claims and
@@ -32,9 +32,8 @@ classification maps are not declarations and this run never applies A12 to them
 (GH-DEC-2026-020 §3).
 
 A bare revision citation in a prose value — `layer.yaml` cites "v0.6 §13" as
-provenance in a gap record — is reported on every run, not failed: whether A12 r2's
-"any value" reaches a citation rather than a pin is raised with gate-house by
-kings-guard (see decisions/decisions.md KG-DEC-2026-005), not settled here.
+provenance in a gap record — is reported on every run, not failed. A12 r3
+excludes prose provenance from declaration pins.
 
 Every run prints, first, the standard version this check was built and validated
 against (VALIDATED_AGAINST) and the scope it ranges over (SCOPE), including runs
@@ -67,7 +66,10 @@ INTENT = ROOT / "INTENT.md"
 # from layer.yaml's former `standard_version: "0.7"`, which recorded the same
 # fact in a place the ruling says a declaration must not carry it. Bump it when
 # the checker is re-validated against a newer accepted text.
-VALIDATED_AGAINST = "net-kingdom/canon/standards/security-layer-model_v0.7.md"
+VALIDATED_AGAINST = (
+    "net-kingdom/canon/standards/security-layer-model_v0.8.md "
+    "(accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)"
+)
 
 # The scope every run ranges over, printed on every run (GH-DEC-2026-020 §4, A11).
 # This is a single-repository run, not an estate run: it grades kings-guard, a §4
@@ -77,18 +79,14 @@ SCOPE = (
     "src/kings_guard, repository tree for credential files"
 )
 
-# A12 r2 detection. A key naming a version is a pin, except the sidecar's own
+# A12 r3 detection. A key naming a standard/companion version is a pin; the sidecar's own
 # schema_version. A value naming the standard or companion with a version, or any
 # versioned file name, is a pin. In identity-bearing keys any version token is a
 # pin. A bare "vN.N" elsewhere in a value is a citation: reported, not failed.
 A12_EXEMPT_KEYS = {"schema_version"}
-A12_IDENTITY_KEYS = {"standard", "companion", "framework"}
-A12_PIN_VALUE = re.compile(
-    r"""(?ix)
-    (?:security[-_ ]?layer[-_ ]?model|security[-_ ]?companion)[^\s'"]*?[-_.]v?\d+(?:\.\d+)+
-    | [-_]v\d+(?:\.\d+)*\.(?:md|ya?ml|json)\b
-    """
-)
+A12_IDENTITY_KEYS = {"standard", "companion"}
+A12_VERSION_KEY = re.compile(r"(standard|companion).*version|version.*(standard|companion)", re.I)
+A12_PIN_VALUE = re.compile(r"[_\-.]v\d+(\.\d+)*(\.md)?\b|@v?\d+\.\d+", re.I)
 A12_VERSION_TOKEN = re.compile(r"\bv?\d+\.\d+(?:\.\d+)*\b")
 A12_CITATION = re.compile(r"\bv\d+\.\d+\b")
 
@@ -155,7 +153,7 @@ def a12_findings(node: object, where: str) -> tuple[list[str], list[str]]:
             for k, v in value.items():
                 k_str = str(k)
                 sub = f"{path}.{k_str}" if path else k_str
-                if "version" in k_str.lower() and k_str not in A12_EXEMPT_KEYS:
+                if A12_VERSION_KEY.search(k_str) and k_str not in A12_EXEMPT_KEYS:
                     pins.append(f"{where}: key '{sub}' carries a version")
                 if k_str in A12_EXEMPT_KEYS:
                     continue
@@ -165,11 +163,11 @@ def a12_findings(node: object, where: str) -> tuple[list[str], list[str]]:
             for i, v in enumerate(value):
                 walk(v, f"{path}[{i}]", key)
             return
-        if value is None or isinstance(value, bool):
+        if not isinstance(value, str):
             return
         text = str(value)
         if A12_PIN_VALUE.search(text) or (
-            key in A12_IDENTITY_KEYS and A12_VERSION_TOKEN.search(text)
+            key and key.lower() in A12_IDENTITY_KEYS and A12_VERSION_TOKEN.search(text)
         ):
             pins.append(f"{where}: '{path}' = {text!r} names a versioned standard")
         elif A12_CITATION.search(text):
@@ -354,7 +352,7 @@ def main() -> int:
         + a12_findings(decl, DECL.name)[1]
     )
     for citation in citations:
-        print(f"NOTE (A12 r2 reach unruled, reported not failed): {citation}")
+        print(f"NOTE (A12 r3 provenance, reported not failed): {citation}")
 
     if forms_disagree(governing, decl["layer"]):
         print("", file=sys.stderr)

tests/test_layer_conformance.py

@@ -98,7 +98,6 @@ def test_no_version_anywhere_in_either_form():
         "companion: net-kingdom/SECURITY-COMPANION_v0.2.md",
         'companion_version: "0.2"',
         'standard_version: "0.7"',
-        'spec_version: "0.7"',
     ],
 )
 def test_checker_rejects_a_version_pin_in_intent_frontmatter(tmp_path, monkeypatch, front_extra):

tests/test_layer_v08_convergence.py

@@ -0,0 +1,37 @@
+"""Accepted A12 r3 semantics, retaining local contact scanners and scope."""
+import importlib.util
+from pathlib import Path
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+SCRIPT = ROOT / "scripts/check_layer_conformance.py"
+
+def checker():
+    spec = importlib.util.spec_from_file_location("v08_checker", SCRIPT)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+@pytest.mark.parametrize("value,pinned", [
+    ({"intent_version": "0.3"}, False),
+    ({"spec_version": "0.7"}, False),
+    ({"note": "per v0.6 section 13"}, False),
+    ({"note": "revised 0.7 wording"}, False),
+    ({"schema_version": "0.1"}, False),
+    ({"standard": "security-layer-model 0.8"}, True),
+    ({"STANDARD": ["security-layer-model v0.8"]}, True),
+    ({"companion": [["SECURITY-COMPANION v0.3"]]}, True),
+    ({"nested": {"standard_version": "0.8"}}, True),
+    ({"nested": {"companion_version": "0.3"}}, True),
+    ({"references": ["security-layer-model@0.8"]}, True),
+    ({"references": ["security-layer-model_v0.7.md"]}, True),
+])
+def test_reference_pin_provenance_semantics(value, pinned):
+    module = checker()
+    assert bool(module.a12_findings(value, "test")[0]) is pinned
+
+def test_run_names_exact_accepted_standard_and_scope():
+    module = checker()
+    assert "security-layer-model_v0.8.md" in module.VALIDATED_AGAINST
+    assert "3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b" in module.VALIDATED_AGAINST
+    assert "INTENT.md" in module.SCOPE

workplans/ADHOC-2026-10-10.md

@@ -0,0 +1,37 @@
+---
+id: KG-WP-ADHOC-2026-10-10
+type: workplan
+title: "Review exact A11 r2 and A12 r3 declaration amendments"
+domain: infotech
+repo: kings-guard
+status: finished
+owner: codex
+topic_slug: net-kingdom-security-layer
+created: "2026-10-10"
+updated: "2026-10-10"
+flavor: implementation
+depends_on: []
+state_hub_workstream_id: "c6d3c747-8792-5e80-9297-28c7df0932cc"
+---
+
+## Return Kings Guard technical owner review
+
+```task
+id: KG-WP-ADHOC-2026-10-10-T01
+status: done
+priority: medium
+state_hub_task_id: "68c9a878-12a2-5e35-bc4b-316dd1964feb"
+```
+
+Reviewed Kings Guard's Staff responsibility and blocked-clean boundary in
+`INTENT.md`, its governing declaration and derived sidecar, prior
+`KG-DEC-2026-005`, and the exact Gate House A11 r2/A12 r3 amendment text.
+Owner review: **approved** for both exact revisions, retained in
+`docs/reviews/2026-10-10-a11-r2-a12-r3.md` with source and section digests.
+This completes the repository's technical return for `GH-WP-0004-T09`.
+
+The checker passed against accepted v0.7 and its 25 declaration tests passed.
+No governing declaration, checker version or acceptance field changed.
+Publication/acceptance and post-flip checker convergence remain owned by
+existing `GH-WP-0004-T10` and `GH-WP-0004-T11`; they are separate from this
+review, rather than leftover implementation silently folded into its closure.