Apply GH-DEC-2026-017 to the layer declaration

INTENT.md governs; layer.yaml is now marked derived (derived: true,
derived_from: INTENT.md). standard_version is removed from both forms
(A12). The checker changes in the same commit: it no longer requires or
prints standard_version, rejects it in either form, requires the derived
markers, and checks both layer values against the closed four-token
vocabulary after an ASCII case-fold (A9). Layer values are left as
spelled (INTENT.md Engine, layer.yaml engine); they agree once folded.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

INTENT.md

@@ -2,7 +2,6 @@
 layer: Engine
 role: PIP
 standard: netkingdom-security-layer-model
-standard_version: "0.7"
 companion: net-kingdom/SECURITY-COMPANION.md
 ---
 

layer.yaml

@@ -2,7 +2,8 @@
 #
 # Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md
 # Companion: net-kingdom/SECURITY-COMPANION.md v0.2
-# Declaration: INTENT.md (this repository's own voice, §11)
+# Declaration: INTENT.md (this repository's own voice, §11). This file is a
+#              derived artifact and does not govern (GH-DEC-2026-017 §1).
 # Validate:    python3 tools/check_layer_conformance.py
 #
 # §11 requires a machine-readable form because prose cannot distinguish a
@@ -15,7 +16,9 @@
 
 schema_version: "0.1"
 framework: netkingdom-security-layer-model
-standard_version: "0.7"
+# No standard_version: a layer declaration carries none (GH-DEC-2026-017 §5, A12).
+derived: true
+derived_from: INTENT.md
 repository: zone-engine
 layer: engine
 role: pip

tests/test_layer_conformance.py

@@ -11,7 +11,6 @@ INTENT = """---
 layer: Engine
 role: PIP
 standard: netkingdom-security-layer-model
-standard_version: "0.7"
 ---
 
 # INTENT
@@ -21,7 +20,8 @@ DECL = {
     "layer": "engine",
     "role": "pip",
     "repository": "zone-engine",
-    "standard_version": "0.7",
+    "derived": True,
+    "derived_from": "INTENT.md",
     "tooling_contacts": [],
     "unowned_capabilities": [],
 }
@@ -45,13 +45,30 @@ class LayerDeclarationTest(unittest.TestCase):
         self.assertEqual(decl["repository"], "zone-engine")
         self.assertEqual(decl["layer"], "engine")
         self.assertEqual(decl["role"], "pip")
-        self.assertEqual(decl["standard_version"], "0.7")
+        self.assertIs(decl["derived"], True)
+        self.assertEqual(decl["derived_from"], "INTENT.md")
         self.assertEqual(decl["tooling_contacts"], [])
         self.assertIsNone(decl.get("pep_stance"))
         self.assertEqual(intent["layer"].lower(), "engine")
         self.assertEqual(intent["role"].lower(), "pip")
         self.assertEqual(layer.check_declaration_agrees(decl, intent), [])
 
+    def test_the_two_forms_agree_once_case_is_folded(self):
+        """A9/A11: assert the fold, not equality; nothing is re-spelled."""
+        decl = yaml.safe_load(layer.DECL.read_text())
+        intent = layer.load_intent()
+        self.assertEqual(layer._norm(decl["layer"]), layer._norm(intent["layer"]))
+        self.assertIn(layer._norm(intent["layer"]), layer.LAYER_VOCABULARY)
+
+    def test_no_declaration_carries_a_standard_version(self):
+        """GH-DEC-2026-017 §5 / A12, in both forms."""
+        decl = yaml.safe_load(layer.DECL.read_text())
+        self.assertNotIn("standard_version", decl)
+        self.assertNotIn("standard_version", layer.load_intent())
+
+    def test_vocabulary_is_the_closed_four_tokens(self):
+        self.assertEqual(layer.LAYER_VOCABULARY, {"taxonomy", "tooling", "engine", "staff"})
+
     def test_checker_passes_on_the_real_tree(self):
         code, errors, _reports = layer.evaluate()
         self.assertEqual(code, 0, errors)
@@ -76,6 +93,43 @@ class LayerCheckerFailureTest(unittest.TestCase):
             self.assertEqual(code, 2)
             self.assertTrue(any("disagrees" in item for item in errors))
 
+    def test_case_only_difference_is_conforming(self):
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            _write_tree(root, intent=INTENT.replace("layer: Engine", "layer: ENGINE"))
+            code, errors, _ = layer.evaluate(root=root)
+            self.assertEqual(code, 0, errors)
+
+    def test_standard_version_in_either_form_is_exit_2(self):
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            _write_tree(root, decl={**DECL, "standard_version": "0.7"})
+            code, errors, _ = layer.evaluate(root=root)
+            self.assertEqual(code, 2)
+            self.assertTrue(any("standard_version" in item for item in errors))
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            _write_tree(root, intent=INTENT.replace("role: PIP\n", 'role: PIP\nstandard_version: "0.7"\n'))
+            code, errors, _ = layer.evaluate(root=root)
+            self.assertEqual(code, 2)
+            self.assertTrue(any("standard_version" in item for item in errors))
+
+    def test_sidecar_not_marked_derived_is_exit_2(self):
+        for bad in ({**DECL, "derived": False}, {**DECL, "derived_from": "layer.yaml"}):
+            with TemporaryDirectory() as directory:
+                root = Path(directory)
+                _write_tree(root, decl=bad)
+                code, _errors, _ = layer.evaluate(root=root)
+                self.assertEqual(code, 2)
+
+    def test_token_outside_vocabulary_is_exit_2(self):
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            _write_tree(root, intent=INTENT.replace("layer: Engine", "layer: surface"))
+            code, errors, _ = layer.evaluate(root=root)
+            self.assertEqual(code, 2)
+            self.assertTrue(any("closed vocabulary" in item for item in errors))
+
     def test_undeclared_tooling_client_is_exit_1(self):
         with TemporaryDirectory() as directory:
             root = Path(directory)

tools/check_layer_conformance.py

@@ -12,6 +12,12 @@ frontmatter. This script is what makes that claim checkable: it fails if
 layer.yaml is missing, disagrees with INTENT.md, or if a Tooling client or
 decision surface appears under tools/.
 
+Per GH-DEC-2026-017 (amendments A9, A11, A12): INTENT.md governs and
+layer.yaml is a derived artifact that must be marked derived and name
+INTENT.md as its source; layer values are compared against §3's closed
+four-token vocabulary after an ASCII case-fold, and neither form is
+re-spelled; neither form carries a standard_version.
+
 The failure it exists to catch is a *convenience* — a live lookup, an
 OpenBao client, or an /authorize helper "just for this consumer". That is
 this repository's original §7 falsifier, now statute §6.
@@ -72,6 +78,9 @@ HTTP_SURFACE_IMPORTS = {
 
 DECISION_PATHS = ("/authorize", "/v1/check", "/v1/authorize")
 
+# §3 as amended by A9: closed, four tokens, case-insensitive. Stored folded.
+LAYER_VOCABULARY = {"taxonomy", "tooling", "engine", "staff"}
+
 
 class ConformanceError(ValueError):
     """Declaration is missing, unparseable, or disagrees with INTENT.md."""
@@ -97,26 +106,55 @@ def load_declaration(path: Path = DECL) -> dict[str, Any]:
         raise ConformanceError(f"{path.name} is not parseable: {exc}") from exc
     if not isinstance(data, Mapping):
         raise ConformanceError(f"{path.name} must be a mapping")
-    for key in ("layer", "role", "repository", "tooling_contacts", "standard_version"):
+    for key in ("layer", "role", "repository", "derived", "derived_from", "tooling_contacts"):
         if key not in data:
             raise ConformanceError(f"{path.name} missing required key '{key}' (§11)")
+    if data["derived"] is not True:
+        raise ConformanceError(
+            f"{path.name} must be marked 'derived: true' (§11, GH-DEC-2026-017 §1)"
+        )
+    if data["derived_from"] != "INTENT.md":
+        raise ConformanceError(
+            f"{path.name} derives from {data['derived_from']!r}; §11 names INTENT.md"
+        )
+    if "standard_version" in data:
+        raise ConformanceError(
+            f"{path.name} carries 'standard_version'; a layer declaration MUST NOT "
+            "(GH-DEC-2026-017 §5, A12)"
+        )
     return dict(data)
 
 
 def load_intent(path: Path = INTENT) -> dict[str, Any]:
     if not path.exists():
         raise ConformanceError(f"no INTENT.md at {path}")
-    return _frontmatter(path)
+    front = _frontmatter(path)
+    if "layer" not in front:
+        raise ConformanceError("INTENT.md frontmatter has no 'layer:' key (§11)")
+    if "standard_version" in front:
+        raise ConformanceError(
+            "INTENT.md frontmatter carries 'standard_version'; a layer declaration "
+            "MUST NOT (GH-DEC-2026-017 §5, A12)"
+        )
+    return front
 
 
 def _norm(value: Any) -> str:
-    return str(value or "").strip().lower()
+    """ASCII case-fold (§3 as amended by A9). Only A-Z are folded."""
+    text = str(value or "").strip()
+    return text.translate(str.maketrans("ABCDEFGHIJKLMNOPQRSTUVWXYZ", "abcdefghijklmnopqrstuvwxyz"))
 
 
 def check_declaration_agrees(
     decl: Mapping[str, Any], intent: Mapping[str, Any]
 ) -> list[str]:
     errors: list[str] = []
+    for source, value in (("INTENT.md", intent.get("layer")), ("layer.yaml", decl.get("layer"))):
+        if _norm(value) not in LAYER_VOCABULARY:
+            errors.append(
+                f"{source} layer '{value}' is not in §3's closed vocabulary "
+                f"{sorted(LAYER_VOCABULARY)} (case-insensitive)"
+            )
     if _norm(decl.get("layer")) != "engine":
         errors.append(f"declared layer is '{decl.get('layer')}', expected 'engine'")
     if _norm(decl.get("role")) != "pip":
@@ -264,7 +302,7 @@ def main(argv: Iterable[str] | None = None) -> int:
             return 2
         print(
             f"zone-engine — layer {decl['layer']}, role {decl['role']}, "
-            f"standard v{decl['standard_version']}"
+            f"derived from {decl['derived_from']}"
         )
         print(f"  tooling contacts declared: {len(decl.get('tooling_contacts') or [])}")
         print(f"  pep_stance: {decl.get('pep_stance')!r}")