coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
net-kingdom/workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md
repo-manager db2ef631c6
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
chore(registrar): assign State Hub identifiers 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb
2026-08-22 14:54:45 +02:00

2.9 KiB
Raw Blame History

id type title domain repo status owner topic_slug planning_priority created updated state_hub_workstream_id
NK-WP-0028 workplan Publish zone canon and clarify tenant grouping semantics infotech net-kingdom finished codex netkingdom P1 2026-08-22 2026-08-22 869a6cfe-60e3-52af-8fad-895e3204a9e8

NK-WP-0028 — Canon publication and grouping semantics

Authorized by the operator on 2026-08-22 after repository triage. This work publishes the zone-engine owner draft, reconciles its authoritative workload reference semantics with Tenancy Posture, resolves ADR-0013's now-load-bearing grouping ambiguity, and makes the existing ADR set publication-addressable.

Publish and integrate Security Zones v0.1

id: NK-WP-0028-T01
status: done
priority: high
state_hub_task_id: "e2fb5fe9-0453-5a7b-b619-7001ccf4d345"

Reviewed zone-engine revision a510393 against Tenancy Posture Decisions 5.6.1 and 5.6.2 and RMGR-ADR-004. Published it as proposed canon at canon/standards/security-zones_v0.1.md, retaining workload-only zone membership, explicit not-applicable for native non-workload subjects, and unknown for missing or ambiguous workload references. Replaced the tenancy schema's placeholder zones: object with the standard's five memberships, admission context, evidence, and review fields.

Clarify current grouping versus historical identifier segment

id: NK-WP-0028-T02
status: done
priority: high
state_hub_task_id: "320bde34-ca8e-5e69-894f-f8c64f63d3f2"

Amended NK-ADR-0013 so the immutable tenant identifier retains its onboarding-time grouping segment as history while tenant-engine.grouping is the mutable, authoritative current classification. Consumers may not derive current policy, guardrail, or spend-ceiling inputs by splitting a tenant id. Propagated the ruling to IAM Profile v0.3 and the Tenant Engine Boundary Contract.

Add publication metadata and ignore generated architecture cache

id: NK-WP-0028-T03
status: done
priority: medium
state_hub_task_id: "1016e683-f247-5029-b7da-d5289d10dba3"

Added unique NK-ADR-* identifiers plus owner, revision, review date, and review interval metadata to ADR-0006 through ADR-0015 that exist in this repo. Recorded the security-zone source revision and added the generated architecture AST cache to .gitignore.

Verification

id: NK-WP-0028-T04
status: done
priority: medium
state_hub_task_id: "339bcd81-484a-5040-831c-fea5b8c74bf0"

Verified the JSON schema parses, all 14 tenancy-posture unit tests pass, and the repository diff has no whitespace errors. Seven estate declarations were also checked: five validate; the previously-routed flex-auth implemented A2 drift and railiance-platform apps-pg R2/V1 evidence drift remain owner work and are not regressions from this change. Workplan state was reconciled with State Hub. Remaining external decisions stay tracked as waits in NK-WP-0027 and NK-WP-0022.