From a286b916526d7f875f5601fb9f8ee1287836d96d Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 22 Aug 2026 14:55:10 +0200 Subject: [PATCH] docs(workplan): align managed workload declaration wording Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb --- workplans/NK-WP-0027-reef-placement-reconciliation.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/workplans/NK-WP-0027-reef-placement-reconciliation.md b/workplans/NK-WP-0027-reef-placement-reconciliation.md index dc492b6..c880c77 100644 --- a/workplans/NK-WP-0027-reef-placement-reconciliation.md +++ b/workplans/NK-WP-0027-reef-placement-reconciliation.md @@ -172,9 +172,11 @@ state_hub_task_id: "d60e209d-3090-59e7-afc4-0a3780507403" applications.** In the `security-zones_v0.1` publication review, require a stable workload identity and responsible party for operational/control-plane units, and a machine-readable join from credential/control resources to the -workload they serve. Do not require `rapp` packaging merely to gain identity, -and do not infer the join from path strings or repository ownership. Coordinate -the declaration boundary with `zone-engine`, `repo-manager`, and the affected +workload they serve. Require the authoritative rapp declaration for managed +deployables, but do not invent a workload or rapp for native non-workload +subjects or independently governed units that are not managed deployables. Do +not infer the join from path strings or repository ownership. Coordinate the +declaration boundary with `zone-engine`, `repo-manager`, and the affected control owners. **Done 2026-08-22.** Tenancy Posture draft-12 Decision 5.6.2 and its schema now