coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Hand the zone model to zone-engine; keep WP-0032 as the consumer side
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
zone-engine is seeded and owns the security zone model as ZONE-WP-0001. Under
ADR-0005 ops-warden implements one lane narrowly and routes the rest, and an
estate-wide enforcement model is not a lane to absorb — it was ops-warden's
deferred flip that exposed the gap, not ops-warden's model to define.

WARDEN-WP-0032 is rewritten as the consumer side: hand the estate inputs to
ZONE-WP-0001-T02 (27 catalog lanes, the actor inventory, the three posture axes,
the three controls the model must express, and the compiled-registry path),
then replace policy.enabled with a zone-aware control and amend ADR-0006 to say
ops-warden follows the model rather than owning it.

ADR-0006 and SCOPE updated to point at zone-engine, which joins the related
repositories table.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-19 21:20:34 +02:00
parent b845f4b51e
commit 8c58f8bfa1
4 changed files with 65 additions and 187 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/adr/ADR-0006-enforcement-is-zone-scoped.md
View file

@ -13,7 +13,7 @@ created: "2026-08-19"
updated: "2026-08-19"
last_reviewed: "2026-08-19"
review_interval: 6m
enforced_by: "warden.yaml policy.enabled; scripts/check_policy_caller_identity.py; WARDEN-WP-0032"
enforced_by: "warden.yaml policy.enabled; scripts/check_policy_caller_identity.py; zone-engine ZONE-WP-0001; WARDEN-WP-0032"
supersedes: ""
successor: ""
---
@ -61,7 +61,7 @@ does not enable a fail-closed authorization gate globally. Before
differing rigidity, each declaring what is enforced, what is advisory, and what
is exempt — and the gate must be scoped to them.
Concretely, until WARDEN-WP-0032 defines the zone model:
Concretely, until `zone-engine`'s `ZONE-WP-0001` defines the zone model:
- `policy.enabled` stays `false`. Its readiness is evidence, not a mandate.
- A gate that is *ready* is recorded as ready. Readiness is not a reason to
@ -94,7 +94,9 @@ the zone model rather than merged with a caveat in its description.
- `WARDEN-WP-0031` — the calling side that made the flip possible (T05 deferred
under this ADR)
- `WARDEN-WP-0032` — the zone model this record defers to
- `zone-engine` `ZONE-WP-0001` — the zone model this record defers to, seeded
2026-08-19 as the owning repo
- `WARDEN-WP-0032` — ops-warden's consumer-side adoption
- `wiki/WorkloadSecurityPosture.md` — the two axes already shipped (WP-0015)
- `wiki/PolicyGatedSigning.md` — the gate itself
- `history/2026-08-19-flex-auth-caller-identity-evidence.md` — readiness evidence