db2ef631c6
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb
85 lines
2.9 KiB
Markdown
85 lines
2.9 KiB
Markdown
---
|
|
id: NK-WP-0028
|
|
type: workplan
|
|
title: "Publish zone canon and clarify tenant grouping semantics"
|
|
domain: infotech
|
|
repo: net-kingdom
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
planning_priority: P1
|
|
created: "2026-08-22"
|
|
updated: "2026-08-22"
|
|
state_hub_workstream_id: "869a6cfe-60e3-52af-8fad-895e3204a9e8"
|
|
---
|
|
|
|
# NK-WP-0028 — Canon publication and grouping semantics
|
|
|
|
Authorized by the operator on 2026-08-22 after repository triage. This work
|
|
publishes the zone-engine owner draft, reconciles its authoritative workload
|
|
reference semantics with Tenancy Posture, resolves ADR-0013's now-load-bearing
|
|
grouping ambiguity, and makes the existing ADR set publication-addressable.
|
|
|
|
## Publish and integrate Security Zones v0.1
|
|
|
|
```task
|
|
id: NK-WP-0028-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "e2fb5fe9-0453-5a7b-b619-7001ccf4d345"
|
|
```
|
|
|
|
Reviewed zone-engine revision `a510393` against Tenancy Posture Decisions 5.6.1
|
|
and 5.6.2 and RMGR-ADR-004. Published it as proposed canon at
|
|
`canon/standards/security-zones_v0.1.md`, retaining workload-only zone
|
|
membership, explicit `not-applicable` for native non-workload subjects, and
|
|
`unknown` for missing or ambiguous workload references. Replaced the tenancy
|
|
schema's placeholder `zones:` object with the standard's five memberships,
|
|
admission context, evidence, and review fields.
|
|
|
|
## Clarify current grouping versus historical identifier segment
|
|
|
|
```task
|
|
id: NK-WP-0028-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "320bde34-ca8e-5e69-894f-f8c64f63d3f2"
|
|
```
|
|
|
|
Amended NK-ADR-0013 so the immutable tenant identifier retains its
|
|
onboarding-time grouping segment as history while `tenant-engine.grouping` is
|
|
the mutable, authoritative current classification. Consumers may not derive
|
|
current policy, guardrail, or spend-ceiling inputs by splitting a tenant id.
|
|
Propagated the ruling to IAM Profile v0.3 and the Tenant Engine Boundary
|
|
Contract.
|
|
|
|
## Add publication metadata and ignore generated architecture cache
|
|
|
|
```task
|
|
id: NK-WP-0028-T03
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "1016e683-f247-5029-b7da-d5289d10dba3"
|
|
```
|
|
|
|
Added unique `NK-ADR-*` identifiers plus owner, revision, review date, and
|
|
review interval metadata to ADR-0006 through ADR-0015 that exist in this repo.
|
|
Recorded the security-zone source revision and added the generated architecture
|
|
AST cache to `.gitignore`.
|
|
|
|
## Verification
|
|
|
|
```task
|
|
id: NK-WP-0028-T04
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "339bcd81-484a-5040-831c-fea5b8c74bf0"
|
|
```
|
|
|
|
Verified the JSON schema parses, all 14 tenancy-posture unit tests pass, and the
|
|
repository diff has no whitespace errors. Seven estate declarations were also
|
|
checked: five validate; the previously-routed flex-auth `implemented A2` drift
|
|
and railiance-platform apps-pg R2/V1 evidence drift remain owner work and are
|
|
not regressions from this change. Workplan state was reconciled with State Hub.
|
|
Remaining external decisions stay tracked as waits in NK-WP-0027 and
|
|
NK-WP-0022.
|