Apply GH-DEC-2026-020 to the layer conformance checker

The checker now prints VALIDATED_AGAINST and its scope on every run,
including the OK line (kings-guard pattern). A12 detection widens from
the key name standard_version to every key and value of INTENT.md
frontmatter and layer.yaml: versioned standard:/companion: paths,
companion_version, and any *_version key except schema_version.
Comments and non-declaration files are not reached. Declaration
unchanged; gate-house confirmed it conforms.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

tools/check_layer_conformance.py

@@ -16,7 +16,16 @@ Per GH-DEC-2026-017 (amendments A9, A11, A12): INTENT.md governs and
 layer.yaml is a derived artifact that must be marked derived and name
 INTENT.md as its source; layer values are compared against §3's closed
 four-token vocabulary after an ASCII case-fold, and neither form is
-re-spelled; neither form carries a standard_version.
+re-spelled; neither form carries a standard version.
+
+Per GH-DEC-2026-020 (A12 r2), "carries a standard version" is a property of
+the content, not of a key name. The declaration is every key and value of the
+INTENT.md frontmatter and of layer.yaml; a version-bearing `standard:` or
+`companion:` path, a `companion_version`, or any `*_version` key other than
+`schema_version` is a pin and fails. Comments and `schema_version` are not
+reached. Stance, claims, and evidence-classification maps are not
+declarations and are never read here. The version belongs to the run: every
+run prints VALIDATED_AGAINST and the scope it ranged over.
 
 The failure it exists to catch is a *convenience* — a live lookup, an
 OpenBao client, or an /authorize helper "just for this consumer". That is
@@ -32,6 +41,7 @@ from __future__ import annotations
 
 import argparse
 import ast
+import re
 import sys
 from datetime import date
 from pathlib import Path
@@ -44,6 +54,25 @@ TOOLS = ROOT / "tools"
 DECL = ROOT / "layer.yaml"
 INTENT = ROOT / "INTENT.md"
 
+# The standard text this checker was built and validated against. A
+# declaration carries no version (A12 r2); the run states it instead
+# (GH-DEC-2026-020 §4). Bump when re-validated against a newer accepted text.
+VALIDATED_AGAINST = "net-kingdom/canon/standards/security-layer-model_v0.7.md"
+
+# What a run ranges over. Nothing else in the tree is read; in particular no
+# stance, claims, or evidence-classification map (GH-DEC-2026-020 §3).
+SCOPE = "INTENT.md frontmatter, layer.yaml (A12 across all keys and values), tools/**/*.py"
+
+# A12 r2: keys that are version pins. schema_version is the file format's own
+# version and is not reached.
+VERSION_KEY = re.compile(r"(^|_)version$", re.IGNORECASE)
+NOT_REACHED_KEYS = {"schema_version"}
+# A version in a path (`..._v0.7.md`, `...-v1.md`) anywhere in a value.
+VERSIONED_PATH = re.compile(r"[_-]v\d+(\.\d+)*(\.[A-Za-z]+)?\b", re.IGNORECASE)
+# A bare version token (`v0.2`, `0.7`) in the value of a standard/companion pin.
+PIN_KEYS = {"standard", "companion", "framework"}
+VERSION_TOKEN = re.compile(r"\bv?\d+\.\d+(\.\d+)*\b", re.IGNORECASE)
+
 TOOLING_IMPORTS = {
     "hvac": "OpenBao / Vault client",
     "bao": "OpenBao client",
@@ -117,11 +146,7 @@ def load_declaration(path: Path = DECL) -> dict[str, Any]:
         raise ConformanceError(
             f"{path.name} derives from {data['derived_from']!r}; §11 names INTENT.md"
         )
-    if "standard_version" in data:
-        raise ConformanceError(
-            f"{path.name} carries 'standard_version'; a layer declaration MUST NOT "
-            "(GH-DEC-2026-017 §5, A12)"
-        )
+    _reject_versions(path.name, data)
     return dict(data)
 
 
@@ -131,14 +156,48 @@ def load_intent(path: Path = INTENT) -> dict[str, Any]:
     front = _frontmatter(path)
     if "layer" not in front:
         raise ConformanceError("INTENT.md frontmatter has no 'layer:' key (§11)")
-    if "standard_version" in front:
-        raise ConformanceError(
-            "INTENT.md frontmatter carries 'standard_version'; a layer declaration "
-            "MUST NOT (GH-DEC-2026-017 §5, A12)"
-        )
+    _reject_versions("INTENT.md frontmatter", front)
     return front
 
 
+def declaration_versions(data: Any, where: str = "") -> list[str]:
+    """Every standard/companion version pin in a declaration (A12 r2).
+
+    Walks all keys and values. Comments never reach here (YAML drops them);
+    schema_version is skipped by name.
+    """
+    found: list[str] = []
+    if isinstance(data, Mapping):
+        for key, value in data.items():
+            name = str(key)
+            here = f"{where}.{name}" if where else name
+            if name.lower() in NOT_REACHED_KEYS:
+                continue
+            if VERSION_KEY.search(name):
+                found.append(f"key '{here}' is a version pin")
+                continue
+            if name.lower() in PIN_KEYS and isinstance(value, (str, int, float)):
+                if VERSION_TOKEN.search(str(value)) or VERSIONED_PATH.search(str(value)):
+                    found.append(f"'{here}: {value}' carries a version")
+                    continue
+            found.extend(declaration_versions(value, here))
+    elif isinstance(data, list):
+        for index, item in enumerate(data):
+            found.extend(declaration_versions(item, f"{where}[{index}]"))
+    elif isinstance(data, str) and VERSIONED_PATH.search(data):
+        found.append(f"'{where}: {data}' is a version-bearing path")
+    return found
+
+
+def _reject_versions(source: str, data: Any) -> None:
+    hits = declaration_versions(data)
+    if hits:
+        raise ConformanceError(
+            f"{source} carries a standard version; a layer declaration MUST NOT, in any "
+            f"key or value (GH-DEC-2026-017 §5, GH-DEC-2026-020, A12 r2): " + "; ".join(hits)
+        )
+
+
 def _norm(value: Any) -> str:
     """ASCII case-fold (§3 as amended by A9). Only A-Z are folded."""
     text = str(value or "").strip()
@@ -294,6 +353,8 @@ def main(argv: Iterable[str] | None = None) -> int:
     args = parser.parse_args(list(argv) if argv is not None else None)
 
     code, errors, reports = evaluate()
+    print(f"checker validated against: {VALIDATED_AGAINST}")
+    print(f"scope: {SCOPE}")
     if args.report:
         try:
             decl = load_declaration()
@@ -323,7 +384,11 @@ def main(argv: Iterable[str] | None = None) -> int:
         print("  Do not declare it to make the check pass.", file=sys.stderr)
         return 1
     if not args.report:
-        print(f"OK: Engine/PIP declaration agrees with INTENT.md; no Tooling client or decision surface in {TOOLS.relative_to(ROOT)}")
+        print(
+            "OK: Engine/PIP declaration agrees with INTENT.md and carries no standard "
+            f"version; no Tooling client or decision surface in {TOOLS.relative_to(ROOT)}; "
+            f"validated against {VALIDATED_AGAINST}"
+        )
     return 0