Apply GH-DEC-2026-017: INTENT.md governs, the sidecar is derived, no version

Verified against gate-house's own committed files before editing, not the inbox
message: GH-DEC-2026-017 in decisions/decisions.md at gate-house@def0af2,
amendments A9-A13 in docs/amendments/v0.8-section-11-declaration-amendments.md,
and sections 3, 4 and 11 of net-kingdom's security-layer-model_v0.8.md. The
ruling and docs/layer-declaration-precedence.md's secondary account agreed.

INTENT.md's frontmatter is the declaration; layer.yaml is a derived artifact,
now marked derived: true / derived_from: INTENT.md, and it does not govern.

standard_version is removed from BOTH forms. The ruling's general form is that a
layer declaration must not carry a standard version, and INTENT.md is the
declaration, so removing it from the sidecar alone would have left the field in
the only file that actually declares. INTENT.md's version-pinned `standard:`
path is de-versioned for the same reason: a pinned path reads as a validity
condition. The version ops-warden assented at stays with the assent, ADR-0010.

NO LAYER VALUE IS CHANGED. INTENT.md still says Staff and layer.yaml still says
staff. Section 3's vocabulary is closed, four tokens, and case-insensitive: the
two forms were never in disagreement about a layer, and the ruling asked nobody
to re-spell anything. The comment marking the divergence is rewritten from
"unruled, do not touch" to "ruled, folding case is the checker's job".

check_layer_conformance.py would have rejected the conforming declaration this
ruling produces -- it listed standard_version as a required key. It now reads
INTENT.md as the governing form, ASCII-folds before comparing, validates both
values against the closed four-token vocabulary (Taxonomy included; omitting it
is the defect A9 records against the estate's other validator), requires the
derived marking, rejects a returning standard_version in either file, and
reports a post-fold disagreement between the forms as a finding rather than
resolving it away by precedence.

The test asserts the fold, not equality. An equality assertion here would be
this repository quietly performing the re-spelling the ruling declined to order;
the fold still fails on a real layer divergence.

pep-stance.yaml is untouched. A stance map is not a layer declaration, and the
sidecar schema beyond the derived marking and the version is explicitly not
ruled.

layer.yaml is the form seven repositories copied, so the adopter change set is
written out in wiki/playbooks/netkingdom-layer-declaration.md -- including the
trap that an adopter which also copied the checker turns a conforming
declaration into MALFORMED exit 2 by removing the field alone. No other
repository is edited here.

Still open: where the removed version lives. A12 says the derived conformance
record "already MUST" carry it; ops-warden has a re-runnable checker that emits
nothing durable. Asked of gate-house in message 4220413a, unanswered, and left
open rather than answered by choosing. Nothing above depends on it.

Carries WARDEN-WP-0034-T06 to done.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

workplans/WARDEN-WP-0034-layer-model-v07-conformance.md

@@ -235,7 +235,7 @@ T05 stays `wait` on the remaining two: `ops-mason` (no stance map published) and
 
 ```task
 id: WARDEN-WP-0034-T06
-status: wait
+status: done
 priority: low
 state_hub_task_id: "b3b573df-2d2d-5a2c-9662-a13e435be57b"
 ```
@@ -247,24 +247,51 @@ while both follow the standard. Nine of nine repositories carrying both forms do
 the same thing (flex-auth `tools/survey_layer_declarations.go`, receipt
 `docs/evidence/2026-09-21-layer-declaration-survey.json`).
 
-**Waiting on gate-house for two rulings**: which form governs, and whether the §3
-vocabulary is case-sensitive. The custodian's estate-wide sweep adds a third that
-bears on it — §3's table capitalises and types engines `Engines` while §4's
-catalog rows type them `Engine`, so the standard disagrees with itself one level
-below B1.
+**RULED 2026-09-21, APPLIED 2026-09-21.** `GH-DEC-2026-017`
+(`gate-house@def0af2`, amendments A9-A13) answers both questions, and the answer
+to the second dissolves the first's consequence:
 
-**Deliberately not acting.** Aligning the two files now means choosing an answer
-gate-house owns, and doing it in the one place §11 says another repository may
-not speak for us. It would also erase the evidence the ruling is being made
-against: the finding is visible because nine repositories exhibit it, and a
-repository that quietly normalises itself makes the estate read as more
-conformant than it is. Position recorded in
-`docs/layer-declaration-precedence.md`; both files carry a comment saying not to
-"fix" the divergence.
+- **`INTENT.md` governs**; `layer.yaml` is a derived artifact that must be marked
+  derived, must name `INTENT.md` as its source, and must agree with it.
+- **The §3 vocabulary is case-insensitive**, closed, and has four tokens
+  (`Taxonomy`, `Tooling`, `Engine`, `Staff`). A conformance run MUST ASCII-fold
+  case before comparing, and **no repository was asked to re-spell anything**.
+  `Staff` and `staff` are one value.
+- **A declaration MUST NOT carry a standard version** — and that field is the
+  *reference form's*, not this repository's habit, so ops-warden was asked to
+  remove it here rather than each of seven adopters deciding.
 
-**Done when:** gate-house rules, the non-governing file is changed to match in
-one commit, and a regression test asserts the two declarations agree so the next
-divergence is caught rather than surveyed.
+Verified before editing against gate-house's own committed files rather than the
+inbox message: the decision at `gate-house@def0af2`, amendments A9-A13 in
+`docs/amendments/v0.8-section-11-declaration-amendments.md`, and §3/§4/§11 of
+`net-kingdom/canon/standards/security-layer-model_v0.8.md`.
+
+**What was applied.** `standard_version` removed from `layer.yaml` **and** from
+`INTENT.md` frontmatter (the ruling's subject is the declaration, and `INTENT.md`
+is the declaration), with the version-pinned `standard:` path de-versioned for the
+same reason; `derived: true` / `derived_from: INTENT.md` added; **no layer value
+changed**; `scripts/check_layer_conformance.py` rewritten to read `INTENT.md` as
+governing, fold case, validate the closed four-token vocabulary, require the
+derived marking, and reject a returning `standard_version` — it previously
+*required* that field and so would have rejected the conforming declaration this
+ruling produces; `tests/test_layer_conformance.py` asserts the **fold** rather
+than equality, because an equality assertion would perform the re-spelling the
+ruling declined to order. `pep-stance.yaml` untouched: a stance map is not a layer
+declaration, and the schema beyond the derived marking and the version is
+explicitly not ruled.
+
+**Evidence.** `python3 scripts/check_layer_conformance.py --report` exits 0 and
+prints the governing form and the derived one separately; `pytest
+tests/test_layer_conformance.py` green; full suite and `ruff` green. Reasoning
+and the adopter change set: `docs/layer-declaration-precedence.md` and
+`wiki/playbooks/netkingdom-layer-declaration.md`.
+
+**Left open, and not decided here.** Where the removed version now lives. A12
+says version-scoped state belongs in the derived conformance record, which
+"already MUST" carry the version it was derived at; ops-warden has a re-runnable
+checker that emits nothing durable, not an emitted record. Whether §11 expects an
+emitted artifact or a re-runnable check discharges it is asked of gate-house in
+message `4220413a` and unanswered. Nothing applied above depends on the answer.
 
 **Ruled the same day, and still `wait` — deliberately.** `GH-DEC-2026-017`
 (message `3715e247`) landed hours later: `INTENT.md` governs, the sidecar is a