Print the validated standard version and scope on every layer-conformance run

GH-DEC-2026-020 / A12 r2: the checker now walks every key and value of
the INTENT.md frontmatter and layer.yaml, so a versioned standard: or
companion: path and a companion_version are rejected, not only a key named
standard_version. schema_version and comments are not reached, and
pep-stance.yaml / evidence-classification.yaml keep their versions.
Every run prints VALIDATED_AGAINST and its scope, the PASS line included.
Declarations unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

tests/test_layer_conformance.py

@@ -141,6 +141,86 @@ def test_checker_rejects_a_returning_standard_version(tmp_path, monkeypatch):
     assert raised.value.code == 2
 
 
+def _run_with(tmp_path, monkeypatch, front_patch: dict, decl_patch: dict) -> int:
+    checker = _checker()
+    front = {**_front(), **front_patch}
+    decl = {**_decl(), **decl_patch}
+    intent = tmp_path / "INTENT.md"
+    intent.write_text("---\n" + yaml.safe_dump(front) + "---\n\n# INTENT\n", encoding="utf-8")
+    sidecar = tmp_path / "layer.yaml"
+    sidecar.write_text(yaml.safe_dump(decl), encoding="utf-8")
+    monkeypatch.setattr(checker, "INTENT", intent)
+    monkeypatch.setattr(checker, "DECL", sidecar)
+    monkeypatch.setattr(sys, "argv", ["check_layer_conformance.py"])
+    try:
+        return checker.main()
+    except SystemExit as exc:
+        return int(exc.code)
+
+
+@pytest.mark.parametrize(
+    ("front_patch", "decl_patch"),
+    [
+        # GH-DEC-2026-020 §1: a version-bearing standard: path counts.
+        ({"standard": "net-kingdom/canon/standards/security-layer-model_v0.7.md"}, {}),
+        ({"standard": "net-kingdom/canon/standards/security-layer-model_v0.8"}, {}),
+        ({}, {"standard": "net-kingdom/canon/standards/security-layer-model_v0.7.md"}),
+        ({"companion": "net-kingdom/SECURITY-COMPANION_v0.2.md"}, {}),
+        # GH-DEC-2026-020 §2: companion_version counts.
+        ({"companion_version": "0.2"}, {}),
+        ({}, {"companion_version": "0.2"}),
+        ({"standard_version": "0.7"}, {}),
+        ({}, {"standard_version": "0.8"}),
+    ],
+)
+def test_checker_rejects_a_version_anywhere_in_the_declaration(
+    tmp_path, monkeypatch, capsys, front_patch, decl_patch
+):
+    """A12 r2 reaches content, not a key name (GH-DEC-2026-020 §1-§2)."""
+    assert _run_with(tmp_path, monkeypatch, front_patch, decl_patch) == 2
+    out = capsys.readouterr().out
+    assert "standard or companion version" in out
+    # The version belongs to the run: stated even when the run fails.
+    assert "validated against: net-kingdom/canon/standards/security-layer-model_v" in out
+    assert "scope:" in out
+
+
+def test_schema_version_is_not_reached(tmp_path, monkeypatch):
+    """GH-DEC-2026-020 §1: a declaration file's own schema version is not reached."""
+    assert _run_with(tmp_path, monkeypatch, {}, {"schema_version": "0.2"}) == 0
+
+
+def test_stance_and_classification_versions_are_not_reached():
+    """GH-DEC-2026-020 §3: stance maps and classifications keep their version,
+    and the checker never applies A12 to them."""
+    checker = _checker()
+    assert "pep-stance.yaml" in checker.SCOPE and "evidence-classification.yaml" in checker.SCOPE
+    for path in (STANCE, CLASSIFICATION):
+        data = yaml.safe_load(path.read_text(encoding="utf-8"))
+        # Each carries a version A12 would reject if it were applied there...
+        assert checker._version_hits(data), f"{path.name} keeps its standard_version"
+    # ...and the real-tree run still passes: A12 is not applied to them.
+    result = subprocess.run(
+        [sys.executable, str(SCRIPT)], cwd=ROOT, capture_output=True, text=True, check=False
+    )
+    assert result.returncode == 0, result.stdout + result.stderr
+
+
+def test_every_run_states_version_and_scope():
+    """GH-DEC-2026-020 §4: the version and scope are printed on every run, PASS included."""
+    checker = _checker()
+    for argv in ([], ["--report"]):
+        result = subprocess.run(
+            [sys.executable, str(SCRIPT), *argv],
+            cwd=ROOT, capture_output=True, text=True, check=False,
+        )
+        assert result.returncode == 0, result.stdout + result.stderr
+        assert f"validated against: {checker.VALIDATED_AGAINST}" in result.stdout
+        assert "scope: declaration = INTENT.md frontmatter + layer.yaml" in result.stdout
+        pass_line = [l for l in result.stdout.splitlines() if l.startswith("PASS")]
+        assert pass_line and checker.VALIDATED_AGAINST in pass_line[0]
+
+
 def test_checker_passes_on_the_real_tree():
     result = subprocess.run(
         [sys.executable, str(SCRIPT)],