Apply GH-DEC-2026-020: the checker prints its version and scope, and detects a version anywhere

check_layer_conformance.py now carries VALIDATED_AGAINST and SCOPE and prints
both on every run, the OK line included (kings-guard's pattern, ruling §4).
A12 detection widens from the key `standard_version` to any version in any key
or value of the INTENT.md frontmatter and layer.yaml: a *version* key, a
version-bearing path, or a version in standard/companion/framework
(ruling §1-§2). schema_version, comments and stance/claims files are not
reached (§1, §3). The declaration itself was already conforming; unchanged.

Tests fail if a versioned `standard:` path or a companion_version comes back.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

scripts/check_layer_conformance.py

@@ -9,11 +9,17 @@ This is an Engine (PIP). The checkable claims:
 - both layer values are in §3's closed four-token vocabulary and are compared
   after an ASCII case fold (A9); nothing is re-spelled. A disagreement that
   survives the fold is reported as a finding, not resolved by precedence (A11)
-- neither form carries a standard_version (A12)
+- neither form carries a standard or companion version in any key or value,
+  including a version-bearing `standard:` or `companion:` path (A12 r2,
+  GH-DEC-2026-020 §1-§2). Comments and `schema_version` are not reached, and
+  stance/claims/classification files are out of scope (GH-DEC-2026-020 §3)
 - no pep_stance path
 - no catalogued Tooling client (OpenBao, key-cape, cluster)
 - sqlite3 is this PIP's own store and is allowed
 
+Every run prints the standard text it checks against (VALIDATED_AGAINST) and
+the scope it ranged over (GH-DEC-2026-020 §4: the version belongs to the run).
+
 Exit 0 clean, 1 undeclared Tooling contact, 2 declaration malformed.
 """
 from __future__ import annotations
@@ -26,6 +32,15 @@ from pathlib import Path
 
 import yaml
 
+# The standard text this checker was built and validated against, printed on
+# every run (GH-DEC-2026-020 §4; kings-guard's pattern). A declaration MUST NOT
+# carry this (A12); the run does. Bump it when re-validated against a newer
+# accepted text.
+VALIDATED_AGAINST = (
+    "net-kingdom/canon/standards/security-layer-model_v0.7.md"
+    " (+ GH-DEC-2026-017, GH-DEC-2026-020 / A12 r2)"
+)
+
 # §3 as amended (A9): closed, four tokens, compared after an ASCII case fold.
 LAYER_VOCABULARY = {"taxonomy", "tooling", "engine", "staff"}
 
@@ -40,6 +55,62 @@ SRC = ROOT / "src" / "maturity_engine"
 DECL = ROOT / "layer.yaml"
 INTENT = ROOT / "INTENT.md"
 
+# What this run ranges over. Declaration files only: stance, claims and
+# evidence-classification maps are deliberately NOT in scope (GH-DEC-2026-020 §3).
+SCOPE = "INTENT.md frontmatter, layer.yaml, imports under src/maturity_engine"
+
+# A12 r2: a version anywhere in the declaration, not only a key literally named
+# `standard_version`. `schema_version` is the file format's own version, not a
+# standard version, and is not reached (GH-DEC-2026-020 §1).
+EXEMPT_VERSION_KEYS = {"schema_version"}
+# A version-bearing path or file name, e.g. `security-layer-model_v0.7.md`,
+# `.../v0.2/companion.md`. Matched only against whitespace-free values, so prose
+# notes citing a rule's history are not mistaken for a pin.
+VERSIONED_PATH = re.compile(r"(?i)(?:^|[_\-/.])v\d+(?:\.\d+)*(?:$|[_\-/.])")
+# Keys that name a standard or companion: any version-like token in their value counts.
+STANDARD_KEYS = {"standard", "companion", "framework"}
+BARE_VERSION = re.compile(r"\d+\.\d+")
+
+
+def version_findings(data: object, where: str) -> list[str]:
+    """Every place a standard or companion version appears in a declaration."""
+    found: list[str] = []
+
+    def walk(node: object, path: str, key: str | None) -> None:
+        if isinstance(node, dict):
+            for k, v in node.items():
+                ks = str(k)
+                if ks in EXEMPT_VERSION_KEYS:
+                    continue
+                if "version" in ks.lower():
+                    found.append(f"{where}: key '{path}{ks}' carries a version")
+                walk(v, f"{path}{ks}.", ks)
+        elif isinstance(node, list):
+            for i, v in enumerate(node):
+                walk(v, f"{path}{i}.", key)
+        elif isinstance(node, str):
+            value = node.strip()
+            label = path.rstrip(".")
+            if key and key.lower() in STANDARD_KEYS and BARE_VERSION.search(value):
+                found.append(f"{where}: '{label}' value {value!r} carries a version")
+            elif value and not any(c.isspace() for c in value) and VERSIONED_PATH.search(value):
+                found.append(f"{where}: '{label}' value {value!r} is a version-bearing path")
+
+    walk(data, "", None)
+    return found
+
+
+def _fail_versions(findings: list[str]) -> None:
+    print(
+        "FAIL: a layer declaration MUST NOT carry a standard or companion version, "
+        "in any key or value (GH-DEC-2026-017 §5, GH-DEC-2026-020, A12 r2)",
+        file=sys.stderr,
+    )
+    for line in findings:
+        print(f"  {line}", file=sys.stderr)
+    raise SystemExit(2)
+
+
 TOOLING_IMPORTS = {
     "hvac": "OpenBao / Vault client",
     "bao": "OpenBao client",
@@ -75,13 +146,9 @@ def load_declaration() -> dict:
             file=sys.stderr,
         )
         raise SystemExit(2)
-    if "standard_version" in data:
-        print(
-            f"FAIL: {DECL.name} carries 'standard_version' — a layer declaration MUST NOT "
-            "carry a standard version (GH-DEC-2026-017 §5, A12)",
-            file=sys.stderr,
-        )
-        raise SystemExit(2)
+    findings = version_findings(data, DECL.name)
+    if findings:
+        _fail_versions(findings)
     if _fold(data["layer"]) not in LAYER_VOCABULARY:
         print(
             f"FAIL: {DECL.name} layer {data['layer']!r} is outside §3's closed vocabulary "
@@ -117,13 +184,9 @@ def intent_frontmatter() -> dict:
             file=sys.stderr,
         )
         raise SystemExit(2)
-    if "standard_version" in meta:
-        print(
-            "FAIL: INTENT.md frontmatter carries 'standard_version' — a layer declaration "
-            "MUST NOT carry a standard version (GH-DEC-2026-017 §5, A12)",
-            file=sys.stderr,
-        )
-        raise SystemExit(2)
+    findings = version_findings(meta, "INTENT.md frontmatter")
+    if findings:
+        _fail_versions(findings)
     if _fold(meta["layer"]) not in LAYER_VOCABULARY:
         print(
             f"FAIL: INTENT.md layer {meta['layer']!r} is outside §3's closed vocabulary "
@@ -162,6 +225,9 @@ def main() -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--report", action="store_true")
     args = parser.parse_args()
+    # GH-DEC-2026-020 §4: every run states what it checks against and its scope,
+    # on stdout, before any verdict — so a failing run carries it too.
+    print(f"check_layer_conformance: validated against {VALIDATED_AGAINST}; scope: {SCOPE}")
 
     decl = load_declaration()
     intent = intent_frontmatter()
@@ -197,8 +263,13 @@ def main() -> int:
         print(f"  tooling contacts: {len(decl.get('tooling_contacts') or [])}")
         print(f"  non-tooling clients: {len(decl.get('non_tooling_clients') or [])}")
         print("  pep_stance: none")
+        print(f"  checker validated against: {VALIDATED_AGAINST}")
+        print(f"  scope: {SCOPE}")
     else:
-        print(f"OK: Engine/PIP declaration holds; no catalogued Tooling client in {SRC.relative_to(ROOT)}")
+        print(
+            f"OK: Engine/PIP declaration holds; no catalogued Tooling client in "
+            f"{SRC.relative_to(ROOT)}; validated against {VALIDATED_AGAINST}; scope: {SCOPE}"
+        )
     return 0