docs(canon): reconcile workload and tenant grouping semantics

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md

@@ -0,0 +1,80 @@
+---
+id: NK-WP-0028
+type: workplan
+title: "Publish zone canon and clarify tenant grouping semantics"
+domain: infotech
+repo: net-kingdom
+status: finished
+owner: codex
+topic_slug: netkingdom
+planning_priority: P1
+created: "2026-08-22"
+updated: "2026-08-22"
+---
+
+# NK-WP-0028 — Canon publication and grouping semantics
+
+Authorized by the operator on 2026-08-22 after repository triage. This work
+publishes the zone-engine owner draft, reconciles its authoritative workload
+reference semantics with Tenancy Posture, resolves ADR-0013's now-load-bearing
+grouping ambiguity, and makes the existing ADR set publication-addressable.
+
+## Publish and integrate Security Zones v0.1
+
+```task
+id: NK-WP-0028-T01
+status: done
+priority: high
+```
+
+Reviewed zone-engine revision `a510393` against Tenancy Posture Decisions 5.6.1
+and 5.6.2 and RMGR-ADR-004. Published it as proposed canon at
+`canon/standards/security-zones_v0.1.md`, retaining workload-only zone
+membership, explicit `not-applicable` for native non-workload subjects, and
+`unknown` for missing or ambiguous workload references. Replaced the tenancy
+schema's placeholder `zones:` object with the standard's five memberships,
+admission context, evidence, and review fields.
+
+## Clarify current grouping versus historical identifier segment
+
+```task
+id: NK-WP-0028-T02
+status: done
+priority: high
+```
+
+Amended NK-ADR-0013 so the immutable tenant identifier retains its
+onboarding-time grouping segment as history while `tenant-engine.grouping` is
+the mutable, authoritative current classification. Consumers may not derive
+current policy, guardrail, or spend-ceiling inputs by splitting a tenant id.
+Propagated the ruling to IAM Profile v0.3 and the Tenant Engine Boundary
+Contract.
+
+## Add publication metadata and ignore generated architecture cache
+
+```task
+id: NK-WP-0028-T03
+status: done
+priority: medium
+```
+
+Added unique `NK-ADR-*` identifiers plus owner, revision, review date, and
+review interval metadata to ADR-0006 through ADR-0015 that exist in this repo.
+Recorded the security-zone source revision and added the generated architecture
+AST cache to `.gitignore`.
+
+## Verification
+
+```task
+id: NK-WP-0028-T04
+status: done
+priority: medium
+```
+
+Verified the JSON schema parses, all 14 tenancy-posture unit tests pass, and the
+repository diff has no whitespace errors. Seven estate declarations were also
+checked: five validate; the previously-routed flex-auth `implemented A2` drift
+and railiance-platform apps-pg R2/V1 evidence drift remain owner work and are
+not regressions from this change. Workplan state was reconciled with State Hub.
+Remaining external decisions stay tracked as waits in NK-WP-0027 and
+NK-WP-0022.