feat: adopt security zones and explicit workload refs

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

docs/adr/ADR-0006-enforcement-is-zone-scoped.md

@@ -4,18 +4,18 @@ type: adr
 title: "ADR-0006 — Enforcement is zone-scoped, never a global flag"
 domain: infotech
 repo: ops-warden
-status: accepted
+status: superseded
 version: "1.0"
 revision: "1"
 owner: ops-warden
 binds: "ops-warden"
 created: "2026-08-19"
-updated: "2026-08-19"
+updated: "2026-08-22"
 last_reviewed: "2026-08-19"
 review_interval: 6m
 enforced_by: "warden.yaml policy.enabled; scripts/check_policy_caller_identity.py; zone-engine ZONE-WP-0001; WARDEN-WP-0032"
 supersedes: ""
-successor: ""
+successor: "ops-warden-adr-0009"
 ---
 
 # ADR-0006 — Enforcement is zone-scoped, never a global flag

docs/adr/ADR-0009-adopt-security-zones-as-a-consumer.md

@@ -0,0 +1,101 @@
+---
+id: ops-warden-adr-0009
+type: adr
+title: "ADR-0009 — Adopt security-zones v0.1 as a consumer"
+domain: infotech
+repo: ops-warden
+status: accepted
+version: "1.0"
+revision: "1"
+owner: ops-warden
+binds: "ops-warden"
+created: "2026-08-22"
+updated: "2026-08-22"
+last_reviewed: "2026-08-22"
+review_interval: 3m
+enforced_by: "tenancy.yaml; registry/routing/catalog.yaml workload_ref; scripts/build_flex_auth_registry.py; src/warden/policy.py; src/warden/config.py"
+supersedes: "ops-warden-adr-0006"
+successor: ""
+---
+
+# ADR-0009 — Adopt security-zones v0.1 as a consumer
+
+## Status
+
+Accepted 2026-08-22 after zone-engine completed `ZONE-WP-0001-T03/T05` and
+published the declaration, compilation, stance, and failure-mode contract in
+canon revision `337484a`; zone-engine's reference compiler is revision
+`9b6ada7`.
+
+## Context
+
+ADR-0006 rejected a repo-wide `policy.enabled` switch because one boolean plus
+one `fail_closed` value made flex-auth a uniform dependency of every signing
+path, including continuity paths needed to repair that dependency. It deferred
+the replacement to zone-engine rather than designing an estate model here.
+
+The owning model now exists. A zone is an evidenced workload-admission fact;
+control stance remains with the control owner, and dependency failure behavior
+remains with the PEP. Membership resolves only through an authoritative
+workload identity. Missing identity, membership, admission evidence, or a
+required floor is `unknown`, never an inferred permissive zone.
+
+## Decision
+
+Ops-warden adopts `security-zones_v0.1` and accepts its initial build-stage rows
+for the controls ops-warden owns:
+
+- the pre-sign PEP fails open for `z0-experimental`, `z1-operational`,
+  `z2-protected`, `z2-continuity`, and build-profile `unknown`; it fails closed
+  for `z3-critical`;
+- the agent high-risk read boundary remains enforced and fail-closed in every
+  zone and for `unknown`;
+- `warden plan` never derives `autonomous` authority from unknown zone evidence.
+
+The implementation follows four rules:
+
+1. `policy.enabled` and the global `policy.fail_closed` setting are retired and
+   rejected by configuration loading. The PEP chooses failure behavior from a
+   total per-zone map.
+2. The existing compiled flex-auth registry is the resource-membership carrier.
+   Actor resources receive `workload_id`, `security_zone`,
+   `security_zone_admission`, and `security_zone_revision`. The dormant
+   `trust_zone: platform` constant is removed; it is not repurposed.
+3. Workload joins are explicit. Managed deployables use Repo Manager's exact
+   `(rapp_id, workload_identity.name, deployable?)` tuple. Independent
+   operational workloads use their owner-reviewed `tenancy.yaml`. Catalog
+   owners distinguish `not-applicable` from applicable-but-`unknown`; no path or
+   repository-name inference is allowed.
+4. A fail-open signing result is metadata, not silence. Signature and unified
+   audit records carry the selected zone, failure mode, outcome, and decision id
+   when one exists.
+
+Ops-warden itself declares `z1-operational`. That is an accuracy decision: the
+workload has M1 evidence and does not yet have the SLO history, on-call rotation,
+or exercised recovery evidence needed for z2 admission.
+
+## Consequences
+
+The global flip and its failure cycle no longer exist. An unknown target remains
+observable and follows the versioned build profile without manufacturing
+membership. A future organization-posture graduation changes the versioned
+control profile, not each workload declaration.
+
+The flex-auth policy package still owns pre-sign stance. Ops-warden can compile
+and send the membership attributes, handle `allow`/`audit_only`/deny, and apply
+the correct PEP failure mode; it does not write flex-auth's Rego rows.
+
+Catalog coverage is intentionally honest at adoption: exact references resolve
+where authoritative declarations exist, applicable lanes without one report
+`unknown` with a reason, and generic actions/patterns are explicitly
+`not-applicable`. Resolution coverage improves by adding owner declarations,
+never by adding heuristics here.
+
+## Related
+
+- `security-zones_v0.1` (net-kingdom canon revision `337484a`; zone-engine
+  compiler revision `9b6ada7`)
+- Repo Manager `helixforge.workloads.ops-warden-reference.v1` revision `890f3b0`
+- NetKingdom tenancy-posture Decisions 5.6.1/5.6.2
+- `WARDEN-WP-0032`
+- `ADR-0004`, `ADR-0007`, and `ADR-0008`

docs/adr/README.md

@@ -67,6 +67,7 @@ and the publication is a defect.
 | `ADR-0003` | Cover gaps, but never silently own them | ops-warden |
 | `ADR-0004` | High-risk lanes refuse raw value streaming to agent sessions | ops-warden, and any agent runtime calling `warden access` |
 | `ADR-0005` | Implement one lane narrowly, route everything else | ops-warden |
-| `ADR-0006` | Enforcement is zone-scoped, never a global flag | ops-warden |
+| `ADR-0006` | Enforcement is zone-scoped, never a global flag (**superseded by ADR-0009**) | ops-warden |
 | `ADR-0007` | Build-stage permissiveness stops at credential disclosure | ops-warden |
 | `ADR-0008` | A lane's risk grade covers every field its path discloses | ops-warden |
+| `ADR-0009` | Adopt security-zones v0.1; compile explicit membership and select PEP failure mode per zone | ops-warden |

docs/evidence/security-zone-admission-2026-08-22.md

@@ -0,0 +1,34 @@
+# Ops-warden security-zone admission evidence — 2026-08-22
+
+This record supports the `z1-operational` membership declared in
+`tenancy.yaml`. It does not claim the M2 gates that ops-warden has not met.
+
+## Identity and scope
+
+- Workload id: `ops-warden`.
+- Runtime binding: Kubernetes ServiceAccount
+  `system:serviceaccount:ops-warden:ops-warden`, issued by railiance01 and
+  verified against the enforcing flex-auth pin on 2026-08-19.
+- Responsible party: `team:platform-security` in this repository.
+- Scope: attended issuance of short-lived SSH certificates plus a pointer-only
+  credential catalog. Secret values are not stored in the catalog or audit.
+
+## M1 evidence
+
+- Owned front door: `warden sign` is the sole certificate-issuance interface;
+  actor inventory, principal allow-list, and TTL ceilings are enforced before
+  the CA backend.
+- Basic service objective: production signing is bounded by the actor TTL
+  policy (`adm` 48h, `agt` 24h, `atm` 8h); `warden status` and the production
+  verification records expose backend readiness.
+- Data handling: `ADR-0002` makes ops-warden a transparent conduit and
+  `ADR-0004`/`ADR-0007` prevent raw agent reads and fail safe on ungraded lanes.
+- Policy path: `history/2026-08-19-flex-auth-caller-identity-evidence.md` proves
+  the authenticated caller path and anonymous rejection.
+
+## Why not z2
+
+Ops-warden has security review artifacts, but not the complete M2 promotion
+set: there is no SLO history, on-call rotation, or exercised signing-path
+incident/recovery runbook. Its tenancy posture therefore remains V0 and its
+accurate zone membership remains `z1-operational`.