docs(canon): reconcile workload and tenant grouping semantics

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

tools/tenancy-posture/validate.py

@@ -38,6 +38,30 @@ def validate_semantics(document: dict[str, Any], path: pathlib.Path) -> list[str
 
     for entry in entries:
         name = entry["service"]
+        workload_identity = entry.get("workload_identity")
+        if workload_identity:
+            if workload_identity["name"] != name:
+                errors.append(
+                    f"{name}: workload_identity.name must equal service"
+                )
+            bindings = workload_identity["identity_bindings"]
+            binding_keys = [
+                (
+                    binding["scheme"],
+                    binding["authority"],
+                    binding["subject"],
+                    binding.get("environment"),
+                )
+                for binding in bindings
+            ]
+            if len(binding_keys) != len(set(binding_keys)):
+                errors.append(f"{name}: workload identity bindings must be unique")
+        zones = entry.get("zones")
+        if zones:
+            zone_reviewed = dt.date.fromisoformat(zones["reviewed"])
+            zone_review_due = dt.date.fromisoformat(zones["review_due"])
+            if zone_review_due <= zone_reviewed:
+                errors.append(f"{name}: zones.review_due must be after zones.reviewed")
         posture = entry["tenancy"]
         current = posture["current"]
         reason = posture.get("reason", {})