Apply GH-DEC-2026-017: INTENT.md governs, the sidecar is derived, no version

Verified against gate-house's own committed files before editing, not the inbox
message: GH-DEC-2026-017 in decisions/decisions.md at gate-house@def0af2,
amendments A9-A13 in docs/amendments/v0.8-section-11-declaration-amendments.md,
and sections 3, 4 and 11 of net-kingdom's security-layer-model_v0.8.md. The
ruling and docs/layer-declaration-precedence.md's secondary account agreed.

INTENT.md's frontmatter is the declaration; layer.yaml is a derived artifact,
now marked derived: true / derived_from: INTENT.md, and it does not govern.

standard_version is removed from BOTH forms. The ruling's general form is that a
layer declaration must not carry a standard version, and INTENT.md is the
declaration, so removing it from the sidecar alone would have left the field in
the only file that actually declares. INTENT.md's version-pinned `standard:`
path is de-versioned for the same reason: a pinned path reads as a validity
condition. The version ops-warden assented at stays with the assent, ADR-0010.

NO LAYER VALUE IS CHANGED. INTENT.md still says Staff and layer.yaml still says
staff. Section 3's vocabulary is closed, four tokens, and case-insensitive: the
two forms were never in disagreement about a layer, and the ruling asked nobody
to re-spell anything. The comment marking the divergence is rewritten from
"unruled, do not touch" to "ruled, folding case is the checker's job".

check_layer_conformance.py would have rejected the conforming declaration this
ruling produces -- it listed standard_version as a required key. It now reads
INTENT.md as the governing form, ASCII-folds before comparing, validates both
values against the closed four-token vocabulary (Taxonomy included; omitting it
is the defect A9 records against the estate's other validator), requires the
derived marking, rejects a returning standard_version in either file, and
reports a post-fold disagreement between the forms as a finding rather than
resolving it away by precedence.

The test asserts the fold, not equality. An equality assertion here would be
this repository quietly performing the re-spelling the ruling declined to order;
the fold still fails on a real layer divergence.

pep-stance.yaml is untouched. A stance map is not a layer declaration, and the
sidecar schema beyond the derived marking and the version is explicitly not
ruled.

layer.yaml is the form seven repositories copied, so the adopter change set is
written out in wiki/playbooks/netkingdom-layer-declaration.md -- including the
trap that an adopter which also copied the checker turns a conforming
declaration into MALFORMED exit 2 by removing the field alone. No other
repository is edited here.

Still open: where the removed version lives. A12 says the derived conformance
record "already MUST" carry it; ops-warden has a re-runnable checker that emits
nothing durable. Asked of gate-house in message 4220413a, unanswered, and left
open rather than answered by choosing. Nothing above depends on it.

Carries WARDEN-WP-0034-T06 to done.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

docs/layer-declaration-precedence.md

@@ -1,7 +1,12 @@
-# Which of ops-warden's two layer declarations governs — unruled, and not ours to rule
+# Which of ops-warden's two layer declarations governs — ruled, and applied
 
-**Status: open, waiting on gate-house. ops-warden will not change either file
-until the ruling lands.** Route: `WARDEN-WP-0034-T06`.
+**Status: RULED and APPLIED, 2026-09-21.** `GH-DEC-2026-017` (`gate-house@def0af2`)
+settles it: `INTENT.md` governs, the sidecar is derived, and the §3 vocabulary is
+case-insensitive — so the two values were never in disagreement about a layer.
+Route: `WARDEN-WP-0034-T06`, done. **Sections 1–3 below are the position as it
+stood while the question was open, kept because the ruling is only legible
+against the question it answers.** What changed, and what is still open, is
+[further down](#the-ruling-landed--2026-09-21--and-it-is-applied).
 
 ## The fact
 
@@ -63,10 +68,10 @@ settled either.
    other file to match in one commit, together with a regression test asserting
    the two agree — so the next divergence is caught rather than surveyed.
 
-## The ruling landed — 2026-09-21, and it is NOT YET APPLIED
+## The ruling landed — 2026-09-21 — and it is APPLIED
 
 `GH-DEC-2026-017` (gate-house `def0af2`, message `3715e247`, amendments A9–A13)
-arrived hours after this page was written. It answers both questions and asks
+arrived hours after this page was written. It answers both questions and asked
 ops-warden for two changes, because `layer.yaml` is the estate's reference form
 and seven repositories copied it.
 
@@ -74,42 +79,80 @@ and seven repositories copied it.
   `layer:` key is the declaration and the file is a **derived** artifact —
   marked derived, naming `INTENT.md` as its source, required to agree with it.
 - **Casing: ruled away, not ruled on.** §3's vocabulary is case-insensitive for
-  comparison; a conformance run **must fold case**, and **nobody re-spells
+  comparison, a conformance run **must fold case**, and **nobody re-spells
   anything**. `Staff` and `staff` agree. The plan in point 4 above — align the
-  files in one commit — is therefore moot rather than completed.
+  files in one commit — is therefore **moot rather than completed**, and that
+  distinction is the point: the divergence was never a disagreement about a
+  layer, so there was never anything to align.
 - **A disagreement between the two forms is still a finding** and must be
   reported rather than resolved away, or precedence makes eight of the nine
   invisible instead of settling them.
-- **Ask 1:** remove `standard_version: "0.7"` from `layer.yaml`. A layer is a
-  standing property; a version here makes every revision of the standard read as
-  though it invalidated every declaration. Version-scoped state belongs in the
-  derived conformance record.
-- **Ask 2:** mark the sidecar derived and name `INTENT.md` as its source.
-  `INTENT.md` already carries `layer: Staff`, so nothing needs adding there.
 
-**Neither ask has been applied, and that is deliberate.** Both would edit this
-repository's security-layer declaration on the strength of an instruction that
-arrived in an inbox message, and both propagate: this file is the form seven
-repositories copied, so removing a field here is a change to the estate's
-reference shape rather than to one repository's metadata. A session that applies
-it should be mandated to, should verify `GH-DEC-2026-017` at
-`gate-house@def0af2` and the A9–A13 amendments in the repository rather than
-from the message text, and should land it as one commit carrying:
+### What was applied, 2026-09-21
 
-1. `standard_version` removed from `layer.yaml` (and from
-   `scripts/check_layer_conformance.py`'s required-key list and report line).
-2. `derived: true` and `derived_from: INTENT.md` added.
-3. A regression test asserting the sidecar's `layer` equals `INTENT.md`'s
-   frontmatter `layer` **case-folded**, and that `standard_version` has not
-   returned.
-4. `pep-stance.yaml` left alone. Its `standard_version: "0.7"` with
+Verified first against gate-house's own committed files — `GH-DEC-2026-017` in
+`decisions/decisions.md` at `gate-house@def0af2`, amendments A9–A13 in
+`docs/amendments/v0.8-section-11-declaration-amendments.md`, and §3/§4/§11 of
+`net-kingdom/canon/standards/security-layer-model_v0.8.md` — not from the inbox
+message and not from this page, which is a secondary record. The decision and
+this page's account of it agreed.
+
+1. `standard_version` removed from **both** forms. The ruling's general form is
+   *a layer declaration MUST NOT carry a standard version*, and the governing
+   declaration is `INTENT.md`, so removing it from the sidecar alone would have
+   left the field in the one file that actually declares. `INTENT.md`'s
+   `standard:` pointer is de-versioned with it, for the same reason the field
+   goes: a version-pinned path reads as a validity condition. The version
+   ops-warden assented at stays with the assent (`ADR-0010`), which is where a
+   version-at-a-boundary belongs.
+2. `derived: true` and `derived_from: INTENT.md` added to `layer.yaml`, and the
+   file's header now says plainly that it does not govern.
+3. **No layer value changed.** `INTENT.md` still says `Staff`, `layer.yaml`
+   still says `staff`, and the comment marking the divergence is rewritten from
+   *unruled, do not touch* to *ruled, folding case is the checker's job*.
+4. `scripts/check_layer_conformance.py` now reads `INTENT.md` as the governing
+   form, ASCII-folds before comparing, validates both values against §3's closed
+   four-token vocabulary (`Taxonomy` included — omitting it is the defect A9
+   records), requires the derived marking, and **rejects a returning
+   `standard_version` in either file**. It previously listed `standard_version`
+   as a required key, so it would have rejected the conforming declaration this
+   ruling produces.
+5. `tests/test_layer_conformance.py` asserts the fold rather than equality. An
+   equality assertion would have been this repository performing the re-spelling
+   the ruling explicitly declined to order; the fold still fails on a real layer
+   divergence, which is what point 4 of this page originally wanted.
+6. `pep-stance.yaml` left alone. Its `standard_version: "0.7"` with
    `standard_version_reviewed: "0.8"` is a stance map, not a layer declaration,
    and gate-house has said separately it would rather other consumers copied
-   that shape than that ops-warden changed it.
+   that shape than that ops-warden changed it. `GH-DEC-2026-017` also states it
+   does not rule the sidecar's schema beyond the derived marking and the version.
 
-Until then this page and `layer.yaml`'s comment stand: do not "fix" the
-divergence ad hoc. Under the ruling there is nothing to fix — the two forms
-already agree once case is folded.
+### What the seven adopters must copy
+
+The change set is written for them in
+`wiki/playbooks/netkingdom-layer-declaration.md`. ops-warden does not edit their
+files. The trap worth repeating: any adopter that also copied the checker has a
+required-key list containing `standard_version`, so removing the field alone
+turns a conforming declaration into a `MALFORMED` exit 2.
+
+### Still open — where the removed version goes
+
+`GH-DEC-2026-017` §5 and A12 both say version-scoped state *"belongs in the
+derived conformance record, which under this section's derived-artifact rule
+already MUST name what it derives from and carry the version or commit it was
+derived at."* Both sentences say **already**, and ops-warden does not have one:
+what it has is `scripts/check_layer_conformance.py`, a re-runnable check that
+emits nothing durable. So it is unresolved whether §11 expects an **emitted
+record** — a committed artifact carrying the version it was derived at — or
+whether a re-runnable checker discharges the obligation, with the version
+supplied by whoever runs it.
+
+Asked of gate-house in message `4220413a` (2026-09-21). **No answer had arrived
+when this change was applied, and the question is deliberately left open rather
+than answered by choosing.** Nothing in the applied change depends on it: the
+version is gone from the declaration either way, and the only thing the answer
+decides is whether ops-warden must additionally emit a record to have somewhere
+to put it.
 
 ## Why this page exists rather than an inbox thread