feat: adopt security zones and explicit workload refs

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

scripts/build_flex_auth_registry.py

@@ -55,12 +55,79 @@ def _caring_descriptor(actor_type: str, resource_id: str) -> dict[str, Any]:
     }
 
 
-def build_registry(inventory: dict[str, Any]) -> dict[str, Any]:
+def _resolved_by_workload(zone_resolutions: dict[str, Any] | None) -> dict[str, Any]:
+    records = (zone_resolutions or {}).get("records") or []
+    resolved: dict[str, Any] = {}
+    for record in records:
+        workload_id = str(record.get("workload_id") or "")
+        if not workload_id:
+            continue
+        if workload_id in resolved:
+            raise ValueError(f"duplicate security-zone resolution for {workload_id!r}")
+        resolved[workload_id] = record
+    return resolved
+
+
+def _zone_attributes(
+    actor: str,
+    entry: dict[str, Any],
+    resolutions: dict[str, Any],
+) -> dict[str, Any]:
+    subject = entry.get("zone_subject")
+    if not isinstance(subject, dict):
+        return {
+            "security_zone": "unknown",
+            "security_zone_admission": "unknown",
+            "security_zone_reason": "catalog_applicability_absent",
+        }
+    applicability = subject.get("applicability")
+    if applicability == "not-applicable":
+        reason = str(subject.get("reason") or "").strip()
+        if not reason:
+            raise ValueError(f"{actor}.zone_subject.reason is required")
+        return {
+            "security_zone": "unknown",
+            "security_zone_admission": "not-applicable",
+            "security_zone_reason": reason,
+        }
+    if applicability != "applicable":
+        raise ValueError(
+            f"{actor}.zone_subject.applicability must be applicable or not-applicable"
+        )
+    workload_id = str(subject.get("workload_id") or "").strip()
+    if not workload_id:
+        return {
+            "security_zone": "unknown",
+            "security_zone_admission": "unknown",
+            "security_zone_reason": "workload_reference_absent",
+        }
+    record = resolutions.get(workload_id)
+    if record is None:
+        return {
+            "workload_id": workload_id,
+            "security_zone": "unknown",
+            "security_zone_admission": "unknown",
+            "security_zone_reason": "workload_resolution_absent",
+        }
+    return {
+        "workload_id": workload_id,
+        "security_zone": str(record.get("effective_zone") or "unknown"),
+        "security_zone_declared": record.get("declared_zone"),
+        "security_zone_admission": str(record.get("admission") or "unknown"),
+        "security_zone_reason": str(record.get("admission_reason") or "unknown"),
+        "security_zone_revision": record.get("membership_revision"),
+    }
+
+
+def build_registry(
+    inventory: dict[str, Any], zone_resolutions: dict[str, Any] | None = None
+) -> dict[str, Any]:
     actors: dict[str, Any] = inventory.get("actors") or {}
     resources: list[dict[str, Any]] = []
     subjects: list[dict[str, Any]] = []
     groups: dict[str, list[str]] = {gid: [] for gid in GROUP_BY_TYPE.values()}
     relationships: list[dict[str, Any]] = []
+    resolutions = _resolved_by_workload(zone_resolutions)
 
     for name, entry in sorted(actors.items()):
         actor_type = str(entry["type"])
@@ -74,7 +141,6 @@ def build_registry(inventory: dict[str, Any]) -> dict[str, Any]:
                 "id": resource_id,
                 "type": "ssh-certificate",
                 "labels": ["ssh-signing", actor_type],
-                "trust_zone": "platform",
                 "owner": "team:platform-security",
                 "attributes": {
                     "actor_id": name,
@@ -82,6 +148,7 @@ def build_registry(inventory: dict[str, Any]) -> dict[str, Any]:
                     "allowed_subjects": [name, f"iam:{name}"],
                     "allowed_principals": principals,
                     "max_ttl_hours": ttl_hours,
+                    **_zone_attributes(name, entry, resolutions),
                 },
             }
         )
@@ -156,8 +223,8 @@ def build_registry(inventory: dict[str, Any]) -> dict[str, Any]:
                 "caring_profiles": ["caring-0.4.0-rc2"],
                 "metadata": {
                     "flex_auth_contract": "protected-system-v0",
-                    "ops_warden_policy_gate": "v2",
-                    "policy_enabled_config": "policy.enabled",
+                    "ops_warden_policy_gate": "security-zones-v0.1",
+                    "security_zone_standard": "security-zones_v0.1",
                     "tenant": "tenant:platform",
                 },
             }
@@ -186,14 +253,24 @@ def main() -> None:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("inventory", type=Path, help="ops-warden inventory.yaml")
     parser.add_argument("-o", "--output", type=Path, required=True)
+    parser.add_argument(
+        "--zone-resolutions",
+        type=Path,
+        help="zone-engine resolved-view JSON; absent references remain unknown",
+    )
     args = parser.parse_args()
 
     inventory = yaml.safe_load(args.inventory.read_text()) or {}
-    registry = build_registry(inventory)
+    zone_resolutions = (
+        json.loads(args.zone_resolutions.read_text())
+        if args.zone_resolutions is not None
+        else None
+    )
+    registry = build_registry(inventory, zone_resolutions)
     args.output.parent.mkdir(parents=True, exist_ok=True)
     args.output.write_text(json.dumps(registry, indent=2) + "\n")
     print(f"Wrote {args.output} ({len(registry['subjects'])} actors)")
 
 
 if __name__ == "__main__":
-    main()
+    main()