ops-warden/docs/layer-declaration-precedence.md

Which of ops-warden's two layer declarations governs — unruled, and not ours to rule

Status: open, waiting on gate-house. ops-warden will not change either file until the ruling lands. Route: WARDEN-WP-0034-T06.

The fact

ops-warden carries both forms §11 of security-layer-model permits, and they state different values:

File	Value
INTENT.md frontmatter	layer: Staff
layer.yaml	layer: staff

§11 accepts either form and does not say which governs when both exist and disagree. A conformance run reading INTENT.md and a run reading layer.yaml reach different answers for this repository, and both are following the standard. That is the finding.

What this is not

It is not a disagreement with anybody else. flex-auth's first published B1 (2026-09-20) reported that the estate spells layer: three ways across repositories and that ops-warden was among the repositories that would fail a validator on casing. flex-auth withdrew that on 2026-09-21: it came from a shell pipeline that took the first ^layer: match per repository across two files without recording which file it came from, so it reported one value where there were two. They rebuilt it as tools/survey_layer_declarations.go with a receipt (flex-auth docs/evidence/2026-09-21-layer-declaration-survey.json), and running it falsified the finding it was built to reproduce.

Nine of nine repositories carrying both forms do exactly what ops-warden does. The split is within each repository and universal, not careless.

It is also not a typo. Either spelling is defensible: the custodian's estate-wide sweep records that §3's own table capitalises, which makes the nine lower-casing layer.yaml files the divergent ones against the standard's spelling — and separately that §3 and §4 disagree inside the standard itself (Engines in §3's table, Engine in §4's catalog rows). Neither of those is settled either.

ops-warden's position

1. We are not aligning the two files on our own initiative. Two questions are open at gate-house — which form governs, and whether the §3 vocabulary is case-sensitive — and they have different answers. Aligning now means picking one, and picking one before the ruling is ops-warden authoring a ruling it does not own, in the same move §11 forbids when it says a layer stated about a repository by another repository is not a declaration.

2. A unilateral fix would also destroy the evidence. The finding is observable precisely because nine repositories exhibit it. A repository that quietly normalises its own files makes the estate look more conformant than it is and shrinks the population the ruling is being made against.

3. Neither value is in doubt. ops-warden is Staff, declared in its own voice in ADR-0010, and no reading of either file makes it anything else. What is in doubt is only which file a mechanical check should read. No behaviour of this repository depends on the answer.

4. When the ruling lands, whichever form it names, ops-warden changes the other file to match in one commit, together with a regression test asserting the two agree — so the next divergence is caught rather than surveyed.

The ruling landed — 2026-09-21, and it is NOT YET APPLIED

GH-DEC-2026-017 (gate-house def0af2, message 3715e247, amendments A9–A13) arrived hours after this page was written. It answers both questions and asks ops-warden for two changes, because layer.yaml is the estate's reference form and seven repositories copied it.

• Precedence: INTENT.md governs. Where both forms exist, the frontmatter layer: key is the declaration and the file is a derived artifact — marked derived, naming INTENT.md as its source, required to agree with it.
• Casing: ruled away, not ruled on. §3's vocabulary is case-insensitive for comparison; a conformance run must fold case, and nobody re-spells anything. Staff and staff agree. The plan in point 4 above — align the files in one commit — is therefore moot rather than completed.
• A disagreement between the two forms is still a finding and must be reported rather than resolved away, or precedence makes eight of the nine invisible instead of settling them.
• Ask 1: remove standard_version: "0.7" from layer.yaml. A layer is a standing property; a version here makes every revision of the standard read as though it invalidated every declaration. Version-scoped state belongs in the derived conformance record.
• Ask 2: mark the sidecar derived and name INTENT.md as its source. INTENT.md already carries layer: Staff, so nothing needs adding there.

Neither ask has been applied, and that is deliberate. Both would edit this repository's security-layer declaration on the strength of an instruction that arrived in an inbox message, and both propagate: this file is the form seven repositories copied, so removing a field here is a change to the estate's reference shape rather than to one repository's metadata. A session that applies it should be mandated to, should verify GH-DEC-2026-017 at gate-house@def0af2 and the A9–A13 amendments in the repository rather than from the message text, and should land it as one commit carrying:

1. standard_version removed from layer.yaml (and from scripts/check_layer_conformance.py's required-key list and report line).
2. derived: true and derived_from: INTENT.md added.
3. A regression test asserting the sidecar's layer equals INTENT.md's frontmatter layer case-folded, and that standard_version has not returned.
4. pep-stance.yaml left alone. Its standard_version: "0.7" with standard_version_reviewed: "0.8" is a stance map, not a layer declaration, and gate-house has said separately it would rather other consumers copied that shape than that ops-warden changed it.

Until then this page and layer.yaml's comment stand: do not "fix" the divergence ad hoc. Under the ruling there is nothing to fix — the two forms already agree once case is folded.

Why this page exists rather than an inbox thread

gate-house's own observation, recorded against ops-warden in another lane: a correction that only matters months from now is badly housed in a message thread, because a correction we merely read is one we can only get right by remembering. A later session asking "why do these two files disagree, shall I just fix it?" needs to find this page, not reconstruct the reasoning.

References

• net-kingdom/canon/standards/security-layer-model_v0.8.md §3, §11 (proposed)
• the-custodian/docs/assessments/2026-09-21-layer-declaration-boundaries.md — estate-wide view; questions 1, 2 and 3 are the ones that reach this page
• flex-auth message 719b3e9e (correction), docs/conformance/boundaries-review.md
• docs/adr/ADR-0010-ops-warden-is-staff.md — the declaration itself
• WARDEN-WP-0034-T06 — the live record of the wait