Bind checker to accepted v0.8 and preserve provenance distinctions

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
Assistant-Process: 8340@bnt-lap001

scripts/check_layer_conformance.py

@@ -37,8 +37,8 @@ import yaml
 # carry this (A12); the run does. Bump it when re-validated against a newer
 # accepted text.
 VALIDATED_AGAINST = (
-    "net-kingdom/canon/standards/security-layer-model_v0.7.md"
-    " (+ GH-DEC-2026-017, GH-DEC-2026-020 / A12 r2)"
+    "net-kingdom/canon/standards/security-layer-model_v0.8.md "
+    "(accepted-1 sha256:3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b)"
 )
 
 # §3 as amended (A9): closed, four tokens, compared after an ASCII case fold.
@@ -47,7 +47,7 @@ LAYER_VOCABULARY = {"taxonomy", "tooling", "engine", "staff"}
 
 def _fold(value: object) -> str:
     """ASCII case-fold: two spellings of a token are one token."""
-    return str(value).strip().encode("ascii", "ignore").decode().lower()
+    return str(value).strip().translate(str.maketrans("ABCDEFGHIJKLMNOPQRSTUVWXYZ", "abcdefghijklmnopqrstuvwxyz"))
 
 
 ROOT = Path(__file__).resolve().parents[1]
@@ -63,40 +63,30 @@ SCOPE = "INTENT.md frontmatter, layer.yaml, imports under src/maturity_engine"
 # `standard_version`. `schema_version` is the file format's own version, not a
 # standard version, and is not reached (GH-DEC-2026-020 §1).
 EXEMPT_VERSION_KEYS = {"schema_version"}
-# A version-bearing path or file name, e.g. `security-layer-model_v0.7.md`,
-# `.../v0.2/companion.md`. Matched only against whitespace-free values, so prose
-# notes citing a rule's history are not mistaken for a pin.
-VERSIONED_PATH = re.compile(r"(?i)(?:^|[_\-/.])v\d+(?:\.\d+)*(?:$|[_\-/.])")
-# Keys that name a standard or companion: any version-like token in their value counts.
-STANDARD_KEYS = {"standard", "companion", "framework"}
-BARE_VERSION = re.compile(r"\d+\.\d+")
+VERSION_KEY = re.compile(r"(standard|companion).*version|version.*(standard|companion)", re.I)
+VERSIONED_PATH = re.compile(r"[_\-.]v\d+(\.\d+)*(\.md)?\b|@v?\d+\.\d+", re.I)
+STANDARD_KEYS = {"standard", "companion"}
+BARE_VERSION = re.compile(r"\bv?\d+\.\d+", re.I)
 
 
-def version_findings(data: object, where: str) -> list[str]:
-    """Every place a standard or companion version appears in a declaration."""
+def version_findings(data: object, where: str, identity: bool = False) -> list[str]:
+    """A12 r3 pins; bare prose provenance and unrelated versions are not pins."""
     found: list[str] = []
-
-    def walk(node: object, path: str, key: str | None) -> None:
-        if isinstance(node, dict):
-            for k, v in node.items():
-                ks = str(k)
-                if ks in EXEMPT_VERSION_KEYS:
-                    continue
-                if "version" in ks.lower():
-                    found.append(f"{where}: key '{path}{ks}' carries a version")
-                walk(v, f"{path}{ks}.", ks)
-        elif isinstance(node, list):
-            for i, v in enumerate(node):
-                walk(v, f"{path}{i}.", key)
-        elif isinstance(node, str):
-            value = node.strip()
-            label = path.rstrip(".")
-            if key and key.lower() in STANDARD_KEYS and BARE_VERSION.search(value):
-                found.append(f"{where}: '{label}' value {value!r} carries a version")
-            elif value and not any(c.isspace() for c in value) and VERSIONED_PATH.search(value):
-                found.append(f"{where}: '{label}' value {value!r} is a version-bearing path")
-
-    walk(data, "", None)
+    if isinstance(data, dict):
+        for key, value in data.items():
+            name = str(key)
+            here = f"{where}.{name}" if where else name
+            if name in EXEMPT_VERSION_KEYS:
+                continue
+            if VERSION_KEY.search(name):
+                found.append(f"{here} names a standard/companion version")
+                continue
+            found.extend(version_findings(value, here, name.lower() in STANDARD_KEYS))
+    elif isinstance(data, list):
+        for index, item in enumerate(data):
+            found.extend(version_findings(item, f"{where}[{index}]", identity))
+    elif isinstance(data, str) and (VERSIONED_PATH.search(data) or identity and BARE_VERSION.search(data)):
+        found.append(f"{where} = {data!r} carries a standard/companion version")
     return found