feat: adopt security zones and explicit workload refs

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

examples/inventory.seed.yaml

@@ -10,6 +10,9 @@ actors:
       - agt-task-bridge
     ttl_hours: 24
     description: "ops-bridge tunnel agent for state-hub"
+    zone_subject:
+      applicability: applicable
+      workload_id: ops-bridge-tunnel
 
   agt-codex-interhub-bootstrap:
     type: agt
@@ -17,6 +20,9 @@ actors:
       - agt-interhub-bootstrap
     ttl_hours: 2
     description: "Short-lived agent access for attended Inter-Hub bootstrap"
+    zone_subject:
+      applicability: applicable
+      workload_id: codex-interhub-bootstrap
 
   adm-example:
     type: adm
@@ -24,6 +30,9 @@ actors:
       - adm-full
     ttl_hours: 48
     description: "Example human operator — replace with per-person adm-* actors"
+    zone_subject:
+      applicability: not-applicable
+      reason: human operator retains native actor identity
 
   atm-backup-daily:
     type: atm
@@ -31,6 +40,9 @@ actors:
       - atm-backup-daily
     ttl_hours: 8
     description: "Example nightly automation actor"
+    zone_subject:
+      applicability: applicable
+      workload_id: backup-daily
 
 hosts:
   example-host:
@@ -38,4 +50,4 @@ hosts:
       agt:
         - agt-task-bridge
       atm:
-        - atm-backup-daily
+        - atm-backup-daily

examples/warden.production.example.yaml

@@ -15,18 +15,24 @@ vault:
 inventory_path: ~/.config/warden/inventory.yaml
 state_dir: ~/.local/state/warden
 
-# Opt-in flex-auth gate — enable only when flex-auth is reachable at flex_auth_url.
+# Zone-aware flex-auth gate. Missing target membership is the explicit unknown
+# profile; there is no repo-wide enable switch.
 # Registry: registry/flex-auth/production_registry_snapshot.json (build from inventory).
 # See wiki/PolicyGatedSigning.md (operator checklist) and wiki/playbooks/operator-openbao-token-hygiene.md
 policy:
-  # Keep false until the flex-auth ops-warden pin runs callerAuth.mode: enforce.
-  # Gate: python scripts/check_policy_caller_identity.py  (WARDEN-WP-0031)
-  enabled: false
   # The in-cluster pin for ops-warden's signing policy (FLEX-WP-0016). A bare
   # flex-auth.flex-auth.svc Service does not exist. From a workstation, reach it
   # through a port-forward or tunnel and point this at that local address.
   flex_auth_url: http://flex-auth-ops-warden.flex-auth.svc.cluster.local:8080
-  fail_closed: true
+  zone_registry_path: registry/flex-auth/production_registry_snapshot.json
+  failure_modes:
+    z0-experimental: fail_open
+    z1-operational: fail_open
+    z2-protected: fail_open
+    z2-continuity: fail_open
+    z3-critical: fail_closed
+    unknown: fail_open
+    not-applicable: fail_closed
   tenant: tenant:platform
   subject_env: WARDEN_POLICY_SUBJECT
   system: ops-warden
@@ -44,4 +50,4 @@ policy:
     # command: kubectl create token ops-warden -n ops-warden
     #   --audience flex-auth --duration 10m
     token_env: WARDEN_POLICY_CALLER_TOKEN
-    audience: flex-auth
+    audience: flex-auth