tegwick bee22db620

CI Smoke / host-smoke (push) Successful in 0s

Details

CI Smoke / container-smoke (push) Successful in 1s

Details

docs(canon): reconcile workload and tenant grouping semantics

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

2026-08-22 14:53:31 +02:00

2.6 KiB

Raw Blame History

id	type	title	domain	repo	status	owner	topic_slug	planning_priority	created	updated
NK-WP-0028	workplan	Publish zone canon and clarify tenant grouping semantics	infotech	net-kingdom	finished	codex	netkingdom	P1	2026-08-22	2026-08-22

NK-WP-0028 — Canon publication and grouping semantics

Authorized by the operator on 2026-08-22 after repository triage. This work publishes the zone-engine owner draft, reconciles its authoritative workload reference semantics with Tenancy Posture, resolves ADR-0013's now-load-bearing grouping ambiguity, and makes the existing ADR set publication-addressable.

Publish and integrate Security Zones v0.1

id: NK-WP-0028-T01
status: done
priority: high

Reviewed zone-engine revision a510393 against Tenancy Posture Decisions 5.6.1 and 5.6.2 and RMGR-ADR-004. Published it as proposed canon at canon/standards/security-zones_v0.1.md, retaining workload-only zone membership, explicit not-applicable for native non-workload subjects, and unknown for missing or ambiguous workload references. Replaced the tenancy schema's placeholder zones: object with the standard's five memberships, admission context, evidence, and review fields.

Clarify current grouping versus historical identifier segment

id: NK-WP-0028-T02
status: done
priority: high

Amended NK-ADR-0013 so the immutable tenant identifier retains its onboarding-time grouping segment as history while tenant-engine.grouping is the mutable, authoritative current classification. Consumers may not derive current policy, guardrail, or spend-ceiling inputs by splitting a tenant id. Propagated the ruling to IAM Profile v0.3 and the Tenant Engine Boundary Contract.

Add publication metadata and ignore generated architecture cache

id: NK-WP-0028-T03
status: done
priority: medium

Added unique NK-ADR-* identifiers plus owner, revision, review date, and review interval metadata to ADR-0006 through ADR-0015 that exist in this repo. Recorded the security-zone source revision and added the generated architecture AST cache to .gitignore.

Verification

id: NK-WP-0028-T04
status: done
priority: medium

Verified the JSON schema parses, all 14 tenancy-posture unit tests pass, and the repository diff has no whitespace errors. Seven estate declarations were also checked: five validate; the previously-routed flex-auth implemented A2 drift and railiance-platform apps-pg R2/V1 evidence drift remain owner work and are not regressions from this change. Workplan state was reconciled with State Hub. Remaining external decisions stay tracked as waits in NK-WP-0027 and NK-WP-0022.

2.6 KiB Raw Blame History