---
id: NK-WP-0028
type: workplan
title: "Publish zone canon and clarify tenant grouping semantics"
domain: infotech
repo: net-kingdom
status: finished
owner: codex
topic_slug: netkingdom
planning_priority: P1
created: "2026-08-22"
updated: "2026-08-22"
state_hub_workstream_id: "869a6cfe-60e3-52af-8fad-895e3204a9e8"
---

# NK-WP-0028 — Canon publication and grouping semantics

Authorized by the operator on 2026-08-22 after repository triage. This work
publishes the zone-engine owner draft, reconciles its authoritative workload
reference semantics with Tenancy Posture, resolves ADR-0013's now-load-bearing
grouping ambiguity, and makes the existing ADR set publication-addressable.

## Publish and integrate Security Zones v0.1

```task
id: NK-WP-0028-T01
status: done
priority: high
state_hub_task_id: "e2fb5fe9-0453-5a7b-b619-7001ccf4d345"
```

Reviewed zone-engine revision `a510393` against Tenancy Posture Decisions 5.6.1
and 5.6.2 and RMGR-ADR-004. Published it as proposed canon at
`canon/standards/security-zones_v0.1.md`, retaining workload-only zone
membership, explicit `not-applicable` for native non-workload subjects, and
`unknown` for missing or ambiguous workload references. Replaced the tenancy
schema's placeholder `zones:` object with the standard's five memberships,
admission context, evidence, and review fields.

## Clarify current grouping versus historical identifier segment

```task
id: NK-WP-0028-T02
status: done
priority: high
state_hub_task_id: "320bde34-ca8e-5e69-894f-f8c64f63d3f2"
```

Amended NK-ADR-0013 so the immutable tenant identifier retains its
onboarding-time grouping segment as history while `tenant-engine.grouping` is
the mutable, authoritative current classification. Consumers may not derive
current policy, guardrail, or spend-ceiling inputs by splitting a tenant id.
Propagated the ruling to IAM Profile v0.3 and the Tenant Engine Boundary
Contract.

## Add publication metadata and ignore generated architecture cache

```task
id: NK-WP-0028-T03
status: done
priority: medium
state_hub_task_id: "1016e683-f247-5029-b7da-d5289d10dba3"
```

Added unique `NK-ADR-*` identifiers plus owner, revision, review date, and
review interval metadata to ADR-0006 through ADR-0015 that exist in this repo.
Recorded the security-zone source revision and added the generated architecture
AST cache to `.gitignore`.

## Verification

```task
id: NK-WP-0028-T04
status: done
priority: medium
state_hub_task_id: "339bcd81-484a-5040-831c-fea5b8c74bf0"
```

Verified the JSON schema parses, all 14 tenancy-posture unit tests pass, and the
repository diff has no whitespace errors. Seven estate declarations were also
checked: five validate; the previously-routed flex-auth `implemented A2` drift
and railiance-platform apps-pg R2/V1 evidence drift remain owner work and are
not regressions from this change. Workplan state was reconciled with State Hub.
Remaining external decisions stay tracked as waits in NK-WP-0027 and
NK-WP-0022.