Apply GH-DEC-2026-020: de-version the standard path and widen the checker.

INTENT.md's standard: path drops _v0.7.md; a version inside the path is a
standard version under A12 r2. The conformance checker now rejects a
version in any key or value of INTENT.md frontmatter and layer.yaml
(standard_version, companion_version, versioned standard/companion paths),
leaves schema_version and pep-stance.yaml alone, and prints VALIDATED_AGAINST
and SCOPE on every run, following kings-guard. Tests fail if a versioned
standard: path or companion_version returns.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

scripts/check_layer_conformance.py

@@ -8,12 +8,17 @@ INTENT.md frontmatter governs the layer; layer.yaml is its derived form.
 The failure this exists to catch is a convenience: an OpenBao, Vault, LDAP,
 or cluster client arriving as one import. That is an undeclared violation.
 
+Every run prints the standard text it checks against (VALIDATED_AGAINST) and
+the scope it ranged over (SCOPE), on the OK line and in --report. The version
+lives in the run, not in the declaration (GH-DEC-2026-020, A12 r2).
+
 Exit 0 clean, 1 undeclared contact found, 2 declaration malformed.
 """
 from __future__ import annotations
 
 import argparse
 import ast
+import re
 import sys
 from pathlib import Path
 
@@ -25,6 +30,25 @@ sys.path.insert(0, str(ROOT / "src"))
 
 from user_engine.layer_yaml import load_mapping, load_mapping_text  # noqa: E402
 
+# The standard text this checker was built and validated against. The version
+# belongs to the run, not to the declaration (GH-DEC-2026-020 §4, A12 r2); it is
+# printed on every run. Bump it when the checker is re-validated.
+VALIDATED_AGAINST = "net-kingdom/canon/standards/security-layer-model_v0.7.md"
+
+# What every run ranges over. Stance, claims and classification maps
+# (pep-stance.yaml) are not declarations and are not checked for versions
+# (GH-DEC-2026-020 §3).
+SCOPE = (
+    "declaration: INTENT.md frontmatter + layer.yaml (all keys and values); "
+    "imports: src/user_engine/**/*.py"
+)
+
+# A12 r2: no standard or companion version in any key or value of the
+# declaration. Comments are not parsed; schema_version is not reached.
+VERSION_KEY = re.compile(r"(?:^|_)version$", re.IGNORECASE)
+VERSION_VALUE = re.compile(r"(?:^|[_\-/\s])v?\d+\.\d+(?:\.\d+)*(?:\.md)?(?=$|[\s/])|_v\d+", re.IGNORECASE)
+UNREACHED_KEYS = {"schema_version"}
+
 TOOLING_IMPORTS = {
     "hvac": "OpenBao / Vault client",
     "bao": "OpenBao client",
@@ -57,6 +81,39 @@ def fold(value: object) -> str:
     )
 
 
+def find_versions(node: object, where: str, path: str = "") -> list[str]:
+    """Every key or value in a declaration that carries a version (A12 r2)."""
+    found: list[str] = []
+    if isinstance(node, dict):
+        for key, value in node.items():
+            here = f"{path}.{key}" if path else str(key)
+            if str(key) in UNREACHED_KEYS:
+                continue
+            if VERSION_KEY.search(str(key)):
+                found.append(f"{where}: key '{here}'")
+                continue
+            found.extend(find_versions(value, where, here))
+    elif isinstance(node, list):
+        for index, item in enumerate(node):
+            found.extend(find_versions(item, where, f"{path}[{index}]"))
+    elif isinstance(node, str) and VERSION_VALUE.search(node):
+        found.append(f"{where}: value of '{path}' = {node!r}")
+    return found
+
+
+def reject_versions(data: dict, where: str) -> None:
+    found = find_versions(data, where)
+    if found:
+        print(
+            "FAIL: a layer declaration MUST NOT carry a standard or companion "
+            "version in any key or value (GH-DEC-2026-017 §5, GH-DEC-2026-020, A12 r2)",
+            file=sys.stderr,
+        )
+        for item in found:
+            print(f"  {item}", file=sys.stderr)
+        raise SystemExit(2)
+
+
 def load_intent_layer() -> str:
     """Return the governing `layer:` value from INTENT.md frontmatter (§11)."""
     try:
@@ -73,6 +130,7 @@ def load_intent_layer() -> str:
     except ValueError as exc:
         print(f"FAIL: {INTENT.name} frontmatter is not parseable: {exc}", file=sys.stderr)
         raise SystemExit(2) from exc
+    reject_versions(front, f"{INTENT.name} frontmatter")
     if "layer" not in front:
         print(f"FAIL: {INTENT.name} frontmatter has no 'layer:' key (§11)", file=sys.stderr)
         raise SystemExit(2)
@@ -94,13 +152,7 @@ def load_declaration() -> dict:
         if key not in data:
             print(f"FAIL: {DECL.name} missing required key '{key}' (§11)", file=sys.stderr)
             raise SystemExit(2)
-    if "standard_version" in data:
-        print(
-            f"FAIL: {DECL.name} carries standard_version; a layer declaration "
-            "MUST NOT carry a standard version (GH-DEC-2026-017, A12)",
-            file=sys.stderr,
-        )
-        raise SystemExit(2)
+    reject_versions(data, DECL.name)
     if data["derived"] is not True or data["derived_from"] != "INTENT.md":
         print(
             f"FAIL: {DECL.name} must be marked derived: true, derived_from: INTENT.md "
@@ -192,6 +244,8 @@ def main() -> int:
             f"user-engine — layer {decl['layer']}/{decl['role']} "
             f"(derived from {decl['derived_from']})"
         )
+        print(f"  checked against: {VALIDATED_AGAINST}")
+        print(f"  scope: {SCOPE}")
         print("  tooling contacts declared: 0")
         print(f"  own-store declarations: {len(own_store)}")
         print(f"  own-store imports: {len(own_store_hits)}")
@@ -219,7 +273,7 @@ def main() -> int:
     if not args.report:
         print(
             f"OK: no catalogued Tooling client in {SRC.relative_to(ROOT)} "
-            "(Engine/PIP, §11)"
+            f"(Engine/PIP, §11); checked against {VALIDATED_AGAINST}; scope: {SCOPE}"
         )
     return 0