feat: adopt security zones and explicit workload refs

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

SCOPE.md

@@ -17,7 +17,7 @@ access guidance aligned with NetKingdom canon.
 
 ---
 
-## Where we are (2026-08-11)
+## Where we are (2026-08-22)
 
 ops-warden **issues short-lived SSH certificates and routes every other credential
 need to the subsystem that owns it.** SSH signing is **production-verified** on
@@ -48,14 +48,13 @@ the read-only conformance checker `scripts/check_secret_posture_conformance.py`
 and the dev-tier contract-double library `warden.doubles` (T4). Canon landing in
 net-kingdom / info-tech-canon is owner-driven (tracked via coordination messages, T5).
 
-**Policy gate** is shipped on the caller side (WP-0007) with production registry
-and smoke evidence (WP-0009 archived). flex-auth published the `ssh-certificate`
-policy package (FLEX-WP-0006) and now runs the in-cluster pin
-`flex-auth-ops-warden` (FLEX-WP-0007 finished; FLEX-WP-0016). `policy.enabled`
-remains **false**: that pin is in `callerAuth.mode: warn` because ops-warden sent
-no caller identity. WP-0031 ships the calling side (`policy.caller_auth` +
-`scripts/check_policy_caller_identity.py`); the flip waits on an operator picking
-a token source and flex-auth then enforcing.
+**The policy gate is zone-aware.** The caller-identity path is production proven
+and the flex-auth pin enforces caller authentication. WP-0032 adopted
+`security-zones_v0.1`: the repo-wide `policy.enabled` and `policy.fail_closed`
+settings are retired, target workload membership compiles into flex-auth resource
+attributes, and ops-warden selects dependency failure behavior from the target
+zone. Unknown membership is explicit and uses the versioned build profile.
+Ops-warden itself declares `z1-operational` in `tenancy.yaml`.
 
 **ops-bridge cert_command pilot** is shipped to pilot-ready (WP-0016): a read-only
 readiness gate (`scripts/check_tunnel_cert_readiness.py`) plus an opt-in offline
@@ -82,7 +81,7 @@ for warden-sign) but is used by 2 of 24 lanes. See
 **INTENT alignment:** SSH issuance mission met in production. All ops-warden workplans
 through WP-0029 are finished except WP-0027 (`backlog`) and WP-0030 (`proposed`).
 Remaining distance is in other repos' lanes: ops-bridge running the cert_command pilot
-cutover, flex-auth runtime deployment (FLEX-WP-0007, unblocks `policy.enabled: true`),
+cutover, flex-auth publishing the zone-aware pre-sign stance package,
 the owner-driven WP-0015 canon landing, and — newly named — the missing owner front
 doors that keep ops-warden holding interim lanes (secrets-engine, tenant-engine).
 
@@ -153,9 +152,10 @@ superseding ADR, never an in-place edit.
 | `ADR-0003` | Cover gaps, but never silently own them |
 | `ADR-0004` | High-risk lanes refuse raw value streaming to agent sessions |
 | `ADR-0005` | Implement one lane narrowly, route everything else |
-| `ADR-0006` | Enforcement is zone-scoped, never a global flag (`policy.enabled` stays off until WP-0032) |
+| `ADR-0006` | Superseded: enforcement is zone-scoped, never a global flag |
 | `ADR-0007` | Build-stage permissiveness stops at credential disclosure; every lane carries an explicit `risk` grade |
 | `ADR-0008` | A lane's risk grade covers every field its path discloses, not just the field it is named after |
+| `ADR-0009` | Adopt security-zones v0.1 and compile explicit workload membership; PEP failure mode is per zone |
 
 Rules we follow but do not own — NetKingdom canon, the IAM profile, the
 credential-management standard, the-custodian's ADR-001 workplan convention — are
@@ -188,7 +188,8 @@ for the rest.
 - `cert_command`: `warden sign <actor> --pubkey <path>` → cert on stdout
 - TTL enforcement per `ActorType` (`adm` 48 h, `agt` 24 h, `atm` 8 h)
 - `warden status`, cleanup, scorecard, signatures log
-- Opt-in flex-auth policy gate (`policy.enabled`, `policy_decision_id` in log)
+- Zone-aware flex-auth policy gate (`policy_decision_id`, zone, failure mode, and
+  outcome in the signing audit; no repo-wide enable switch)
 - Production flex-auth registry builder (`scripts/build_flex_auth_registry.py`,
   `registry/flex-auth/production_registry_snapshot.json`)
 - Policy gate smoke runner (`scripts/policy_gate_production_smoke.sh`)
@@ -247,7 +248,7 @@ for the rest.
 | --- | --- |
 | WP-0001–0005 | Initial CLI, quality, hygiene, OpenBao docs, hub sync |
 | WP-0006 | Credential routing, security map, inventory patterns, OpenBao checklist |
-| WP-0007 | Opt-in flex-auth policy gate (`policy.enabled`) |
+| WP-0007 | Original opt-in flex-auth policy gate (global switch retired by WP-0032) |
 | WP-0008 | Production sign verification, stewardship closeout, archive hygiene |
 | WP-0009 | flex-auth registry + policy smoke; pickup brief for FLEX-WP-0007 |
 | WP-0010 | Access routing charter + pointer catalog |
@@ -280,7 +281,7 @@ for the rest.
 | WP | Status | Focus |
 | --- | --- | --- |
 | WP-0027 | `backlog` | Tamper-resistant credential governance + mass rotation/lockdown (Strand B follow-on to WP-0026) |
-| WP-0032 | `proposed` | Adopt security zones as a consumer — retire the global `policy.enabled` (model owned by `zone-engine`) |
+| WP-0032 | `finished` | Security zones adopted — global switch retired, explicit workload references compiled, and owner policy live |
 | WP-0030 | `proposed` | Delegation register — record intended owner + blocker on every interim lane, `warden route gaps`, promotion gate |
 
 Remaining production distance is also in other repos' lanes (see Known gaps).
@@ -356,10 +357,10 @@ Remaining production distance is also in other repos' lanes (see Known gaps).
 - **Policy gate:** caller shipped (WP-0007); registry + smoke complete (WP-0009 archived).
   WP-0031 shipped the calling identity and flex-auth's pin now runs
   `callerAuth.mode: enforce` (FLEX-WP-0016) — the gate is **ready and verified**
-  (`decision:f3f7c88f9585582a`, anonymous `/v1/check` -> 401). `policy.enabled`
-  remains **false by decision**, not by blocker: `ADR-0006` scopes enforcement to
-  security zones, which `zone-engine` defines (`ZONE-WP-0001`). Re-check with
-  `scripts/check_policy_caller_identity.py`
+  (`decision:f3f7c88f9585582a`, anonymous `/v1/check` -> 401). WP-0032 and
+  `ADR-0009` retired the global switch: the compiled target workload selects the
+  zone, flex-auth owns stance, and ops-warden applies the zone's PEP failure mode.
+  Re-check caller identity with `scripts/check_policy_caller_identity.py`.
 - **Workload posture:** WP-0015 shipped (standard, descriptors, `warden policy`,
   conformance checker, dev doubles); canon landing owner-driven
 - **ops-bridge cert_command:** WP-0016 shipped to pilot-ready (readiness gate +