coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/wiki/playbooks/netkingdom-layer-declaration.md
tegwick a70f559d40
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
Apply GH-DEC-2026-017: INTENT.md governs, the sidecar is derived, no version 
Verified against gate-house's own committed files before editing, not the inbox
message: GH-DEC-2026-017 in decisions/decisions.md at gate-house@def0af2,
amendments A9-A13 in docs/amendments/v0.8-section-11-declaration-amendments.md,
and sections 3, 4 and 11 of net-kingdom's security-layer-model_v0.8.md. The
ruling and docs/layer-declaration-precedence.md's secondary account agreed.

INTENT.md's frontmatter is the declaration; layer.yaml is a derived artifact,
now marked derived: true / derived_from: INTENT.md, and it does not govern.

standard_version is removed from BOTH forms. The ruling's general form is that a
layer declaration must not carry a standard version, and INTENT.md is the
declaration, so removing it from the sidecar alone would have left the field in
the only file that actually declares. INTENT.md's version-pinned `standard:`
path is de-versioned for the same reason: a pinned path reads as a validity
condition. The version ops-warden assented at stays with the assent, ADR-0010.

NO LAYER VALUE IS CHANGED. INTENT.md still says Staff and layer.yaml still says
staff. Section 3's vocabulary is closed, four tokens, and case-insensitive: the
two forms were never in disagreement about a layer, and the ruling asked nobody
to re-spell anything. The comment marking the divergence is rewritten from
"unruled, do not touch" to "ruled, folding case is the checker's job".

check_layer_conformance.py would have rejected the conforming declaration this
ruling produces -- it listed standard_version as a required key. It now reads
INTENT.md as the governing form, ASCII-folds before comparing, validates both
values against the closed four-token vocabulary (Taxonomy included; omitting it
is the defect A9 records against the estate's other validator), requires the
derived marking, rejects a returning standard_version in either file, and
reports a post-fold disagreement between the forms as a finding rather than
resolving it away by precedence.

The test asserts the fold, not equality. An equality assertion here would be
this repository quietly performing the re-spelling the ruling declined to order;
the fold still fails on a real layer divergence.

pep-stance.yaml is untouched. A stance map is not a layer declaration, and the
sidecar schema beyond the derived marking and the version is explicitly not
ruled.

layer.yaml is the form seven repositories copied, so the adopter change set is
written out in wiki/playbooks/netkingdom-layer-declaration.md -- including the
trap that an adopter which also copied the checker turns a conforming
declaration into MALFORMED exit 2 by removing the field alone. No other
repository is edited here.

Still open: where the removed version lives. A12 says the derived conformance
record "already MUST" carry it; ops-warden has a re-runnable checker that emits
nothing durable. Asked of gate-house in message 4220413a, unanswered, and left
open rather than answered by choosing. Nothing above depends on it.

Carries WARDEN-WP-0034-T06 to done.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
2026-09-21 02:38:55 +02:00

4.8 KiB
Raw Blame History

NetKingdom layer declaration route

Date: 2026-09-04 Catalog: netkingdom-layer-declaration Doctrine owner: gate-house Path steward: ops-warden

This page is a route from the accepted NetKingdom security companion to the reference declaration artifacts. It does not redefine the layer model.

Worker checklist

  1. Read net-kingdom/SECURITY-COMPANION.md, then use the accepted net-kingdom/canon/standards/security-layer-model_v0.7.md for the normative layer, Tooling-contact, and PEP obligations. v0.8 is proposed, not accepted, and its acceptance flip is held on amendments A9–A13 (GH-DEC-2026-019) — but those amendments' substance already governs through the decision record that authorises each of them, so declare to the shape below now.
  2. Declare in your own INTENT.md frontmatter. That is the declaration (GH-DEC-2026-017 §1). Use ops-warden's layer.yaml as the machine-readable reference form, which is a derived artifact that must be marked derived, must name INTENT.md as its source, and must agree with it. Adapt its repository, layer, contacts, and ownership facts; do not copy ops-warden-specific claims as your own.
  3. If the repository is PEP-shaped, use pep-stance.yaml as the stance-map reference and publish the resulting path in the repository's layer declaration.
  4. Adapt scripts/check_layer_conformance.py and tests/test_layer_conformance.py, then run both checks in the declaring repo.
  5. Send the declaration and any stance-map inventory pointer to gate-house for doctrine/register review. Route credential or operational-lane questions back through warden route; do not place doctrine in the routing catalog.

Reference checks in this checkout:

python3 scripts/check_layer_conformance.py
pytest tests/test_layer_conformance.py

Reference-form change set — 2026-09-21 (GH-DEC-2026-017)

If you copied ops-warden's layer.yaml before 2026-09-21, it is now the wrong shape in three ways. The change is to the reference form, which is why gate-house asked ops-warden to make it here rather than asking each adopter to work it out. Apply all three in your own repository; ops-warden does not edit anyone else's files.

  1. Remove standard_version: from the sidecar and from your INTENT.md frontmatter. A layer declaration MUST NOT carry a standard version (GH-DEC-2026-017 §5, amendment A12): the declared layer is a standing property that does not change when the standard is revised, and a version in the declaration makes every revision read as though it invalidated every declaration. Keeping it "for information" was declined explicitly — a field that is present will be branched on. Version-scoped state belongs in the derived conformance record. If your checker lists standard_version as a required key, or prints it in a report line, it will now reject a conforming declaration — fix the checker in the same commit.
  2. Add derived: true and derived_from: INTENT.md. The sidecar is a derived artifact under §11's derived-artifact rule and does not govern (GH-DEC-2026-017 §1, amendment A11). If your INTENT.md has no frontmatter layer: key, add one — that, not the sidecar and not a prose line, is your declaration.
  3. Fold ASCII case before comparing a layer value, and re-spell nothing. §3's vocabulary is closed and has four tokens — Taxonomy, Tooling, Engine, Staff — and comparison is case-insensitive (GH-DEC-2026-017 §2 and §3, amendment A9). Staff and staff are the same value; a lowercase declaration is conforming, not tolerated. Two traps: a validator that admits only three tokens and rejects Taxonomy carries a defect — the layer this standard itself occupies is in the vocabulary; and an equality assertion between your two forms silently performs the re-spelling the ruling declined to order. Assert the fold, so a real layer divergence still fails.

A disagreement between the two forms, after folding, is a finding in its own right and must be reported rather than resolved away by precedence. Precedence says which value is your answer; it does not say the disagreement did not happen.

pep-stance.yaml is not a layer declaration and is out of scope here: its standard_version / standard_version_reviewed pair is a stance map's record of what was reviewed, and stays.

ops-warden's applied instance of this change set is commit-local: INTENT.md, layer.yaml, scripts/check_layer_conformance.py, tests/test_layer_conformance.py. Read those four together rather than the sidecar alone.

Ownership boundary

gate-house owns what the model requires. Each repository owns the truth of its own declaration. ops-warden owns only this discoverable path to those sources.