Apply GH-DEC-2026-017: INTENT.md governs, the sidecar is derived, no version

- Remove standard_version from layer.yaml and INTENT.md frontmatter (§5, A12).
- Mark layer.yaml derived: true, derived_from: INTENT.md (§1, A11).
- Checker and tests change in the same commit: standard_version is no longer
  a required key (it is now rejected in either form), the derived marking is
  required, both layer values are checked against the closed four-token
  vocabulary, and the two forms are compared after an ASCII case fold (A9).
  A disagreement surviving the fold is reported as a finding.
- Nothing re-spelled: INTENT.md keeps "Engine", layer.yaml keeps "engine".

Scope check (§9.5 / GH-DEC-2026-017 §4): maturity-engine does not score
layer declarations anywhere. scoring.py grades gap-register conformance
states, and seed gaps concern capabilities, not §11 declarations, so no
non-§4 repository is graded. No scoring change required.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

scripts/check_layer_conformance.py

@@ -3,8 +3,13 @@
 
 This is an Engine (PIP). The checkable claims:
 
-- layer.yaml declares layer=engine, role=pip
-- INTENT.md frontmatter agrees (case-insensitive)
+- INTENT.md frontmatter declares the layer and governs (GH-DEC-2026-017 §1)
+- layer.yaml is derived: marked `derived: true`, `derived_from: INTENT.md`,
+  and declares layer=engine, role=pip
+- both layer values are in §3's closed four-token vocabulary and are compared
+  after an ASCII case fold (A9); nothing is re-spelled. A disagreement that
+  survives the fold is reported as a finding, not resolved by precedence (A11)
+- neither form carries a standard_version (A12)
 - no pep_stance path
 - no catalogued Tooling client (OpenBao, key-cape, cluster)
 - sqlite3 is this PIP's own store and is allowed
@@ -21,6 +26,15 @@ from pathlib import Path
 
 import yaml
 
+# §3 as amended (A9): closed, four tokens, compared after an ASCII case fold.
+LAYER_VOCABULARY = {"taxonomy", "tooling", "engine", "staff"}
+
+
+def _fold(value: object) -> str:
+    """ASCII case-fold: two spellings of a token are one token."""
+    return str(value).strip().encode("ascii", "ignore").decode().lower()
+
+
 ROOT = Path(__file__).resolve().parents[1]
 SRC = ROOT / "src" / "maturity_engine"
 DECL = ROOT / "layer.yaml"
@@ -45,14 +59,40 @@ def load_declaration() -> dict:
     except yaml.YAMLError as exc:
         print(f"FAIL: {DECL.name} is not parseable: {exc}", file=sys.stderr)
         raise SystemExit(2) from exc
-    for key in ("layer", "role", "repository", "tooling_contacts", "standard_version"):
+    for key in ("layer", "role", "repository", "tooling_contacts", "derived", "derived_from"):
         if key not in data:
             print(f"FAIL: {DECL.name} missing required key '{key}' (§11)", file=sys.stderr)
             raise SystemExit(2)
-    if str(data["layer"]).lower() != "engine":
+    if data["derived"] is not True:
+        print(
+            f"FAIL: {DECL.name} must be marked 'derived: true' (§11, GH-DEC-2026-017 §1)",
+            file=sys.stderr,
+        )
+        raise SystemExit(2)
+    if data["derived_from"] != "INTENT.md":
+        print(
+            f"FAIL: {DECL.name} derives from {data['derived_from']!r}; §11 names INTENT.md",
+            file=sys.stderr,
+        )
+        raise SystemExit(2)
+    if "standard_version" in data:
+        print(
+            f"FAIL: {DECL.name} carries 'standard_version' — a layer declaration MUST NOT "
+            "carry a standard version (GH-DEC-2026-017 §5, A12)",
+            file=sys.stderr,
+        )
+        raise SystemExit(2)
+    if _fold(data["layer"]) not in LAYER_VOCABULARY:
+        print(
+            f"FAIL: {DECL.name} layer {data['layer']!r} is outside §3's closed vocabulary "
+            f"{sorted(LAYER_VOCABULARY)} (case-insensitive)",
+            file=sys.stderr,
+        )
+        raise SystemExit(2)
+    if _fold(data["layer"]) != "engine":
         print(f"FAIL: declared layer is {data['layer']!r}, expected 'engine'", file=sys.stderr)
         raise SystemExit(2)
-    if str(data["role"]).lower() != "pip":
+    if _fold(data["role"]) != "pip":
         print(f"FAIL: declared role is {data['role']!r}, expected 'pip'", file=sys.stderr)
         raise SystemExit(2)
     if data.get("pep_stance"):
@@ -71,6 +111,26 @@ def intent_frontmatter() -> dict:
     if not isinstance(meta, dict):
         print("FAIL: INTENT.md frontmatter is not a mapping", file=sys.stderr)
         raise SystemExit(2)
+    if "layer" not in meta:
+        print(
+            "FAIL: INTENT.md frontmatter has no 'layer:' key — that is the declaration (§11)",
+            file=sys.stderr,
+        )
+        raise SystemExit(2)
+    if "standard_version" in meta:
+        print(
+            "FAIL: INTENT.md frontmatter carries 'standard_version' — a layer declaration "
+            "MUST NOT carry a standard version (GH-DEC-2026-017 §5, A12)",
+            file=sys.stderr,
+        )
+        raise SystemExit(2)
+    if _fold(meta["layer"]) not in LAYER_VOCABULARY:
+        print(
+            f"FAIL: INTENT.md layer {meta['layer']!r} is outside §3's closed vocabulary "
+            f"{sorted(LAYER_VOCABULARY)} (case-insensitive)",
+            file=sys.stderr,
+        )
+        raise SystemExit(2)
     return meta
 
 
@@ -105,13 +165,17 @@ def main() -> int:
 
     decl = load_declaration()
     intent = intent_frontmatter()
-    if str(intent.get("layer", "")).lower() != str(decl["layer"]).lower():
+    # A11: the derived form MUST agree with the governing one. Case is folded
+    # first (A9), so a mismatch here is a real layer disagreement — a finding
+    # in its own right, reported rather than resolved away by precedence.
+    if _fold(intent["layer"]) != _fold(decl["layer"]):
         print(
-            f"FAIL: INTENT.md layer {intent.get('layer')!r} != layer.yaml {decl['layer']!r}",
+            f"FAIL: layer disagreement after case fold — INTENT.md (governs) "
+            f"{intent['layer']!r} vs layer.yaml (derived) {decl['layer']!r}",
             file=sys.stderr,
         )
         return 2
-    if str(intent.get("role", "")).lower() != str(decl["role"]).lower():
+    if _fold(intent.get("role", "")) != _fold(decl["role"]):
         print(
             f"FAIL: INTENT.md role {intent.get('role')!r} != layer.yaml {decl['role']!r}",
             file=sys.stderr,
@@ -127,9 +191,9 @@ def main() -> int:
 
     if args.report:
         print(
-            f"maturity-engine — layer {decl['layer']}, role {decl['role']}, "
-            f"standard v{decl['standard_version']}"
+            f"maturity-engine — layer {intent['layer']} (INTENT.md, governs), role {decl['role']}"
         )
+        print(f"  layer.yaml: derived from {decl['derived_from']}, layer: {decl['layer']}")
         print(f"  tooling contacts: {len(decl.get('tooling_contacts') or [])}")
         print(f"  non-tooling clients: {len(decl.get('non_tooling_clients') or [])}")
         print("  pep_stance: none")