Apply GH-DEC-2026-017: INTENT.md governs, the sidecar is derived, no version

- Remove standard_version from layer.yaml and INTENT.md frontmatter (§5, A12).
- Mark layer.yaml derived: true, derived_from: INTENT.md (§1, A11).
- Checker and tests change in the same commit: standard_version is no longer
  a required key (it is now rejected in either form), the derived marking is
  required, both layer values are checked against the closed four-token
  vocabulary, and the two forms are compared after an ASCII case fold (A9).
  A disagreement surviving the fold is reported as a finding.
- Nothing re-spelled: INTENT.md keeps "Engine", layer.yaml keeps "engine".

Scope check (§9.5 / GH-DEC-2026-017 §4): maturity-engine does not score
layer declarations anywhere. scoring.py grades gap-register conformance
states, and seed gaps concern capabilities, not §11 declarations, so no
non-§4 repository is graded. No scoring change required.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

INTENT.md

@@ -2,7 +2,6 @@
 layer: Engine
 role: PIP
 standard: netkingdom-security-layer-model
-standard_version: "0.7"
 companion: net-kingdom/SECURITY-COMPANION.md
 ---
 

layer.yaml

@@ -1,7 +1,10 @@
 # maturity-engine — NetKingdom security layer declaration
 #
 # Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md
-# Assent:    INTENT.md frontmatter (this repository's own voice, §11)
+# Governs:   INTENT.md frontmatter (this repository's own voice, §11). This
+#            file is a DERIVED artifact of it and does not govern
+#            (GH-DEC-2026-017 §1). No standard version: a layer declaration
+#            MUST NOT carry one (GH-DEC-2026-017 §5).
 # Validate:  python3 scripts/check_layer_conformance.py
 #
 # §11 requires a machine-readable declaration: prose cannot distinguish a
@@ -14,12 +17,13 @@
 
 schema_version: "0.1"
 framework: netkingdom-security-layer-model
-standard_version: "0.7"
 repository: maturity-engine
 layer: engine
 role: pip
 declared_by: INTENT.md
 declared_at: "2026-08-29"
+derived: true
+derived_from: INTENT.md
 
 # §4 catalog entry, transcribed so drift between the catalog and this file is
 # visible. The standard is authoritative for the row; this records what we

scripts/check_layer_conformance.py

@@ -3,8 +3,13 @@
 
 This is an Engine (PIP). The checkable claims:
 
-- layer.yaml declares layer=engine, role=pip
-- INTENT.md frontmatter agrees (case-insensitive)
+- INTENT.md frontmatter declares the layer and governs (GH-DEC-2026-017 §1)
+- layer.yaml is derived: marked `derived: true`, `derived_from: INTENT.md`,
+  and declares layer=engine, role=pip
+- both layer values are in §3's closed four-token vocabulary and are compared
+  after an ASCII case fold (A9); nothing is re-spelled. A disagreement that
+  survives the fold is reported as a finding, not resolved by precedence (A11)
+- neither form carries a standard_version (A12)
 - no pep_stance path
 - no catalogued Tooling client (OpenBao, key-cape, cluster)
 - sqlite3 is this PIP's own store and is allowed
@@ -21,6 +26,15 @@ from pathlib import Path
 
 import yaml
 
+# §3 as amended (A9): closed, four tokens, compared after an ASCII case fold.
+LAYER_VOCABULARY = {"taxonomy", "tooling", "engine", "staff"}
+
+
+def _fold(value: object) -> str:
+    """ASCII case-fold: two spellings of a token are one token."""
+    return str(value).strip().encode("ascii", "ignore").decode().lower()
+
+
 ROOT = Path(__file__).resolve().parents[1]
 SRC = ROOT / "src" / "maturity_engine"
 DECL = ROOT / "layer.yaml"
@@ -45,14 +59,40 @@ def load_declaration() -> dict:
     except yaml.YAMLError as exc:
         print(f"FAIL: {DECL.name} is not parseable: {exc}", file=sys.stderr)
         raise SystemExit(2) from exc
-    for key in ("layer", "role", "repository", "tooling_contacts", "standard_version"):
+    for key in ("layer", "role", "repository", "tooling_contacts", "derived", "derived_from"):
         if key not in data:
             print(f"FAIL: {DECL.name} missing required key '{key}' (§11)", file=sys.stderr)
             raise SystemExit(2)
-    if str(data["layer"]).lower() != "engine":
+    if data["derived"] is not True:
+        print(
+            f"FAIL: {DECL.name} must be marked 'derived: true' (§11, GH-DEC-2026-017 §1)",
+            file=sys.stderr,
+        )
+        raise SystemExit(2)
+    if data["derived_from"] != "INTENT.md":
+        print(
+            f"FAIL: {DECL.name} derives from {data['derived_from']!r}; §11 names INTENT.md",
+            file=sys.stderr,
+        )
+        raise SystemExit(2)
+    if "standard_version" in data:
+        print(
+            f"FAIL: {DECL.name} carries 'standard_version' — a layer declaration MUST NOT "
+            "carry a standard version (GH-DEC-2026-017 §5, A12)",
+            file=sys.stderr,
+        )
+        raise SystemExit(2)
+    if _fold(data["layer"]) not in LAYER_VOCABULARY:
+        print(
+            f"FAIL: {DECL.name} layer {data['layer']!r} is outside §3's closed vocabulary "
+            f"{sorted(LAYER_VOCABULARY)} (case-insensitive)",
+            file=sys.stderr,
+        )
+        raise SystemExit(2)
+    if _fold(data["layer"]) != "engine":
         print(f"FAIL: declared layer is {data['layer']!r}, expected 'engine'", file=sys.stderr)
         raise SystemExit(2)
-    if str(data["role"]).lower() != "pip":
+    if _fold(data["role"]) != "pip":
         print(f"FAIL: declared role is {data['role']!r}, expected 'pip'", file=sys.stderr)
         raise SystemExit(2)
     if data.get("pep_stance"):
@@ -71,6 +111,26 @@ def intent_frontmatter() -> dict:
     if not isinstance(meta, dict):
         print("FAIL: INTENT.md frontmatter is not a mapping", file=sys.stderr)
         raise SystemExit(2)
+    if "layer" not in meta:
+        print(
+            "FAIL: INTENT.md frontmatter has no 'layer:' key — that is the declaration (§11)",
+            file=sys.stderr,
+        )
+        raise SystemExit(2)
+    if "standard_version" in meta:
+        print(
+            "FAIL: INTENT.md frontmatter carries 'standard_version' — a layer declaration "
+            "MUST NOT carry a standard version (GH-DEC-2026-017 §5, A12)",
+            file=sys.stderr,
+        )
+        raise SystemExit(2)
+    if _fold(meta["layer"]) not in LAYER_VOCABULARY:
+        print(
+            f"FAIL: INTENT.md layer {meta['layer']!r} is outside §3's closed vocabulary "
+            f"{sorted(LAYER_VOCABULARY)} (case-insensitive)",
+            file=sys.stderr,
+        )
+        raise SystemExit(2)
     return meta
 
 
@@ -105,13 +165,17 @@ def main() -> int:
 
     decl = load_declaration()
     intent = intent_frontmatter()
-    if str(intent.get("layer", "")).lower() != str(decl["layer"]).lower():
+    # A11: the derived form MUST agree with the governing one. Case is folded
+    # first (A9), so a mismatch here is a real layer disagreement — a finding
+    # in its own right, reported rather than resolved away by precedence.
+    if _fold(intent["layer"]) != _fold(decl["layer"]):
         print(
-            f"FAIL: INTENT.md layer {intent.get('layer')!r} != layer.yaml {decl['layer']!r}",
+            f"FAIL: layer disagreement after case fold — INTENT.md (governs) "
+            f"{intent['layer']!r} vs layer.yaml (derived) {decl['layer']!r}",
             file=sys.stderr,
         )
         return 2
-    if str(intent.get("role", "")).lower() != str(decl["role"]).lower():
+    if _fold(intent.get("role", "")) != _fold(decl["role"]):
         print(
             f"FAIL: INTENT.md role {intent.get('role')!r} != layer.yaml {decl['role']!r}",
             file=sys.stderr,
@@ -127,9 +191,9 @@ def main() -> int:
 
     if args.report:
         print(
-            f"maturity-engine — layer {decl['layer']}, role {decl['role']}, "
-            f"standard v{decl['standard_version']}"
+            f"maturity-engine — layer {intent['layer']} (INTENT.md, governs), role {decl['role']}"
         )
+        print(f"  layer.yaml: derived from {decl['derived_from']}, layer: {decl['layer']}")
         print(f"  tooling contacts: {len(decl.get('tooling_contacts') or [])}")
         print(f"  non-tooling clients: {len(decl.get('non_tooling_clients') or [])}")
         print("  pep_stance: none")

tests/test_layer_conformance.py

@@ -15,6 +15,16 @@ DECL = ROOT / "layer.yaml"
 INTENT = ROOT / "INTENT.md"
 
 
+def _fold(value: object) -> str:
+    return str(value).strip().encode("ascii", "ignore").decode().lower()
+
+
+def _intent_frontmatter() -> dict:
+    match = re.match(r"^---\n(.*?)\n---\n", INTENT.read_text(), re.DOTALL)
+    assert match
+    return yaml.safe_load(match.group(1))
+
+
 def _run(*args: str) -> subprocess.CompletedProcess[str]:
     return subprocess.run(
         [sys.executable, str(SCRIPT), *args],
@@ -27,21 +37,42 @@ def test_declaration_exists_and_declares_engine_pip():
     assert DECL.exists()
     data = yaml.safe_load(DECL.read_text())
     assert data["repository"] == "maturity-engine"
-    assert data["layer"] == "engine"
-    assert data["role"] == "pip"
+    assert _fold(data["layer"]) == "engine"
+    assert _fold(data["role"]) == "pip"
     assert data["framework"] == "netkingdom-security-layer-model"
-    assert data["standard_version"] == "0.7"
     assert "pep_stance" not in data or not data.get("pep_stance")
 
 
-def test_frontmatter_agrees_with_layer_yaml():
-    text = INTENT.read_text()
-    match = re.match(r"^---\n(.*?)\n---\n", text, re.DOTALL)
-    assert match
-    meta = yaml.safe_load(match.group(1))
+def test_intent_md_carries_the_governing_layer_key():
+    """GH-DEC-2026-017 §1: the INTENT.md frontmatter key is the declaration."""
+    assert _fold(_intent_frontmatter()["layer"]) == "engine"
+
+
+def test_sidecar_is_marked_derived_and_names_its_source():
     data = yaml.safe_load(DECL.read_text())
-    assert str(meta["layer"]).lower() == str(data["layer"]).lower()
-    assert str(meta["role"]).lower() == str(data["role"]).lower()
+    assert data["derived"] is True
+    assert data["derived_from"] == "INTENT.md"
+
+
+def test_frontmatter_agrees_with_layer_yaml_once_case_is_folded():
+    """A11 agreement, A9 fold. Deliberately a fold, not an equality: an
+    equality would silently demand the re-spelling the ruling declined."""
+    meta = _intent_frontmatter()
+    data = yaml.safe_load(DECL.read_text())
+    assert _fold(meta["layer"]) == _fold(data["layer"])
+    assert _fold(meta["role"]) == _fold(data["role"])
+
+
+def test_both_layer_values_are_in_the_closed_vocabulary():
+    vocabulary = {"taxonomy", "tooling", "engine", "staff"}
+    assert _fold(_intent_frontmatter()["layer"]) in vocabulary
+    assert _fold(yaml.safe_load(DECL.read_text())["layer"]) in vocabulary
+
+
+def test_no_declaration_carries_a_standard_version():
+    """GH-DEC-2026-017 §5 / A12."""
+    assert "standard_version" not in yaml.safe_load(DECL.read_text())
+    assert "standard_version" not in _intent_frontmatter()
 
 
 def test_no_tooling_contacts_or_pep():