feat: adopt security zones and explicit workload refs

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

workplans/WARDEN-WP-0032-security-zones.md

@@ -4,14 +4,14 @@ type: workplan
 title: "Adopt security zones as a consumer — retire the global policy.enabled"
 domain: infotech
 repo: ops-warden
-status: proposed
+status: finished
 owner: ops-warden
 topic_slug: netkingdom
 planning_priority: P1
 depends_on_workplans:
   - WARDEN-WP-0031
 created: "2026-08-19"
-updated: "2026-08-19"
+updated: "2026-08-22"
 state_hub_workstream_id: "f1b6cdcb-5e16-48ab-a72b-339e909e92f0"
 ---
 
@@ -98,7 +98,7 @@ this repo's own input rather than out of supplying a new one.
 
 ```task
 id: WARDEN-WP-0032-T02
-status: wait
+status: done
 priority: high
 state_hub_task_id: "08735f17-fe7e-4a6a-9b71-f350f98c30b1"
 ```
@@ -144,9 +144,39 @@ Good news for T03's cost: **no flex-auth registry schema change is required.**
 `metadata`, `labels` and `attributes` already flatten into the rego input, so the
 compiler can emit membership today.
 
+**Consumer implementation landed in the working tree 2026-08-22.** The config
+loader rejects the retired `policy.enabled` and global `policy.fail_closed`
+keys. `scripts/build_flex_auth_registry.py` now emits the normative
+`workload_id`, `security_zone`, `security_zone_declared`,
+`security_zone_admission`, `security_zone_reason`, and
+`security_zone_revision` attributes; the dormant `trust_zone` field is gone.
+The PEP reads compiled resource membership and applies its local per-zone
+failure mode. Sign and audit records retain the zone, selected failure mode,
+outcome, and decision id.
+
+The legacy `--no-policy` proxy switch remains only as a rejected compatibility
+flag. It can no longer bypass the gate: unresolved credential targets take the
+explicit `unknown` profile and its configured failure mode.
+
+**Done 2026-08-22.** flex-auth package v2 (commit `e521e7b`) supplies total
+stance over every v0.1 zone plus `unknown`, preserves native enforcement for
+`not-applicable`, and returns `audit_only` for advisory decisions. The required
+live caller check passed through the existing tunnel with command-mode caller
+identity and decision `decision:f3f7c88f9585582a`; the check used a temporary
+migrated copy because the operator's persistent config still carries the two
+retired keys. Full repo tests pass and sign/audit evidence records zone,
+failure mode, outcome, and decision id.
+
+The required readiness recheck was run on 2026-08-22 after `warden plan`
+returned `autonomous`. It correctly returned **NOT READY** before obtaining or
+printing any token because the active operator `warden.yaml` still contains
+the two retired global keys. Operator configuration migration is therefore an
+explicit remaining acceptance step, followed by the value-safe live
+`/v1/check` smoke. Do not ask flex-auth to enforce caller authentication yet.
+
 ```task
 id: WARDEN-WP-0032-T03
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "fd642377-8d64-473c-b684-f8f1a842c223"
 ```
@@ -183,9 +213,16 @@ carries membership. Carry the conformance rule:
 *accuracy, not altitude*. Declaring a stricter zone than can be evidenced is the
 failure mode that looks like progress.
 
+**Done 2026-08-22.** `tenancy.yaml` now declares ops-warden as an independently
+governed operational execution unit with its Kubernetes service-account
+binding, and admits it to `z1-operational` at `M1`, `medium`, `internal`.
+`docs/evidence/security-zone-admission-2026-08-22.md` records why this is the
+highest evidenced admission rather than an aspirational `M2`. The declaration
+passes net-kingdom's current `tenancy-posture_v0.1` validator.
+
 ```task
 id: WARDEN-WP-0032-T04
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "1af3d26e-ce21-46ca-a56c-486d52b76dcb"
 ```
@@ -195,6 +232,13 @@ state_hub_task_id: "1af3d26e-ce21-46ca-a56c-486d52b76dcb"
 owning it — a superseding record, never an in-place edit. Update `SCOPE.md`,
 `wiki/WorkloadSecurityPosture.md`, and `wiki/PolicyGatedSigning.md` with it.
 
+**Done 2026-08-22.** ADR-0006 is marked superseded without rewriting its
+decision. ADR-0009 accepts `security-zones_v0.1` as a consumer, records the
+PDP/PEP split and unknown handling, and is indexed as its successor. `SCOPE.md`,
+`wiki/WorkloadSecurityPosture.md`, `wiki/PolicyGatedSigning.md`, configuration
+guidance, access guidance, and affected playbooks now describe the zone-aware
+control and do not instruct operators to use a global bypass.
+
 ```task
 id: WARDEN-WP-0032-T05
 status: done
@@ -241,7 +285,7 @@ policy covers these paths (T06).
 
 ```task
 id: WARDEN-WP-0032-T06
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "8c082416-0ff9-45dc-8cbd-e9ca7913a6ef"
 ```
@@ -330,8 +374,53 @@ with a `workload-kv-read-*` policy. Confirming that means minting or inspecting
 tokens — a write against railiance-platform's OpenBao. Exposure stays theoretical
 to the same degree as before.
 
-**Still open:** whether the maturity-derived default replaces the `ungraded`
-sentinel entirely (waits on `ZONE-WP-0001-T03`).
+**Platform half closed 2026-08-22.** `RAILIANCE-WP-0022` consumed the generated
+high-risk path input and deployed the completed deny policy. The platform-owned
+invariants report **19 high-risk lanes, 14 concrete entries, 0 uncovered**. A
+dedicated `coding-agent-railiance-platform` AppRole then proved deny-wins with
+exactly `agent-high-risk-boundary` plus one workload read policy: data access was
+denied while metadata remained readable; its single-use test identity was
+self-revoked and no test tokens remained. Decision `f0955252` records the
+operational identity. No KV value was read.
+
+The local invariant agrees against the platform policy file: 19 high-risk lanes,
+14 concrete entries covered, 5 without a concrete address, 0 uncovered. This
+session could not independently read the deployed policy, so live-state evidence
+is the platform-owned readback above rather than a claim inferred from the local
+file.
+
+**Done 2026-08-22.** The settled model makes the two layers complementary:
+catalog CI continues to require an explicit `risk` field so omission cannot
+silently weaken the agent boundary, while `RouteEntry.risk_for_zone` implements
+the normative maturity-derived fallback for consumers evaluating unresolved or
+future inputs (`z0` + satisfied + synthetic-only → `standard`; satisfied `z3`
+→ `critical`; everything else → `high`). An explicit catalog grade always wins.
+The platform deny policy and its live proof above close the direct-OpenBao half.
+
+```task
+id: WARDEN-WP-0032-T07
+status: done
+priority: medium
+state_hub_task_id: "6b8c8181-978c-4b0a-ac7b-2cc9ad57b3ba"
+```
+
+**Adopt Repo Manager's workload-reference owner interface.** Accepted with one
+documented amendment against repo-manager revision `890f3b0`: managed
+deployables use the exact `(rapp_id, workload_identity.name)` pair and optional
+deployable name; an independently governed operational execution unit may use
+an exact local `tenancy.yaml` declaration. Native actions, actors, grants,
+patterns, and non-workload resources are explicitly `not-applicable`; unresolved
+workload-applicable references remain `unknown`. No path, owner name, or
+repository-name inference is allowed.
+
+Every one of the 27 catalog lanes now carries an explicit `workload_ref`: 3
+resolved (2 exact managed RAPP references and ops-warden's direct operational
+declaration), 17 unknown with reasons, and 7 not-applicable with reasons.
+`scripts/report_workload_join.py` resolves only those explicit references,
+Repo Manager validates the interface and resolves both managed tuples exactly,
+and regression tests reject malformed or inferred joins. This incorporates
+net-kingdom's draft-12 correction received 2026-08-22: local tenancy declaration
+is not an escape hatch for a managed running deployable.
 
 ## Related