docs: assent to v0.8 obligation 3, and price its adoption

gate-house circulated security-layer-model v0.8, whose §6.4 obligation 3
makes our `unknown: fail_open` cell non-conformant, and asked to be argued
with rather than obeyed.

Finding 1 -- assent. They wrote the falsifier into GH-DEC-2026-009: a scope
genuinely unknown AND genuinely low-consequence, expected to be a §5.1
read-only diagnostic. We looked and do not have one. The stance map governs
`warden sign` -- a credential-issuing side effect -- so §5.1 does not reach
it and the argument stands. Being unclassifiable must not buy permissiveness.

Finding 2 -- adopting it today would be a global fail-closed flag in all but
name. Of four signing targets, zero resolve to a zone and three are
`unknown`, so the cell would fail closed on essentially every certificate
during a flex-auth outage -- including the SSH certificate needed to reach
the host and repair flex-auth. That is exactly ADR-0006's rejected
configuration reached by another route. Asked for a dated transition gated
on coverage, or failing that for §13.1 to record coverage alongside stance:
a row reading `unknown: fail_closed` while every target is unknown is
conformant and misleading.

Not flipping the cell. It is a proposed standard, 18 of our 18 unknown
lanes are unknown because another repo has not declared, and ADR-0009 rule 3
forbids closing that with inference -- a stricter stance is not a licence to
manufacture the membership that makes it survivable. WARDEN-WP-0040 records
the order: classify the continuity path, raise coverage by asking owners,
then supersede ADR-0009's unknown row.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013EPuTc18FjU5WFqoSEKH3C

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1276224@bnt-lap001
Assistant-Session: 426ec497-e1c4-4dd3-b417-dfce1ca1dbc3

workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md

@@ -0,0 +1,122 @@
+---
+id: WARDEN-WP-0040
+type: workplan
+title: "Adopt unknown -> fail_closed behind signing-target classification coverage"
+domain: infotech
+repo: ops-warden
+status: proposed
+owner: ops-warden
+topic_slug: netkingdom
+planning_priority: P1
+depends_on_workplans:
+  - WARDEN-WP-0032
+  - WARDEN-WP-0034
+created: "2026-09-09"
+updated: "2026-09-09"
+---
+
+# WARDEN-WP-0040 — `unknown` → `fail_closed`, in the right order
+
+security-layer-model v0.8 §6.4 obligation 3 (proposed, 2026-09-06) rules that
+`unknown` is not a zone and must resolve to `fail_closed`. ops-warden's
+`pep-stance.yaml` declares `unknown: fail_open` under `ADR-0009`.
+
+**We agree with the rule.** `history/2026-09-09-layer-model-v08-review.md` records
+the assent and why our falsifier check failed: the cell governs certificate
+issuance, not a §5.1 read-only diagnostic, so nothing rescues it.
+
+**We disagree with adopting it first.** Measured 2026-09-09: of four signing
+targets, zero resolve to a zone, three are `unknown`, one is `not-applicable`.
+Flipping the cell today makes flex-auth a hard dependency of essentially every
+certificate — `ADR-0006`'s rejected configuration, reached by a different route,
+including the continuity path needed to repair flex-auth itself.
+
+So: coverage first, then the cell. That ordering is the whole holding of
+`ADR-0006` and the reason `ADR-0009` replaced a global switch with a zone map.
+
+## Tasks
+
+```task
+id: WARDEN-WP-0040-T01
+status: todo
+priority: high
+```
+
+**Classify the continuity path before anything else changes.**
+
+The deadlock is specific and worth naming before it is designed around: flex-auth
+unreachable → operator needs an SSH certificate to reach the host → target is
+`unknown` because nobody classified the repair path → `fail_closed` denies it.
+
+`z2-continuity` exists for this and its stance is `fail_open`, so the fix is
+classification, not an exception. Determine which actor(s) constitute the
+repair path, establish whether the declaration is ops-warden's to make (our own
+`tenancy.yaml` covers ops-warden as a workload; the actors' target workloads may
+not be ours), and route what is not.
+
+Blocks T03. Converting the cell with the repair path unclassified is the one
+outcome this workplan exists to prevent.
+
+```task
+id: WARDEN-WP-0040-T02
+status: todo
+priority: high
+```
+
+**Raise signing-target coverage, by asking owners — never by inferring.**
+
+Three actor resources report `workload_resolution_absent`:
+`agt-codex-interhub-bootstrap`, `agt-state-hub-bridge`, `atm-backup-daily`.
+Their owners (ops-bridge and the backup execution unit among them) have not
+published an authoritative workload identity declaration.
+
+`ADR-0009` rule 3 forbids closing this with path or repository-name inference,
+and that prohibition holds under pressure from this workplan specifically —
+adopting a stricter stance is not a licence to manufacture the membership that
+makes it survivable.
+
+Route to each owner with the concrete consequence: while the declaration is
+absent their actor cannot be issued a certificate during a flex-auth outage once
+the cell converts. That is a better ask than a generic request to publish a
+declaration, and it is true.
+
+Report coverage with `scripts/report_workload_join.py`; this task is done when
+coverage is stated, not when it reaches a threshold — the threshold is T03's
+gate, and owners may legitimately decline.
+
+```task
+id: WARDEN-WP-0040-T03
+status: wait
+priority: high
+```
+
+**Convert the cell and supersede `ADR-0009`'s unknown row.**
+
+Gated on T01, and on v0.8 (or its successor) reaching `accepted`. Do not convert
+against a `proposed` standard.
+
+`ADR-0009` is `owner: ops-warden`, so changing it means a superseding ADR, never
+an in-place edit (`.claude/rules/architecture.md`). The superseding record should
+carry the v0.8 argument rather than restate it: unknown is not a zone, so a §9.3
+per-zone trade was never made for that request.
+
+`pep-stance.yaml` is asserted equal to `PolicyConfig.failure_modes` by
+`tests/test_layer_conformance.py`, so the map and the code convert in one commit
+or the test fails — which is the property that makes the map worth publishing.
+
+```task
+id: WARDEN-WP-0040-T04
+status: todo
+priority: medium
+```
+
+**Return findings to gate-house and track the transition ask.**
+
+Sent 2026-09-09 with the review. Two asks, in preference order: obligation 3
+names a dated transitional state gated on coverage; or failing that, §13.1
+records classification coverage alongside stance, so a register row cannot read
+`unknown: fail_closed` while every target is unknown.
+
+If both are declined, that is an answer and this workplan proceeds unchanged —
+the cell stays a **declared gap** under §11 with this workplan as its route,
+which is what the `declared-gap` mark (our own v0.6 finding) exists to express.