Apply GH-DEC-2026-017 to the layer declaration

INTENT.md governs; layer.yaml is now marked derived (derived: true,
derived_from: INTENT.md). standard_version is removed from both forms
(A12). The checker changes in the same commit: it no longer requires or
prints standard_version, rejects it in either form, requires the derived
markers, and checks both layer values against the closed four-token
vocabulary after an ASCII case-fold (A9). Layer values are left as
spelled (INTENT.md Engine, layer.yaml engine); they agree once folded.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

tools/check_layer_conformance.py

@@ -12,6 +12,12 @@ frontmatter. This script is what makes that claim checkable: it fails if
 layer.yaml is missing, disagrees with INTENT.md, or if a Tooling client or
 decision surface appears under tools/.
 
+Per GH-DEC-2026-017 (amendments A9, A11, A12): INTENT.md governs and
+layer.yaml is a derived artifact that must be marked derived and name
+INTENT.md as its source; layer values are compared against §3's closed
+four-token vocabulary after an ASCII case-fold, and neither form is
+re-spelled; neither form carries a standard_version.
+
 The failure it exists to catch is a *convenience* — a live lookup, an
 OpenBao client, or an /authorize helper "just for this consumer". That is
 this repository's original §7 falsifier, now statute §6.
@@ -72,6 +78,9 @@ HTTP_SURFACE_IMPORTS = {
 
 DECISION_PATHS = ("/authorize", "/v1/check", "/v1/authorize")
 
+# §3 as amended by A9: closed, four tokens, case-insensitive. Stored folded.
+LAYER_VOCABULARY = {"taxonomy", "tooling", "engine", "staff"}
+
 
 class ConformanceError(ValueError):
     """Declaration is missing, unparseable, or disagrees with INTENT.md."""
@@ -97,26 +106,55 @@ def load_declaration(path: Path = DECL) -> dict[str, Any]:
         raise ConformanceError(f"{path.name} is not parseable: {exc}") from exc
     if not isinstance(data, Mapping):
         raise ConformanceError(f"{path.name} must be a mapping")
-    for key in ("layer", "role", "repository", "tooling_contacts", "standard_version"):
+    for key in ("layer", "role", "repository", "derived", "derived_from", "tooling_contacts"):
         if key not in data:
             raise ConformanceError(f"{path.name} missing required key '{key}' (§11)")
+    if data["derived"] is not True:
+        raise ConformanceError(
+            f"{path.name} must be marked 'derived: true' (§11, GH-DEC-2026-017 §1)"
+        )
+    if data["derived_from"] != "INTENT.md":
+        raise ConformanceError(
+            f"{path.name} derives from {data['derived_from']!r}; §11 names INTENT.md"
+        )
+    if "standard_version" in data:
+        raise ConformanceError(
+            f"{path.name} carries 'standard_version'; a layer declaration MUST NOT "
+            "(GH-DEC-2026-017 §5, A12)"
+        )
     return dict(data)
 
 
 def load_intent(path: Path = INTENT) -> dict[str, Any]:
     if not path.exists():
         raise ConformanceError(f"no INTENT.md at {path}")
-    return _frontmatter(path)
+    front = _frontmatter(path)
+    if "layer" not in front:
+        raise ConformanceError("INTENT.md frontmatter has no 'layer:' key (§11)")
+    if "standard_version" in front:
+        raise ConformanceError(
+            "INTENT.md frontmatter carries 'standard_version'; a layer declaration "
+            "MUST NOT (GH-DEC-2026-017 §5, A12)"
+        )
+    return front
 
 
 def _norm(value: Any) -> str:
-    return str(value or "").strip().lower()
+    """ASCII case-fold (§3 as amended by A9). Only A-Z are folded."""
+    text = str(value or "").strip()
+    return text.translate(str.maketrans("ABCDEFGHIJKLMNOPQRSTUVWXYZ", "abcdefghijklmnopqrstuvwxyz"))
 
 
 def check_declaration_agrees(
     decl: Mapping[str, Any], intent: Mapping[str, Any]
 ) -> list[str]:
     errors: list[str] = []
+    for source, value in (("INTENT.md", intent.get("layer")), ("layer.yaml", decl.get("layer"))):
+        if _norm(value) not in LAYER_VOCABULARY:
+            errors.append(
+                f"{source} layer '{value}' is not in §3's closed vocabulary "
+                f"{sorted(LAYER_VOCABULARY)} (case-insensitive)"
+            )
     if _norm(decl.get("layer")) != "engine":
         errors.append(f"declared layer is '{decl.get('layer')}', expected 'engine'")
     if _norm(decl.get("role")) != "pip":
@@ -264,7 +302,7 @@ def main(argv: Iterable[str] | None = None) -> int:
             return 2
         print(
             f"zone-engine — layer {decl['layer']}, role {decl['role']}, "
-            f"standard v{decl['standard_version']}"
+            f"derived from {decl['derived_from']}"
         )
         print(f"  tooling contacts declared: {len(decl.get('tooling_contacts') or [])}")
         print(f"  pep_stance: {decl.get('pep_stance')!r}")