ops-warden/docs/layer-declaration-precedence.md

Which of ops-warden's two layer declarations governs — ruled, and applied

Status: RULED and APPLIED, 2026-09-21. GH-DEC-2026-017 (gate-house@def0af2) settles it: INTENT.md governs, the sidecar is derived, and the §3 vocabulary is case-insensitive — so the two values were never in disagreement about a layer. Route: WARDEN-WP-0034-T06, done. Sections 1–3 below are the position as it stood while the question was open, kept because the ruling is only legible against the question it answers. What changed, and what is still open, is further down.

The fact

ops-warden carries both forms §11 of security-layer-model permits, and they state different values:

File	Value
INTENT.md frontmatter	layer: Staff
layer.yaml	layer: staff

§11 accepts either form and does not say which governs when both exist and disagree. A conformance run reading INTENT.md and a run reading layer.yaml reach different answers for this repository, and both are following the standard. That is the finding.

What this is not

It is not a disagreement with anybody else. flex-auth's first published B1 (2026-09-20) reported that the estate spells layer: three ways across repositories and that ops-warden was among the repositories that would fail a validator on casing. flex-auth withdrew that on 2026-09-21: it came from a shell pipeline that took the first ^layer: match per repository across two files without recording which file it came from, so it reported one value where there were two. They rebuilt it as tools/survey_layer_declarations.go with a receipt (flex-auth docs/evidence/2026-09-21-layer-declaration-survey.json), and running it falsified the finding it was built to reproduce.

Nine of nine repositories carrying both forms do exactly what ops-warden does. The split is within each repository and universal, not careless.

It is also not a typo. Either spelling is defensible: the custodian's estate-wide sweep records that §3's own table capitalises, which makes the nine lower-casing layer.yaml files the divergent ones against the standard's spelling — and separately that §3 and §4 disagree inside the standard itself (Engines in §3's table, Engine in §4's catalog rows). Neither of those is settled either.

ops-warden's position

1. We are not aligning the two files on our own initiative. Two questions are open at gate-house — which form governs, and whether the §3 vocabulary is case-sensitive — and they have different answers. Aligning now means picking one, and picking one before the ruling is ops-warden authoring a ruling it does not own, in the same move §11 forbids when it says a layer stated about a repository by another repository is not a declaration.

2. A unilateral fix would also destroy the evidence. The finding is observable precisely because nine repositories exhibit it. A repository that quietly normalises its own files makes the estate look more conformant than it is and shrinks the population the ruling is being made against.

3. Neither value is in doubt. ops-warden is Staff, declared in its own voice in ADR-0010, and no reading of either file makes it anything else. What is in doubt is only which file a mechanical check should read. No behaviour of this repository depends on the answer.

4. When the ruling lands, whichever form it names, ops-warden changes the other file to match in one commit, together with a regression test asserting the two agree — so the next divergence is caught rather than surveyed.

The ruling landed — 2026-09-21 — and it is APPLIED

GH-DEC-2026-017 (gate-house def0af2, message 3715e247, amendments A9–A13) arrived hours after this page was written. It answers both questions and asked ops-warden for two changes, because layer.yaml is the estate's reference form and seven repositories copied it.

• Precedence: INTENT.md governs. Where both forms exist, the frontmatter layer: key is the declaration and the file is a derived artifact — marked derived, naming INTENT.md as its source, required to agree with it.
• Casing: ruled away, not ruled on. §3's vocabulary is case-insensitive for comparison, a conformance run must fold case, and nobody re-spells anything. Staff and staff agree. The plan in point 4 above — align the files in one commit — is therefore moot rather than completed, and that distinction is the point: the divergence was never a disagreement about a layer, so there was never anything to align.
• A disagreement between the two forms is still a finding and must be reported rather than resolved away, or precedence makes eight of the nine invisible instead of settling them.

What was applied, 2026-09-21

Verified first against gate-house's own committed files — GH-DEC-2026-017 in decisions/decisions.md at gate-house@def0af2, amendments A9–A13 in docs/amendments/v0.8-section-11-declaration-amendments.md, and §3/§4/§11 of net-kingdom/canon/standards/security-layer-model_v0.8.md — not from the inbox message and not from this page, which is a secondary record. The decision and this page's account of it agreed.

1. standard_version removed from both forms. The ruling's general form is a layer declaration MUST NOT carry a standard version, and the governing declaration is INTENT.md, so removing it from the sidecar alone would have left the field in the one file that actually declares. INTENT.md's standard: pointer is de-versioned with it, for the same reason the field goes: a version-pinned path reads as a validity condition. The version ops-warden assented at stays with the assent (ADR-0010), which is where a version-at-a-boundary belongs.
2. derived: true and derived_from: INTENT.md added to layer.yaml, and the file's header now says plainly that it does not govern.
3. No layer value changed. INTENT.md still says Staff, layer.yaml still says staff, and the comment marking the divergence is rewritten from unruled, do not touch to ruled, folding case is the checker's job.
4. scripts/check_layer_conformance.py now reads INTENT.md as the governing form, ASCII-folds before comparing, validates both values against §3's closed four-token vocabulary (Taxonomy included — omitting it is the defect A9 records), requires the derived marking, and rejects a returning standard_version in either file. It previously listed standard_version as a required key, so it would have rejected the conforming declaration this ruling produces.
5. tests/test_layer_conformance.py asserts the fold rather than equality. An equality assertion would have been this repository performing the re-spelling the ruling explicitly declined to order; the fold still fails on a real layer divergence, which is what point 4 of this page originally wanted.
6. pep-stance.yaml left alone. Its standard_version: "0.7" with standard_version_reviewed: "0.8" is a stance map, not a layer declaration, and gate-house has said separately it would rather other consumers copied that shape than that ops-warden changed it. GH-DEC-2026-017 also states it does not rule the sidecar's schema beyond the derived marking and the version.

What the seven adopters must copy

The change set is written for them in wiki/playbooks/netkingdom-layer-declaration.md. ops-warden does not edit their files. The trap worth repeating: any adopter that also copied the checker has a required-key list containing standard_version, so removing the field alone turns a conforming declaration into a MALFORMED exit 2.

Still open — where the removed version goes

GH-DEC-2026-017 §5 and A12 both say version-scoped state "belongs in the derived conformance record, which under this section's derived-artifact rule already MUST name what it derives from and carry the version or commit it was derived at." Both sentences say already, and ops-warden does not have one: what it has is scripts/check_layer_conformance.py, a re-runnable check that emits nothing durable. So it is unresolved whether §11 expects an emitted record — a committed artifact carrying the version it was derived at — or whether a re-runnable checker discharges the obligation, with the version supplied by whoever runs it.

Asked of gate-house in message 4220413a (2026-09-21). No answer had arrived when this change was applied, and the question is deliberately left open rather than answered by choosing. Nothing in the applied change depends on it: the version is gone from the declaration either way, and the only thing the answer decides is whether ops-warden must additionally emit a record to have somewhere to put it.

Why this page exists rather than an inbox thread

gate-house's own observation, recorded against ops-warden in another lane: a correction that only matters months from now is badly housed in a message thread, because a correction we merely read is one we can only get right by remembering. A later session asking "why do these two files disagree, shall I just fix it?" needs to find this page, not reconstruct the reasoning.

References

• net-kingdom/canon/standards/security-layer-model_v0.8.md §3, §11 (proposed)
• the-custodian/docs/assessments/2026-09-21-layer-declaration-boundaries.md — estate-wide view; questions 1, 2 and 3 are the ones that reach this page
• flex-auth message 719b3e9e (correction), docs/conformance/boundaries-review.md
• docs/adr/ADR-0010-ops-warden-is-staff.md — the declaration itself
• WARDEN-WP-0034-T06 — the live record of the wait