Apply GH-DEC-2026-017: INTENT.md governs, layer.yaml is derived, no version

Verified against gate-house's committed ruling (decisions/decisions.md,
GH-DEC-2026-017) and amendments A9-A13, then ops-warden's reference change set
(a70f559, wiki/playbooks/netkingdom-layer-declaration.md). They agree.

layer.yaml: standard_version removed; derived: true and derived_from:
INTENT.md added; declared_by kept. INTENT.md frontmatter never carried
standard_version, but its standard: value was a version-pinned path; it is
de-versioned as the reference instance did. No layer value is re-spelled:
INTENT.md still says Engine and layer.yaml still says engine.

The checker changes in the same commit because it listed standard_version as
a required key: removing the field alone would have made a conforming
declaration exit 2 MALFORMED. It now reads INTENT.md as the governing form,
requires the derived marking, rejects a returning standard_version in either
form, checks both layer values against the closed four-token vocabulary
(Taxonomy included) after an ASCII fold, and reports a post-fold disagreement
between the forms as a finding rather than resolving it by precedence.

Tests assert the fold, not per-file spelling, and cover fold agreement, a
real disagreement, the closed vocabulary and a returning version. Full suite
430 passed.

role:, pep-stance.yaml and schema_version are untouched (not ruled). Still
open: where the removed version lives in a derived conformance record; asked
of gate-house by ops-warden (4220413a), followed rather than chosen here.

Closes the SECRETS-WP-0008 note that waited on the reference form.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md

@@ -9,7 +9,7 @@ flavor: implementation
 owner: grok
 topic_slug: custodian
 created: "2026-08-29"
-updated: "2026-09-09"
+updated: "2026-09-21"
 state_hub_workstream_id: "9c9e5164-b2f5-5ea2-a557-5368d65e9fe0"
 ---
 
@@ -416,6 +416,47 @@ No task is opened here by hand. This is a note against the workplan that already
 owns `layer.yaml` / `pep-stance.yaml` / INTENT frontmatter staying in one voice;
 the work lands under that exit criterion when ops-warden's form is published.
 
+### 2026-09-21 GH-DEC-2026-017 applied — reference form published, note closed
+
+ops-warden published the reference form (commit `a70f559`,
+`wiki/playbooks/netkingdom-layer-declaration.md` "Reference-form change set").
+Re-read against the ruling in `gate-house/decisions/decisions.md` and
+amendments A9–A13 before editing; the ruling and the playbook agree.
+
+Applied in one commit, field and checker together:
+
+- `layer.yaml`: `standard_version: "0.7"` removed; `derived: true` and
+  `derived_from: INTENT.md` added (`declared_by: INTENT.md` kept, as the note
+  above required). Header comment marks the file derived and drops the version
+  from the framework citation.
+- `INTENT.md` frontmatter: never carried `standard_version`, but its
+  `standard:` value was a version-pinned path (`..._v0.7.md`). De-versioned to
+  `net-kingdom/canon/standards/security-layer-model`, as the reference instance
+  did, because a pinned path in the governing form is a standard version by
+  another name. The field is kept; only the pin is gone.
+- **No layer value re-spelled.** INTENT says `Engine`, layer.yaml says
+  `engine`; both unchanged.
+- `scripts/check_layer_conformance.py`: `standard_version` was a required key,
+  so removing the field alone would have exited 2 MALFORMED. It now reads
+  INTENT.md as the governing form, requires the derived marking, rejects a
+  returning `standard_version` in either form, validates both layer values
+  against the closed four-token vocabulary (Taxonomy included) after an ASCII
+  fold, and reports a post-fold disagreement between the forms as a finding.
+- `tests/test_layer_conformance.py`: per-file equality on the layer spelling
+  replaced by fold assertions; new tests for fold agreement, a real
+  disagreement (finding, exit 1), the closed vocabulary (`surface` exit 2,
+  `Taxonomy` admitted), and a returning `standard_version` (exit 2).
+  Full suite: 430 passed.
+
+`role:` untouched (not ruled). `pep-stance.yaml` untouched (a stance map, not
+a declaration). `schema_version` left at `0.1` — ops-warden bumped its own, but
+the ruling does not call for it.
+
+**Still open, not ours to answer:** where the removed version lives. A12 says
+the derived conformance record already MUST carry it; our checker, like
+ops-warden's, is re-runnable and emits nothing durable. ops-warden asked
+gate-house (message `4220413a`); we follow that answer rather than choose.
+
 ## Exit criteria
 
 - The published PEP stance is the shipped default and stance application is