Print the validated standard version and scope on every layer-conformance run

GH-DEC-2026-020 / A12 r2: the checker now walks every key and value of
the INTENT.md frontmatter and layer.yaml, so a versioned standard: or
companion: path and a companion_version are rejected, not only a key named
standard_version. schema_version and comments are not reached, and
pep-stance.yaml / evidence-classification.yaml keep their versions.
Every run prints VALIDATED_AGAINST and its scope, the PASS line included.
Declarations unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

scripts/check_layer_conformance.py

@@ -13,7 +13,16 @@ its own right, reported rather than resolved away by precedence.
 Layer values are compared against §3's closed four-token vocabulary after an
 ASCII case-fold (GH-DEC-2026-017 §2-§3, amendment A9). Nothing is re-spelled:
 `Engine` and `engine` are one token. Neither form carries a standard version
-(GH-DEC-2026-017 §5, amendment A12), and its return is rejected.
+(GH-DEC-2026-017 §5, amendment A12 r2 / GH-DEC-2026-020), and its return is
+rejected. The rule reaches content, not a key name: every key and value of the
+INTENT.md frontmatter and of layer.yaml is walked, so a versioned `standard:` or
+`companion:` path and a `companion_version` are caught as well as a
+`standard_version`. Comments and `schema_version` are not reached. Stance maps
+and evidence classifications (pep-stance.yaml, evidence-classification.yaml)
+are not declarations and A12 is never applied to them (GH-DEC-2026-020 §3).
+
+The version belongs to the run (GH-DEC-2026-020 §4): every run prints
+VALIDATED_AGAINST and the scope it ranged over, including the PASS line.
 
 Mechanical checks:
 
@@ -51,17 +60,67 @@ DECISION_SURFACE = re.compile(
 LAYER_VOCABULARY = {"taxonomy", "tooling", "engine", "staff"}
 EXPECTED_LAYER = "engine"
 
+# The standard text this checker was built and validated against, printed on
+# every run (GH-DEC-2026-020 §4, A12 r2). v0.7 is the accepted text in force;
+# the v0.8 §11 amendments it already applies are named alongside. Bump this
+# when the checker is re-validated against a newer accepted text.
+VALIDATED_AGAINST = "net-kingdom/canon/standards/security-layer-model_v0.7.md"
+AMENDMENTS_APPLIED = "v0.8 A9, A11, A12 r2 (GH-DEC-2026-017, GH-DEC-2026-020)"
+SCOPE = (
+    "declaration = INTENT.md frontmatter + layer.yaml (every key and value); "
+    "source = src/secrets_engine/**/*.py; "
+    "not reached by A12: pep-stance.yaml, evidence-classification.yaml"
+)
+
+# A12 r2: a version of the standard or its companion, anywhere in the
+# declaration. `schema_version` is the declaration file's own schema and is
+# not reached.
+VERSION_KEY = re.compile(r"version", re.IGNORECASE)
+UNREACHED_KEYS = {"schema_version"}
+VERSIONED_REF = re.compile(
+    r"(?i)(security-layer-model|security-companion|layer-model|companion)"
+    r"[^\s]*?(?:[_@-]v?\d+(?:\.\d+)*|\bv\d+(?:\.\d+)*)"
+)
+STANDARD_KEYS = {"standard", "companion", "framework"}
+BARE_VERSION = re.compile(r"(?i)(?:^|[_@\s-])v?\d+\.\d+(?:\.\d+)*\b")
+
 
 def _fold(value: object) -> str:
     """ASCII case-fold, per §3 as amended: two spellings of a token are one token."""
     return str(value).strip().encode("ascii", "ignore").decode().lower()
 
 
+def _version_hits(data: object, path: str = "") -> list[str]:
+    """Every place a standard or companion version appears in a declaration."""
+    hits: list[str] = []
+    if isinstance(data, dict):
+        for key, value in data.items():
+            here = f"{path}.{key}" if path else str(key)
+            if str(key) in UNREACHED_KEYS:
+                continue
+            if VERSION_KEY.search(str(key)):
+                hits.append(f"key {here!r}")
+                continue
+            if isinstance(value, str) and str(key).lower() in STANDARD_KEYS:
+                if BARE_VERSION.search(value):
+                    hits.append(f"{here}: {value!r}")
+                    continue
+            hits.extend(_version_hits(value, here))
+    elif isinstance(data, list):
+        for n, item in enumerate(data):
+            hits.extend(_version_hits(item, f"{path}[{n}]"))
+    elif isinstance(data, str) and VERSIONED_REF.search(data):
+        hits.append(f"{path}: {data!r}")
+    return hits
+
+
 def _no_standard_version(where: str, data: dict) -> None:
-    if "standard_version" in data:
+    hits = _version_hits(data)
+    if hits:
         print(
-            f"MALFORMED: {where} carries 'standard_version' — a layer declaration "
-            "MUST NOT carry a standard version (§11 as amended by A12)"
+            f"MALFORMED: {where} carries a standard or companion version at "
+            f"{'; '.join(hits)} — a layer declaration MUST NOT carry one in any "
+            "key or value (§11 as amended by A12 r2, GH-DEC-2026-020 §1-§2)"
         )
         raise SystemExit(2)
 
@@ -172,6 +231,8 @@ def main() -> int:
     ap = argparse.ArgumentParser()
     ap.add_argument("--report", action="store_true")
     args = ap.parse_args()
+    print(f"validated against: {VALIDATED_AGAINST} [{AMENDMENTS_APPLIED}]")
+    print(f"scope: {SCOPE}")
 
     front = intent_frontmatter()
     decl = load_declaration()
@@ -239,10 +300,14 @@ def main() -> int:
     if ok and not args.report:
         print(
             "PASS — Engine/Lifecycle declaration present, no decision surface, "
-            f"{len(found)} OpenBao adapter module(s) owned."
+            f"{len(found)} OpenBao adapter module(s) owned; "
+            f"validated against {VALIDATED_AGAINST}."
         )
     elif ok:
-        print("\nPASS — declaration, owned tooling, and PEP stance path hold.")
+        print(
+            "\nPASS — declaration, owned tooling, and PEP stance path hold; "
+            f"validated against {VALIDATED_AGAINST}."
+        )
     return 0 if ok else 1