Apply GH-DEC-2026-017: INTENT.md governs, layer.yaml is derived, no version

Verified against gate-house's committed ruling (decisions/decisions.md,
GH-DEC-2026-017) and amendments A9-A13, then ops-warden's reference change set
(a70f559, wiki/playbooks/netkingdom-layer-declaration.md). They agree.

layer.yaml: standard_version removed; derived: true and derived_from:
INTENT.md added; declared_by kept. INTENT.md frontmatter never carried
standard_version, but its standard: value was a version-pinned path; it is
de-versioned as the reference instance did. No layer value is re-spelled:
INTENT.md still says Engine and layer.yaml still says engine.

The checker changes in the same commit because it listed standard_version as
a required key: removing the field alone would have made a conforming
declaration exit 2 MALFORMED. It now reads INTENT.md as the governing form,
requires the derived marking, rejects a returning standard_version in either
form, checks both layer values against the closed four-token vocabulary
(Taxonomy included) after an ASCII fold, and reports a post-fold disagreement
between the forms as a finding rather than resolving it by precedence.

Tests assert the fold, not per-file spelling, and cover fold agreement, a
real disagreement, the closed vocabulary and a returning version. Full suite
430 passed.

role:, pep-stance.yaml and schema_version are untouched (not ruled). Still
open: where the removed version lives in a derived conformance record; asked
of gate-house by ops-warden (4220413a), followed rather than chosen here.

Closes the SECRETS-WP-0008 note that waited on the reference form.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

tests/test_layer_conformance.py

@@ -6,6 +6,7 @@ from the code is worse than none.
 """
 from __future__ import annotations
 
+import importlib.util
 import subprocess
 import sys
 from pathlib import Path
@@ -38,28 +39,108 @@ def _stance() -> dict:
     return yaml.safe_load(STANCE.read_text(encoding="utf-8"))
 
 
+def _front() -> dict:
+    text = INTENT.read_text(encoding="utf-8")
+    assert text.startswith("---"), "companion §2 requires INTENT.md frontmatter"
+    end = text.find("\n---", 3)
+    return yaml.safe_load(text[3:end])
+
+
+def _fold(value: object) -> str:
+    """§3 as amended (A9): comparison is ASCII case-insensitive."""
+    return str(value).strip().encode("ascii", "ignore").decode().lower()
+
+
+def _checker():
+    spec = importlib.util.spec_from_file_location("check_layer_conformance", SCRIPT)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
 def test_declares_engine_lifecycle_in_its_own_voice():
     assert DECL.exists(), "no layer.yaml — §11 requires a machine-readable declaration"
     data = _decl()
     assert data["repository"] == "secrets-engine"
-    assert data["layer"] == "engine"
+    # Fold, never equality: the ruling declined to order a re-spelling.
+    assert _fold(data["layer"]) == "engine"
     assert data["role"] == "lifecycle"
     assert data["declared_by"] == "INTENT.md"
+    assert data["derived"] is True
+    assert data["derived_from"] == "INTENT.md"
     assert data["decision_surfaces_exposed"] == "none"
     assert data["pep_shaped"] is True
 
 
 def test_intent_frontmatter_matches_declaration():
-    text = INTENT.read_text(encoding="utf-8")
-    assert text.startswith("---"), "companion §2 requires INTENT.md frontmatter"
-    end = text.find("\n---", 3)
-    front = yaml.safe_load(text[3:end])
-    assert front["layer"] == "Engine"
+    front = _front()
+    assert _fold(front["layer"]) == "engine"
+    assert _fold(_decl()["layer"]) == _fold(front["layer"]), (
+        "INTENT.md governs and layer.yaml must agree after folding (GH-DEC-2026-017 §1-§2)"
+    )
     assert front["role"] == "Lifecycle"
     assert front["declaration"] == "layer.yaml"
     assert front["pep_stance"] == "pep-stance.yaml"
 
 
+def test_no_standard_version_in_either_form():
+    """GH-DEC-2026-017 §5 / A12: a layer declaration carries no standard version."""
+    assert "standard_version" not in _decl()
+    assert "standard_version" not in _front()
+    assert not str(_front().get("standard", "")).endswith(".md")
+
+
+def _run_checker(tmp_path, monkeypatch, intent_layer: str, sidecar_layer: str) -> int:
+    checker = _checker()
+    front = _front()
+    front["layer"] = intent_layer
+    intent = tmp_path / "INTENT.md"
+    intent.write_text("---\n" + yaml.safe_dump(front) + "---\n\n# INTENT\n", encoding="utf-8")
+    decl = _decl()
+    decl["layer"] = sidecar_layer
+    sidecar = tmp_path / "layer.yaml"
+    sidecar.write_text(yaml.safe_dump(decl), encoding="utf-8")
+    monkeypatch.setattr(checker, "INTENT", intent)
+    monkeypatch.setattr(checker, "DECL", sidecar)
+    monkeypatch.setattr(sys, "argv", ["check_layer_conformance.py"])
+    try:
+        return checker.main()
+    except SystemExit as exc:
+        return int(exc.code)
+
+
+def test_checker_folds_case_between_forms(tmp_path, monkeypatch):
+    assert _run_checker(tmp_path, monkeypatch, "ENGINE", "engine") == 0
+    assert _run_checker(tmp_path, monkeypatch, "Engine", "Engine") == 0
+
+
+def test_checker_reports_a_real_disagreement(tmp_path, monkeypatch, capsys):
+    """A post-fold disagreement is a finding, not resolved by precedence."""
+    assert _run_checker(tmp_path, monkeypatch, "Engine", "staff") == 1
+    assert "DECLARATION DISAGREEMENT" in capsys.readouterr().out
+
+
+def test_checker_vocabulary_is_closed_at_four_tokens(tmp_path, monkeypatch, capsys):
+    checker = _checker()
+    assert checker.LAYER_VOCABULARY == {"taxonomy", "tooling", "engine", "staff"}
+    # Taxonomy is in the vocabulary: a finding (wrong layer for this repo), not MALFORMED.
+    assert _run_checker(tmp_path, monkeypatch, "Taxonomy", "taxonomy") == 1
+    assert _run_checker(tmp_path, monkeypatch, "surface", "surface") == 2
+    assert "outside §3's closed vocabulary" in capsys.readouterr().out
+
+
+def test_checker_rejects_a_returning_standard_version(tmp_path, monkeypatch):
+    checker = _checker()
+    decl = _decl()
+    decl["standard_version"] = "0.8"
+    sidecar = tmp_path / "layer.yaml"
+    sidecar.write_text(yaml.safe_dump(decl), encoding="utf-8")
+    monkeypatch.setattr(checker, "DECL", sidecar)
+    with pytest.raises(SystemExit) as raised:
+        checker.load_declaration()
+    assert raised.value.code == 2
+
+
 def test_checker_passes_on_the_real_tree():
     result = subprocess.run(
         [sys.executable, str(SCRIPT)],